Appendix A Master Security Requirements Traceability Matrix：附录一主安全需求跟踪矩阵.doc

Appendix A Master Security Requirements Traceability Matrix The Master Security Requirements Traceability Matrix (SRTM) is provided as an aid in preparing an IS-specific SRTM. The Master SRTM is a Microsoft Word table that contains the complete set of security requirements applicable to DoD intelligence information systems. These requirements were extracted from Director, Central Intelligence Directive (DCID) 6/3 and the Joint DoDIIS Cryptologic SCI Information Systems Security Standards (JDCSISSS) document. The Master SRTM provides a placeholder for identifying the method to be used for verifying the IS’s compliance with applicable security requirements, a test procedure column for identifying the particular test procedure(s) that will be used to test IS compliance with applicable security requirements, a comments column for including any amplifying information, and a column to record the system’s compliance with the requirement. Security requirements associated with a particular Protection Level or Level of Concern (e.g., Integrity or Availability) that do not apply to the IS should be deleted from the table to produce an SRTM that is specific to the IS. For example, if it has been agreed that the subject IS must meet the requirements of Protection Level 2, Integrity High, and Availability Medium, then all rows in the matrix that contain Protection Level 1, 3, 4, and 5 security requirements, Integrity Basic and Medium, and Availability Basic and High should be deleted from the table. A row may be deleted by selecting the entire row, or a group of rows, and pressing the delete key. In addition, the Controlled Interface requirements should be reviewed for applicability, and may be deleted if they are deemed not applicable. In other words, if the IS is not a Controlled Interface or does not include a Controlled interface, then all Controlled Interface requirements should be deleted. All remaining security requirements should be left in the SRTM, and those