Software Engineering

11.2.10 
Identify data security procedures
Data security functions and procedures must be identified that protect confiden-
tial or classified information. Information security is a profession that addresses 
a broader range of computer security and information assurance challenges. Data 
security represents a subset of the information security capabilities that will be per-
formed by the software product. Information security means protecting informa-
tion and information systems from unauthorized access, use, disclosure, disruption, 
modification, perusal, inspection, recording, or destruction. Software engineering 
involves the establishment of logical controls that monitor and regulate access to 
sensitive (confidential or classified) information. Information security functions 
must be identified and the appropriate procedures defined for:
●
 
Access control
, including user account administration, identification, authentica-
tion, and authorization. Access control protects information by restricting the 
individuals who are authorized to access sensitive information.
●
 
Information security classification
, involving the identification of different data 
classification levels, the criteria for data to be assigned a particular level, and the 
required controls to govern the access to each level of sensitive information.
●
 
Cryptography
, including information encryption and decryption.