A replacement CRM has had its business case approved. In preparation for a requirements workshop, an architect is working with a business analyst to ensure that appropriate security requirements…

The Business Requirements Document formally captures what the business needs from a system, including non-functional requirements such as confidentiality, integrity, availability, and compliance obligations. In enterprise architecture practice, security requirements are embedded within the BRD so they are considered from the earliest stage of solution design rather than retrofitted later. This ensures security is addressed as a business need rather than a technical afterthought.

A Requirements Traceability Matrix tracks and links requirements to design and test artifacts but does not itself capture or define requirements.

Use case and viewpoints documents describe system interactions and perspectives but are not the primary vehicle for capturing security requirements.

A Solution Overview Document describes the proposed technical solution and architecture, not the business and security requirements the solution must meet.