You work as a security engineer for BlueWell Inc. You are working on the ISSE model. In which of the following phases of the ISSE model is the system defined in terms of what security is needed?

Question

Options

• ADefine system security architecture
• BDevelop detailed security design
• CDiscover information protection needs
• DDefine system security requirements

• A
  8% (2)
• B
  4% (1)
• D
  88% (22)

Explanation

Option D is correct because "Define System Security Requirements" is the ISSE phase explicitly focused on translating protection needs into a formal specification of what security the system must provide - the "what," not the "how."

Why the distractors are wrong:

• A (Define system security architecture): This comes after requirements are set; it answers how security will be structured at a high level, not what is needed.
• B (Develop detailed security design): This is even further downstream - it elaborates the architecture into implementable designs. Still "how," not "what."
• C (Discover information protection needs): This phase identifies what assets and information require protection (the inputs), but it does not yet define the security requirements themselves (the outputs).

Memory tip: Map the ISSE phases to the classic engineering progression - Discover (find assets) → Define requirements (what security?) → Architecture (how overall?) → Detailed design (how specifically?). "Requirements" always answers "what is needed," which directly matches the question's wording. If you see "what security is needed," think requirements.

No community discussion yet for this question.