Skip to content

Commit 1acac44

Browse files
masc2023masc2023
committed
process: initial security management process
Resolves: #709, #696
1 parent 82dc32a commit 1acac44

36 files changed

+1852
-62
lines changed

‎docs/platform_management_plan/index.rst

+1
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@ Platform Management Plan
3131
project_management
3232
stakeholder_management
3333
safety_management
34+
security_management
3435
risk_management
3536
quality_management
3637
config_management

‎docs/platform_management_plan/safety_management.rst

+3-7
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
:id: doc__platform_safety_plan
1717
:status: draft
1818
:safety: ASIL_B
19-
:realizes: wp__platform_safety_plan
19+
:realizes: wp__platform_safety_plan, wp__tailoring
2020
:tags: platform_management
2121

2222
Safety management / Platform Safety Plan
@@ -117,13 +117,9 @@ Because in the S-CORE SW platform integration of safety-related systems not deve
117117

118118
Because in the S-CORE SW platform no ASIL decomposition is planned: :need:`std_wp__iso26262__analysis_551`, :need:`std_wp__iso26262__analysis_552`
119119

120-
.. workproduct:: Tailoring Document Platform
121-
:id: wp__tailoring_platform
122-
:status: valid
123-
:complies: std_wp__iso26262__management_751, std_wp__iso26262__system_652, std_wp__iso26262__system_653, std_wp__iso26262__system_654, std_wp__iso26262__system_655, std_wp__iso26262__system_656, std_wp__iso26262__system_657, std_wp__iso26262__system_751, std_wp__iso26262__system_752, std_wp__iso26262__system_851, std_wp__iso26262__system_852, std_wp__iso26262__software_1151, std_wp__iso26262__software_1152, std_wp__iso26262__software_app_c_52, std_wp__iso26262__software_app_c_54, std_wp__iso26262__software_app_c_57, std_wp__iso26262__support_551, std_wp__iso26262__support_552, std_wp__iso26262__support_553, std_wp__iso26262__support_554, std_wp__iso26262__support_555, std_wp__iso26262__support_1351, std_wp__iso26262__support_1352, std_wp__iso26262__support_1353, std_wp__iso26262__support_1451, std_wp__iso26262__support_1452, std_wp__iso26262__support_1551, std_wp__iso26262__support_1651, std_wp__iso26262__analysis_551, std_wp__iso26262__analysis_552
124120

125-
This work product instantiation links to all the work products which are tailored out in the platform safety plan,
126-
to be able to demonstrate completeness in :ref:`external_standards`
121+
Summary: :need:`wp__tailoring` links to all the work products which are tailored out in the platform safety plan,
122+
to be able to demonstrate completeness in :ref:`external_standards`
127123

128124
Approach
129125
++++++++

‎docs/platform_management_plan/security_management.rst

+452
Large diffs are not rendered by default.

‎docs/platform_management_plan/tool_management.rst

+3-1
Original file line numberDiff line numberDiff line change
@@ -12,8 +12,10 @@
1212
# SPDX-License-Identifier: Apache-2.0
1313
# *******************************************************************************
1414
15+
.. _tool_management:
16+
1517
Tool Management
16-
------------------------
18+
---------------
1719

1820
Purpose
1921
+++++++

‎docs/process/_assets/score_process_area_overview.drawio.svg

+1-1
Loading

‎docs/process/process_areas/architecture_design/architecture_workproducts.rst

+2-2
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Architecture Workproducts
2020
.. workproduct:: Feature Architecture
2121
:id: wp__feature_arch
2222
:status: valid
23-
:complies: std_wp__iso26262__software_751
23+
:complies: std_wp__iso26262__software_751, std_wp__isosae21434__development_1051
2424

2525
Feature Architecture linked to Feature Requirements, i.e. interaction of components
2626

@@ -33,7 +33,7 @@ Architecture Workproducts
3333
.. workproduct:: Component Architecture
3434
:id: wp__component_arch
3535
:status: valid
36-
:complies: std_wp__iso26262__software_751, std_wp__isopas8926__4523
36+
:complies: std_wp__iso26262__software_751, std_wp__isopas8926__4523, std_wp__isosae21434__development_1051
3737

3838
Component Architecture linked to Component Requirements
3939

‎docs/process/process_areas/change_management/change_management_workproducts.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ Work Products Change Management
2727
:id: wp__issue_track_system
2828
:status: valid
2929
:tags: change_management
30-
:complies: std_wp__iso26262__support_852, std_wp__iso26262__support_853, std_wp__iso26262__support_854, std_wp__isopas8926__4527, std_req__aspice_40__iic-13-16, std_req__aspice_40__iic-13-07, std_req__aspice_40__iic-15-55, std_req__aspice_40__iic-15-12
30+
:complies: std_wp__iso26262__support_852, std_wp__iso26262__support_853, std_wp__iso26262__support_854, std_wp__isopas8926__4527, std_req__aspice_40__iic-13-16, std_req__aspice_40__iic-13-07, std_req__aspice_40__iic-15-55, std_req__aspice_40__iic-15-12, std_wp__isosae21434__continual_8333, std_wp__isosae21434__continual_8431, std_wp__isosae21434__continual_8531, std_wp__isosae21434__continual_8631
3131

3232
| - Change request
3333
| - Change request plan

‎docs/process/process_areas/change_management/guidance/change_management_guideline.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ Guideline
1818
.. gd_guidl:: Change Request Guideline
1919
:id: gd_guidl__change__change_request
2020
:status: valid
21-
:complies: std_req__iso26262__support_8414, std_req__iso26262__support_8432, std_req__iso26262__support_8442, std_req__iso26262__support_8451
21+
:complies: std_req__iso26262__support_8414, std_req__iso26262__support_8432, std_req__iso26262__support_8442, std_req__iso26262__support_8451, std_req__isosae21434__org_management_5441, std_req__isosae21434__continual_8321, std_req__isosae21434__continual_8322, std_req__isosae21434__continual_8323
2222

2323
This document describes the general guidances for Change Management based on the concept which is defined :need:`[[title]]<doc_concept__change__process>`.
2424

‎docs/process/process_areas/change_management/guidance/change_management_impact_analysis_template.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Impact Analysis Template
2020
.. gd_temp:: Impact Analysis Template
2121
:id: gd_temp__change__impact_analysis
2222
:status: valid
23-
:complies: std_req__aspice_40__SUP-10-BP2, std_req__aspice_40__iic-18-57, std_req__iso26262__support_8431, std_req__iso26262__support_8432, std_req__isopas8926__4462
23+
:complies: std_req__aspice_40__SUP-10-BP2, std_req__aspice_40__iic-18-57, std_req__iso26262__support_8431, std_req__iso26262__support_8432, std_req__isopas8926__4462, std_req__isosae21434__continual_8322, std_req__isosae21434__continual_8421, std_req__isosae21434__continual_8521, std_req__isosae21434__continual_8522, , std_req__isosae21434__continual_8621, std_req__isosae21434__continual_8622
2424

2525
Type of Change Request
2626
----------------------

‎docs/process/process_areas/documentation_management/guidance/documentation_guideline.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ Guideline
1818
.. gd_guidl:: Documentation
1919
:id: gd_guidl__documentation
2020
:status: valid
21-
:complies: std_req__iso26262__support_1041, std_req__iso26262__support_1042, std_req__iso26262__support_1043, std_req__iso26262__support_1044, std_req__iso26262__support_1045, std_req__iso26262__support_1046
21+
:complies: std_req__iso26262__support_1041, std_req__iso26262__support_1042, std_req__iso26262__support_1043, std_req__iso26262__support_1044, std_req__iso26262__support_1045, std_req__iso26262__support_1046, std_req__isosae21434__org_management_5441
2222

2323
The planning for the documents is part of the Platform Management Plan.
2424

‎docs/process/process_areas/implementation/implementation_workproducts.rst

+2-2
Original file line numberDiff line numberDiff line change
@@ -28,15 +28,15 @@ Workproducts Implementation
2828
:id: wp__sw_implementation_inspection
2929
:status: valid
3030
:tags: safety
31-
:complies: std_wp__iso26262__software_952
31+
:complies: std_wp__iso26262__software_952, std_wp__isosae21434__development_1054
3232

3333
Github review with integrated inspection checklist, only valid Detailed Design and Code get merged
3434

3535
.. workproduct:: Software Development Plan
3636
:id: wp__sw_development_plan
3737
:status: valid
3838
:tags: safety
39-
:complies: std_wp__iso26262__software_551, std_wp__iso26262__software_app_c_58
39+
:complies: std_wp__iso26262__software_551, std_wp__iso26262__software_app_c_58, std_wp__isosae21434__development_1053
4040

4141
Process description of SW development including
4242
- selection of design and programming language

‎docs/process/process_areas/index.rst

+1
Original file line numberDiff line numberDiff line change
@@ -27,4 +27,5 @@ Process Areas
2727
problem_resolution/index.rst
2828
requirements_engineering/index.rst
2929
safety_management/index.rst
30+
security_management/index.rst
3031
verification/index.rst

‎docs/process/process_areas/platform_management/platform_management_workproducts.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ Work Products Platform Management
1818
.. workproduct:: Platform Management Plan
1919
:id: wp__platform_mgmt
2020
:status: valid
21-
:complies:
21+
:complies: std_wp__isosae21434__org_management_553, std_wp__isosae21434__org_management_554
2222

2323
The Platform Management Plan shall include the plans as defined by the
2424
:ref:`Platform Management Plan Template <platform_templates>`.

‎docs/process/process_areas/problem_resolution/guidance/problem_resolution_template.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Problem Report Template
2020
.. gd_temp:: Problem Template
2121
:id: gd_temp__problem__template
2222
:status: valid
23-
:complies: std_req__aspice_40__SUP-9-BP1, std_req__aspice_40__SUP-9-BP2, std_req__aspice_40__SUP-9-BP3, std_req__aspice_40__SUP-9-BP4,
23+
:complies: std_req__aspice_40__SUP-9-BP1, std_req__aspice_40__SUP-9-BP2, std_req__aspice_40__SUP-9-BP3, std_req__aspice_40__SUP-9-BP4, std_req__isosae21434__continual_8322, std_req__isosae21434__continual_8421, std_req__isosae21434__continual_8521, std_req__isosae21434__continual_8522, std_req__isosae21434__continual_8621, std_req__isosae21434__continual_8622
2424

2525

2626
Parts of the Problem Template shall be created automatically by the defined Issue Tracking System,

‎docs/process/process_areas/requirements_engineering/guidance/requirements_guideline.rst

+1-1
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@ Guideline
1818
.. gd_guidl:: Requirements Guideline
1919
:id: gd_guidl__req__engineering
2020
:status: valid
21-
:complies: std_req__isopas8926__44421, std_req__isopas8926__44422, std_req__isopas8926__44423
21+
:complies: std_req__isopas8926__44421, std_req__isopas8926__44422, std_req__isopas8926__44423, std_req__isosae21434__org_management_5441
2222

2323
This document describes the general guidances for requirements based on the concept which is defined :need:`[[title]]<doc_concept__req__process>`.
2424

‎docs/process/process_areas/requirements_engineering/requirements_workproducts.rst

+5-5
Original file line numberDiff line numberDiff line change
@@ -18,35 +18,35 @@ Workproducts Requirements Engineering
1818
.. workproduct:: Stakeholder Requirements
1919
:id: wp__requirements__stkh
2020
:status: valid
21-
:complies: std_wp__iso26262__system_651, std_wp__iso26262__software_651
21+
:complies: std_wp__iso26262__system_651, std_wp__iso26262__software_651, std_wp__isosae21434__development_1051, std_wp__isosae21434__development_1052
2222

2323
Technical requirements from a stakeholder viewpoint and assumptions of use based on the integration as SW platform SEooC in an assumed context.
2424

2525
.. workproduct:: Feature Requirements
2626
:id: wp__requirements__feat
2727
:status: valid
28-
:complies: std_wp__iso26262__software_651
28+
:complies: std_wp__iso26262__software_651, std_wp__isosae21434__development_1051
2929

3030
Feature requirements describe in a more detailed way the functionality which will fulfill a set of stakeholder requirements. A "feature" itself represents a set of requirements. It describes the interaction of the components to form a feature. It shall also be the basis for integration testing on platform level.
3131

3232
.. workproduct:: Component Requirements
3333
:id: wp__requirements__comp
3434
:status: valid
35-
:complies: std_wp__iso26262__software_651, std_wp__isopas8926__4521
35+
:complies: std_wp__iso26262__software_651, std_wp__isopas8926__4521, std_wp__isosae21434__development_1051, std_wp__isosae21434__development_1052
3636

3737
SW Requirements for components
3838

3939
.. workproduct:: Feature Assumptions of Use
4040
:id: wp__requirements__feat_aou
4141
:status: valid
42-
:complies: std_wp__iso26262__software_651
42+
:complies: std_wp__iso26262__software_651, std_wp__isosae21434__development_1051, std_wp__isosae21434__development_1052
4343

4444
SW Safety Requirements for the user of the feature, exportable requirements for the user to integrate in their req mgt system.
4545

4646
.. workproduct:: Component Assumptions of Use
4747
:id: wp__requirements__comp_aou
4848
:status: valid
49-
:complies: std_wp__iso26262__software_651, std_wp__isopas8926__4521
49+
:complies: std_wp__iso26262__software_651, std_wp__isopas8926__4521, std_wp__isosae21434__development_1051, std_wp__isosae21434__development_1052
5050

5151
SW Safety Requirements for the user of the component, exportable requirements for the user to integrate in their req mgt system.
5252

‎docs/process/process_areas/safety_management/workproducts.rst

-14
Original file line numberDiff line numberDiff line change
@@ -121,17 +121,3 @@ Work products
121121
* a development processes analysis; and
122122
* a complexity analysis of the pre-developed SW component; and
123123
* finally a SW component classification as input for the safety planning (which is to cover the determined gaps, if any, by additional verification measures).
124-
125-
.. workproduct:: Tailoring Documents
126-
:id: wp__tailoring
127-
:status: valid
128-
:complies: std_wp__iso26262__management_653
129-
130-
This work product argues why some work products are not needed in the project.
131-
132-
It may have several levels:
133-
134-
* Project/Platform
135-
* Feature/Component
136-
137-
It belongs to the Safety Plan.

‎docs/process/process_areas/security_management/guidance/index.rst

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
..
2+
# *******************************************************************************
3+
# Copyright (c) 2025 Contributors to the Eclipse Foundation
4+
#
5+
# See the NOTICE file(s) distributed with this work for additional
6+
# information regarding copyright ownership.
7+
#
8+
# This program and the accompanying materials are made available under the
9+
# terms of the Apache License Version 2.0 which is available at
10+
# https://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# SPDX-License-Identifier: Apache-2.0
13+
# *******************************************************************************
14+
15+
Guidance
16+
########
17+
18+
.. toctree::
19+
:maxdepth: 1
20+
21+
security_management_guideline
22+
security_management_feature_security_wp_template
23+
security_management_module_security_plan_template
24+
security_management_security_manual_template
25+
security_management_checklist_security_package
26+
security_management_checklist_security_plan
27+
security_management_process_reqs

‎docs/process/process_areas/security_management/guidance/security_management_checklist_security_package.rst

+65
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
..
2+
# *******************************************************************************
3+
# Copyright (c) 2025 Contributors to the Eclipse Foundation
4+
#
5+
# See the NOTICE file(s) distributed with this work for additional
6+
# information regarding copyright ownership.
7+
#
8+
# This program and the accompanying materials are made available under the
9+
# terms of the Apache License Version 2.0 which is available at
10+
# https://www.apache.org/licenses/LICENSE-2.0
11+
#
12+
# SPDX-License-Identifier: Apache-2.0
13+
# *******************************************************************************
14+
15+
Security Package Formal Review Checklist
16+
========================================
17+
18+
.. gd_chklst:: Security Package Formal Review Checklist
19+
:id: gd_chklst__security_package
20+
:status: valid
21+
:complies: std_req__isosae21434__prj_management_6471, std_req__isosae21434__prj_management_6491, std_req__isosae21434__prj_management_6492
22+
23+
**1. Purpose**
24+
25+
The purpose of this review checklist is to report status of the formal review for the security package.
26+
27+
**2. Checklist**
28+
29+
.. list-table:: Security Package Checklist
30+
:header-rows: 1
31+
32+
* - Id
33+
- Security package activity
34+
- Compliant to ISO SAE 21434?
35+
- Comment
36+
37+
* - 1
38+
- Is a security package provided which matches the security plan (i.e. all planned work products referenced)?
39+
- [YES | NO ]
40+
- <Rationale for result>
41+
42+
* - 2
43+
- Is the argument how security is achieved, provided in the security package, plausible and sufficient?
44+
- NO
45+
- The argument is intentionally not provided by S-CORE.
46+
47+
* - 3
48+
- Are the referenced work products available?
49+
- [YES | NO ]
50+
- <Rationale for result>
51+
52+
* - 4
53+
- Are the referenced work products in released state, including the process security audit?
54+
- NO
55+
- Security audit is currently not planned, tailored out.
56+
57+
* - 5
58+
- If security related deviations from the process or security concept are documented, are these argued understandably?
59+
- [YES | NO ]
60+
- <Rationale for result>
61+
62+
* - 6
63+
- Are the requirements for post-development available?
64+
- [YES | NO ]
65+
- <Rationale for result>

0 commit comments

Comments
 (0)