CAN CSA-ISO IEC 15026-3-2013 Systems and software engineering - Systems and software assurance - Part 3 System intergrity levels.pdf

1、Systems and software engineering Systems and software assurance Part3:System integrity levelsCAN/CSA-ISO/IEC 15026-3:13(ISO/IEC 15026-3:2011, IDT)National Standard of CanadaNOT FOR RESALE. / PUBLICATION NON DESTINE LA REVENTE.Legal Notice for StandardsCanadian Standards Association (operating as “CS

2、A Group”) develops standards through a consensus standards development process approved by the Standards Council of Canada. This process brings together volunteers representing varied viewpoints and interests to achieve consensus and develop a standard. Although CSA Group administers the process and

3、 establishes rules to promote fairness in achieving consensus, it does not independently test, evaluate, or verify the content of standards.Disclaimer and exclusion of liabilityThis document is provided without any representations, warranties, or conditions of any kind, express or implied, including

4、, without limitation, implied warranties or conditions concerning this documents fitness for a particular purpose or use, its merchantability, or its non-infringement of any third partys intellectual property rights. CSA Group does not warrant the accuracy, completeness, or currency of any of the in

5、formation published in this document. CSA Group makes no representations or warranties regarding this documents compliance with any applicable statute, rule, or regulation. IN NO EVENT SHALL CSA GROUP, ITS VOLUNTEERS, MEMBERS, SUBSIDIARIES, OR AFFILIATED COMPANIES, OR THEIR EMPLOYEES, DIRECTORS, OR

6、OFFICERS, BE LIABLE FOR ANY DIRECT, INDIRECT, OR INCIDENTAL DAMAGES, INJURY, LOSS, COSTS, OR EXPENSES, HOWSOEVER CAUSED, INCLUDING BUT NOT LIMITED TO SPECIAL OR CONSEQUENTIAL DAMAGES, LOST REVENUE, BUSINESS INTERRUPTION, LOST OR DAMAGED DATA, OR ANY OTHER COMMERCIAL OR ECONOMIC LOSS, WHETHER BASED I

7、N CONTRACT, TORT (INCLUDING NEGLIGENCE), OR ANY OTHER THEORY OF LIABILITY, ARISING OUT OF OR RESULTING FROM ACCESS TO OR POSSESSION OR USE OF THIS DOCUMENT, EVEN IF CSA GROUP HAS BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES, INJURY, LOSS, COSTS, OR EXPENSES.In publishing and making this document

8、available, CSA Group is not undertaking to render professional or other services for or on behalf of any person or entity or to perform any duty owed by any person or entity to another person or entity. The information in this document is directed to those who have the appropriate degree of experien

9、ce to use and apply its contents, and CSA Group accepts no responsibility whatsoever arising in any way from any and all use of or reliance on the information contained in this document. CSA Group is a private not-for-profit company that publishes voluntary standards and related documents. CSA Group

10、 has no power, nor does it undertake, to enforce compliance with the contents of the standards or other documents it publishes. Intellectual property rights and ownershipAs between CSA Group and the users of this document (whether it be in printed or electronic form), CSA Group is the owner, or the

11、authorized licensee, of all works contained herein that are protected by copyright, all trade-marks (except as otherwise noted to the contrary), and all inventions and trade secrets that may be contained in this document, whether or not such inventions and trade secrets are protected by patents and

12、applications for patents. Without limitation, the unauthorized use, modification, copying, or disclosure of this document may violate laws that protect CSA Groups and/or others intellectual property and may give rise to a right in CSA Group and/or others to seek legal redress for such use, modificat

13、ion, copying, or disclosure. To the extent permitted by licence or by law, CSA Group reserves all intellectual property rights in this document.Patent rightsAttention is drawn to the possibility that some of the elements of this standard may be the subject of patent rights. CSA Group shall not be he

14、ld responsible for identifying any or all such patent rights. Users of this standard are expressly advised that determination of the validity of any such patent rights is entirely their own responsibility.Authorized use of this documentThis document is being provided by CSA Group for informational a

15、nd non-commercial use only. The user of this document is authorized to do only the following:If this document is in electronic form:sLOADTHISDOCUMENTONTOACOMPUTERFORTHESOLEPURPOSEOFREVIEWINGITsSEARCHANDBROWSETHISDOCUMENTANDsPRINTTHISDOCUMENTIFITISIN0$ this remains the continuing responsibility of th

16、e SDO. An NSC reflects a consensus of a number of capable individuals whose collective interests provide, to the greatest practicable extent, a balance of representation of general interests, producers, regulators, users (including consumers), and others with relevant interests, as may be appropriat

17、e to the subject in hand. It normally is a standard which is capable of making a significant and timely contribution to the national interest.Those who have a need to apply standards areencouraged to use NSCs. These standards are subjectto periodic review. Users of NSCs are cautionedto obtain the la

18、test edition from the SDO which publishes the standard.The responsibility for approving standards as National Standards of Canada rests with theStandards Council of Canada270 Albert Street, Suite 200Ottawa, Ontario, K1P 6N7CanadaAlthough the intended primary application of this Standard is stated in

19、 its Scope, it is importantto note that it remains the responsibility of the users to judge its suitability for their particular purpose.Registered trade-mark of Canadian Standards AssociationCette norme est offerte en anglais seulement pour le moment. Le Groupe CSA publiera la versionen franais ds

20、quelle sera produite par lorganisme rdacteur.TMA trade-mark of the Canadian Standards Association, operating as “CSA Group”National Standard of CanadaPublished in January 2013 by CSA GroupA not-for-profit private sector organization5060 Spectrum Way, Suite 100, Mississauga, Ontario, Canada L4W 5N61-

21、800-463-6727 416-747-4044Visit our Online Store at shop.csa.caApproved byStandards Council of CanadaCAN/CSA-ISO/IEC 15026-3:13Systems and software engineering Systems and software assurance Part3:System integrity levelsPrepared by InternationalOrganizationforStandardization/ International Electrotec

22、hnical CommissionReviewed byCAN/CSA-ISO/IEC 15026-3:13Systems and software engineering Systems andsoftware assurance Part 3: System integrity levelsCSA/4 2013 CSA Group January 2013CAN/CSA-ISO/IEC 15026-3:13Systems and software engineering Systems and software assurance Part 3: System integrity leve

23、lsCSA PrefaceStandards development within the Information Technology sector is harmonized with international standards development. Through the CSA Technical Committee on Information Technology (TCIT), Canadians serve as the Canadian Advisory Committee (CAC) on ISO/IEC Joint Technical Committee 1 on

24、 Information Technology (ISO/IEC JTC1) for the Standards Council of Canada (SCC), the ISO member body for Canada and sponsor of the Canadian National Committee of the IEC. Also, as a member of the International Telecommunication Union (ITU), Canada participates in the International Telegraph and Tel

25、ephone Consultative Committee (ITU-T).This Standard replaces CAN/CSA-ISO/IEC 15026-01 (adoption of ISO/IEC 15026:1998).At the time of publication, ISO/IEC 15026-3:2011 is available from ISO and IEC in English only. CSA Group will publish the French version when it becomes available from ISO and IEC.

26、This International Standard was reviewed by the TCIT under the jurisdiction of the Strategic Steering Committee on Information Technology and deemed acceptable for use in Canada. From time to time, ISO/IEC may publish addenda, corrigenda, etc. The TCIT will review these documents for approval and pu

27、blication. For a listing, refer to the Current Standards Activities page at standardsactivities.csa.ca. This Standard has been formally approved, without modification, by the Technical Committee and has been approved as a National Standard of Canada by the Standards Council of Canada. 2013 CSA Group

28、All rights reserved. No part of this publication may be reproduced in any form whatsoever without the prior permission of thepublisher. ISO/IEC material is reprinted with permission. Where the words “this International Standard” appear in the text, they should be interpreted as “this National Standa

29、rd of Canada”.Inquiries regarding this National Standard of Canada should be addressed toCSA Group5060 Spectrum Way, Suite 100, Mississauga, Ontario, Canada L4W 5N61-800-463-6727 416-747-4000http:/csa.caTo purchase standards and related publications, visit our Online Store at shop.csa.ca or call tol

30、l-free 1-800-463-6727 or 416-747-4044.This Standard is subject to periodic review, and suggestions for its improvement will be referred to the appropriate committee. To submit a proposal for change, please send the following information to inquiriescsagroup.org and include “Proposal for change” in t

31、he subject line:(a) Standard designation (number);(b) relevant clause, table, and/or figure number;(c) wording of the proposed change; and(d) rationale for the change.Reference numberISO/IEC 15026-3:2011(E)ISO/IEC 2011INTERNATIONAL STANDARD ISO/IEC15026-3First edition2011-12-15Systems and software e

32、ngineering Systems and software assurance Part 3: System integrity levels Ingnierie du logiciel et des systmes Assurance du logiciel et des systmes Partie 3: Niveaux dintgrit du systme ISO/IEC 15026-3:2011(E) COPYRIGHT PROTECTED DOCUMENT ISO/IEC 2011 All rights reserved. Unless otherwise specified,

33、no part of this publication may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or ISOs member body in the country of the requester. ISO copyright office Case pos

34、tale 56 CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.org Web www.iso.org ii ISO/IEC 2011 All rights reservedCAN/CSA-ISO/IEC 15026-3:13ISO/IEC 15026-3:2011(E) ISO/IEC 2011 All rights reserved iiiContents Page Foreword .v 1 Scope1 2 Normative references1 3 Terms a

35、nd definitions .2 4 Integrity level framework 2 4.1 Integrity level specification 2 4.2 Process for using integrity levels3 5 Using this Part 3 4 5.1 Uses of this part of ISO/IEC 15026.4 5.2 Documentation 5 5.3 Personnel and organizations .5 5.4 Overview of this part of ISO/IEC 15026 .5 6 Defining i

36、ntegrity levels6 6.1 Purpose for using this part of ISO/IEC 15026.6 6.2 Outcomes of using this part of ISO/IEC 15026.6 6.3 Prerequisites for defining integrity levels.6 6.3.1 Establish appropriateness of area for use of integrity levels.6 6.3.2 Establish purpose and preliminary scope7 6.4 Consistenc

37、y with use requirements7 6.5 Analysis of scope of applicability7 6.6 Three required work products .8 6.6.1 Specifying an integrity level claim.8 6.6.2 Specifying integrity level requirements 9 6.6.3 Justification of match between integrity level claim and its requirements.9 6.7 Maintaining integrity

38、 level specification .10 6.8 Information provided for users 11 6.8.1 Requirements.11 6.8.2 Guidance and recommendations.11 7 Using integrity levels 11 7.1 Purpose for using this part of ISO/IEC 15026.11 7.2 Outcomes of using this part of ISO/IEC 15026.12 7.3 Prerequisites for use of integrity levels

39、 12 7.3.1 Determine scope of covered risks.12 7.3.2 Establish applicability of integrity levels to the scope of their use .13 7.3.3 Decide role of integrity levels in life cycle13 7.3.4 Establish approach to risk analysis 13 8 System or product integrity level determination .13 8.1 Introduction13 8.

40、2 Risk .14 8.2.1 Introduction14 8.2.2 Risk criterion14 8.2.3 Risk analyses.15 8.2.4 Risk evaluation 17 8.3 Assignment of system or product integrity level.17 8.4 Independence from internal architecture18 8.5 Maintaining system or product integrity level18 8.5.1 Introduction18 8.5.2 System changes 18

41、 CAN/CSA-ISO/IEC 15026-3:13ISO/IEC 15026-3:2011(E) iv ISO/IEC 2011 All rights reserved8.5.3 Risks becomes known 18 8.5.4 Requirements change .18 8.6 Traceability of system or product integrity level assignments 19 9 Assigning system element integrity levels .19 9.1 General19 9.2 Architecture and des

42、ign19 9.2.1 General19 9.2.2 Failure handling mechanisms 19 9.3 Assignment 20 9.4 Scope of assignments.20 9.5 Special considerations20 9.5.1 Cycles and recursion 20 9.5.2 Special situations and requirements regarding integrity levels.20 9.5.3 Behaviours other than failure.21 9.6 Maintaining the assig

43、nment of integrity levels.21 9.6.1 General21 9.6.2 Changing integrity level assignments.21 10 Meeting integrity level requirements .22 10.1 Requirements related to evidence .22 10.1.1 Related information .22 10.1.2 Organization of evidence 22 10.1.3 Interpretation of evidence.22 10.2 Alternatives 22

44、 10.3 Achieving integrity level claim .23 10.4 Corrective actions23 11 Agreements and approvals.23 11.1 Authorities 23 11.2 Specific approvals and agreements related to integrity level definition .24 11.3 Specific approvals and agreements related to integrity level use .24 11.4 Documentation.25 Anne

45、x A (normative) Inputs and outputs for integrity level framework26 A.1 Table for Clause 4 Integrity level framework 26 Annex B (informative) An example of use of ISO/IEC 15026-3 .27 B.1 Introduction27 B.2 Overview.27 B.3 Defining integrity levels (Clause 6)27 B.4 Using a framework of integrity level

46、s (Clauses 7 and 8) .29 B.5 System element integrity levels (Clause 9).31 B.6 Using integrity levels according to this part of ISO/IEC 15026.31 Bibliography 32 Tables Table A.1 Inputs and outputs for activities in Figure 1 26 Table B.1 Integrity levels for examples . 28 Table B.2 Integrity level cla

47、ims ranges of property values for examples . 28 Table B.3 Examples of integrity level requirements and associated evidence. 29 CAN/CSA-ISO/IEC 15026-3:13ISO/IEC 15026-3:2011(E) ISO/IEC 2011 All rights reserved vForeword ISO (the International Organization for Standardization) and IEC (the Internatio

48、nal Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields

49、of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC