What it asks for. Identify, specify and approve information security requirements when developing or acquiring applications.
In practice. Security requirements are derived from risk assessment, classification of the data involved, legal obligations and threat modelling. They cover areas such as authentication, authorisation, input handling, logging, encryption, session management and, for transactional services, integrity and non-repudiation. Requirements are written into user stories, specifications or procurement criteria, approved by appropriate stakeholders and verified through testing. Auditors expect documented requirements for a sample of applications and traceability from requirements to test results.
Common gaps. Requirements are often generic checklists copied between projects rather than tailored to the application's risk. For purchased software and SaaS, security requirements are frequently missing from procurement, leaving nothing to measure the supplier against.