Module Security Plan Template#

Module Security Plan Template
status: valid
tags: security_management
contained by: wf__cr_mt_security_plan, wf__cr_mt_security_package, wf__consult_exe_sec_training

Will be moved to Folder Templates (tbd eclipse-score/process_description#109) For the content see here: need:doc__module_name_security_plan Will also adapted to the latest Safety Plan Template

1. Security Management Context
This Security Plan adds to the Concept Description all the module development relevant work products needed for ISO SAE 21434 conformity.

2. Security Management Scope
This Security Plan’s scope is a SW module of the SW platform <link to module documentation in platform/modules/<modulename>/index.rst>.
The module consists of one or more SW components and will be qualified as a EooC.

3. Security Management Roles

Security Manager

<link to Module’s Security Manager assignment or name>

Project Manager

<link to Module’s Project Lead assignment or name>
4. Tailoring
Additional to the tailoring in the SW platform project as defined in the Concept Description we define here the additional tailoring on module level.

- Excluded for this module are additionally the following work products (and their related requirements):
- <ISO SAE 21434 reference>: <work product/requirement> - <Argumentation why it is not needed or replaced by another work product or activity.>

5. Security Module Work Products
One set of work products for the module and one set for each component of the module:
gd_temp__module_security_plan
Process Template
Table 55 Module Work Products#

Work Product Id

Link to process

Process status

Link to issue

Link to WP

WP status

Module Security Plan (wp__module_security_plan)

Security Management Guideline

<automated>

<Link to issue>

this document

see above

Module Security Package (wp__module_security_package)

Security Management Guideline

<automated>

<Link to issue>

<Link to WP>

<automated>

Formal Document Review Reports (wp__fdr_reports) (module Security Plan)

Security Plan Review Checklist (gd_chklst__security_plan)

<automated>

<Link to issue>

<Link to WP>

<automated>

Formal Document Review Reports (wp__fdr_reports) (module Security Package)

Security Package Formal Review Checklist (gd_chklst__security_package)

<automated>

<Link to issue>

<Link to WP>

<automated>

Formal Document Review Reports (wp__fdr_reports) (module’s Security Analyses)

Security Analysis FDR tbd

<automated>

<Link to issue>

<Link to WP>

<automated>

Process Security Audit Report (wp__audit_report_security)

performed by external experts

n/a

<Link to issue>

<Link to WP>

<WP status (manual)>

Module Build Configuration (wp__module_sw_build_config)

Software Development Plan Template (gd_temp__software_development_plan)

<automated>

<Link to issue>

<Link to WP>

<automated>

Module Security Manual (wp__module_security_manual)

Security Manual Template (gd_temp__security_manual)

<automated>

<Link to issue>

<Link to WP>

<automated>

Module Verification Report (wp__verification_module_ver_report)

Verification

<automated>

<Link to issue>

<Link to WP>

<automated>

Module Release Notes (wp__module_sw_release_note)

Release Management

<automated>

<Link to issue>

<Link to WP>

<automated>

Module Software Bill of Mat... (wp__sw_module_sbom)

Security Management

not started

<Link to issue>

<Link to WP>

<automated>
Table 56 Component <name> Work Products#

Work Product Id

Link to process

Process status

Link to issue

Link to WP

WP status

Component Requirements (wp__requirements_comp)

<Link to process>

<automated>

<Link to issue>

<Link to WP>

<automated>

Component Assumptions of Use (wp__requirements_comp_aou)

<Link to process>

<automated>

<Link to issue>

<Link to WP>

<automated>

Requirements Inspection (wp__requirements_inspect)

<Link to process>

<automated>

n/a

Checklist used in Pull Request Review

n/a

Component Architecture (wp__component_arch)

<Link to process>

<automated>

<Link to issue>

<Link to WP>

<automated>

Component Security Analysis (wp__sw_component_security_analysis)

<Link to process>

<automated>

<Link to issue>

<Link to WP>

<automated>

Architecture Verification (wp__sw_arch_verification)

<Link to process>

<automated>

<Link to issue>

<Link to WP>

<automated>

Implementation (wp__sw_implementation)

<Link to process>

<automated>

<Link to issue>

<Link to WP>

<automated>

Unit test (wp__verification_sw_unit_test)

<Link to process>

<automated>

<Link to issue>

<Link to WP>

<automated>

Implementation Inspection (wp__sw_implementation_inspection)

<Link to process>

<automated>

<Link to issue>

<Link to WP>

<automated>

Component Integration test (wp__verification_comp_int_test)

<Link to process>

<automated>

<Link to issue>

<Link to WP>

<automated>