Council Decision of 31 March 1992 in the field of security of information systems (92/242/EEC)

2. Action line II — Identification of user and service provider requirements for the security of information systems U.K.

2.1. Issue U.K.

Security of information systems is the inherent prerequisite for the integrity and trustworthiness of business applications, intellectual property and confidentiality. This leads inevitably to a difficult balance and sometimes choices, between a commitment to free trade and a commitment to securing privacy and intellectual property. These choices and compromises need to be based on a full appreciation of requirements and the impact of possible options for the security of information systems to respond to them.

User requirements imply the security functionalities of information systems interdependent with technological, operational and regulatory aspects. Therefore, a systematic investigation of security requirements for information systems forms an essential part of the development of appropriate and effective measures.

2.2. Objective U.K.

Establishing the nature and characteristics of requirements of users and service providers and their relation to security measures of information systems.

2.3. Status and trends U.K.

Hitherto, no concerted effort has been undertaken to identify the rapidly evolving and changing requirements of the major actors for the security of information systems. Member States of the Community have identified the requirements for harmonization of national activities (especially of the ‘IT security evaluation criteria’). Uniform evaluation criteria and rules for mutual recognition of evaluation certificates are of major importance.

2.4. Requirements, options and priorities U.K.

As a basis for a consistent and transparent treatment of the justified needs of the sector actors, it is considered necessary to develop an agreed classification of user requirements and its relation to the provision of security in information systems.

It is also considered important to identify requirements for legislation, regulations and codes of practice in the light of an assessment of trends in service characteristics and technology, to identify alternative strategies for meeting the objectives by administrative, service, operational and technical provisions, and to assess the effectiveness, user-friendliness and costs of alternative security options and strategies for information systems for users, service providers and operators.