TCP is optional. Also QoS should be able to be requested. Authenticate first and check what you can do next. IPsec is most possibly used. Security associations are needed.
Authentication is mandatory to implement between client to server and server to client.
NATs and firewalls should be considered. Location policy decisions should be based on factors in addition to identity, such as group membership etc. Data integrity and confidentiality are needed. Anonymous use should be supported. Security mechanisms should specify a mechanism for extending the security mechanisms for additional capability.