Patent Document ID: 8856863
Application ID: 12997462

Base Claim:
1. A computer-implemented method for managing and analyzing security requirements in reusable models, the method comprising: reading at least one functional model from at least one storage device; reading at least one security implementation model; reading at least one requirement model; reading meta models of the models from said at least one storage device; at least partially automatically relating the read functional model, the read security implementation model, and the read requirements model and analyzing a correspondence between the functional model, security implementation model, and the requirements model, the correspondence indicating that requirements defined in the requirement model match with security objectives implemented by controls defined by the security implementation model; determining whether correspondence is or is not given based on the analysis of the correspondence; and at least partially automatically generating evidence based on the analysis of the correspondence and the determination.

---

Claim 3:
3. The method according to claim 1 , wherein the functional model defines a functional portion of an IT system, which includes services, components, applications, or host machines, wherein the security implementation model defines security relevant portions of the IT system, and wherein the requirement model defines requirements for compliance, accreditation, and security.