Canada ITSG-33 - IT Security Risk Management A1-4.2.2: 4.2.2 Identify business needs for security

The department identifies, in business terms, what its business activities need protected when they rely on information systems: needs arising from regulations, policies, directives, standards and program objectives, from generally recognised system threat exposures and from contractual obligations such as memorandums of understanding and service level agreements, including privacy requirements that depend on IT security. Business analysts and an architect or security architect help, using business process documentation and impact assessments such as business impact and privacy impact assessments. The output is a set of statements of business needs for security.