This document specifies a method for the classification of requirements based on severity and susceptibility. The classification method requires a system in line with the framework described in ISO 24096‑1 to form a complete system.
This document:
gives guidance on the needed elements for a consistent evaluation of the severity over time, and supports a company business model and its brand image;
gives background to why additional parameters alongside severity are useful as a base for classification;
adds susceptibility as a viable parameter along with severity;
gives guidance on the methodology for classification requirements using severity and susceptibility.
BSI recommends this version of standard for organisations operating in or with the UK. The ISO edition is available here if required.