What type of a system requirement involves preventing unauthorized access to data?

The requirement to prevent unauthorized access to data is a core principle of information security, specifically addressing the concept of confidentiality. In systems engineering and software development, such requirements are explicitly categorized as security requirements. These are typically classified as non-functional requirements because they define constraints on the system and specify criteria for how the system must operate securely, rather than defining a specific user-facing function. Security requirements are essential for protecting system assets from threats and ensuring data integrity, confidentiality, and availability.

A. Accessibility: This requirement ensures a system is usable by people with disabilities (e.g., visual or hearing impairments), which is unrelated to preventing unauthorized access.

B. Design: Design is a broad phase or a set of constraints within system development; security is a specific type of requirement that must be addressed within the design.

C. User needs: This term typically refers to functional requirements that enable a user to perform a task. Security is a cross-cutting concern that protects the entire system, not just a single user's function.

---

1. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-53 Rev. 5, Security and Privacy Controls for Information Systems and Organizations. (December 2020). The entire document is predicated on security requirements (controls). The Access Control (AC) family, for instance, is defined as controls to "limit information system access to authorized users...and to the types of transactions and functions that authorized users are permitted to exercise." (See Section 2.3, Control Families, p. 21).

2. ISO/IEC/IEEE 29148:2018, Systems and software engineering — Life cycle processes — Requirements engineering. This international standard defines types of requirements. In Section 5.2.3, "Types of requirements," it lists non-functional requirements and explicitly includes "security" as a characteristic, which encompasses aspects like confidentiality and access control.

3. MIT OpenCourseWare, 16.842 Fundamentals of Systems Engineering, Fall 2015. Lecture 4, "Requirements Definition and Specification," distinguishes between functional and non-functional requirements. Non-functional requirements (or "ilities") are defined as quality attributes, with security being a primary example that constrains the system's design and operation. (See slide 18, "Non-Functional Requirements").

4. Sommerville, I. (2016). Software Engineering (10th ed.). Pearson. In Chapter 4, "Requirements Engineering," security requirements are classified as a type of non-functional requirement. Section 4.2.2 states, "Non-functional requirements...are constraints on the services or functions offered by the system. They include...security requirements." (p. 103).