Security, IAM & Auditing Requirements
Purpose
To protect sensitive information, maintain trust, ensure regulatory compliance, and provide traceability through standardized security controls and centralized identity management.
Scope
Authentication and authorization standards, IAM integration, access control policies, audit logging, security controls for APIs, and compliance requirements.
Requirements
| ID | Name | Description |
|---|---|---|
| REQ-SEC-1 | Standard IAM Protocols | Authentication and authorization for products and APIs MUST be implemented using standard IAM protocols and services (OAuth2, OIDC, LDAP-based directory) owned by security experts. |
| REQ-SEC-2 | Centralized IAM Integration | Products MUST delegate identity and access control to the standard IAM platform and MUST NOT implement ad-hoc credential or session schemes. |
| REQ-SEC-3 | Least Privilege Access | Access control policies MUST be consistent across products and follow least-privilege principles for both users and services. |
| REQ-SEC-4 | Immutable Audit Logs | All relevant user and system operations (especially security-sensitive and business-critical actions) MUST be captured in immutable, timestamped logs that support traceability and compliance. |
| REQ-SEC-5 | Comprehensive Audit Trail | Audit logging MUST allow reconstruction of who did what, when, and through which interface for key entities (e.g., players, operators, configurations). |
| REQ-SEC-6 | Consistent API Security | External and cross-product APIs MUST apply consistent security controls (authN, authZ, input validation, rate limiting, abuse prevention) according to platform standards. |
Reference Template
TBD — a reference example for this standard is pending (to be crafted).