ISO/IEC 25010

Degree to which a product or system defends against attack patterns by malicious actos and protects information and data so that persons or other products or systems have the degree of data access appropriate to their types and levels of authorization. This characteristic is composed of the following sub-characteristics:

• Confidentiality - Degree to which a product or system ensures that data are accessible only to those authorized to have access.
• Integrity - Degree to which a system, product or component ensures that the state of its system and data are protected from unauthorized modification or deletion either by malicious action or computer error.
• Non-repudiation - Degree to which actions or events can be proven to have taken place so that the events or actions cannot be repudiated later.
• Accountability - Degree to which the actions of an entity can be traced uniquely to the entity.
• Authenticity - Degree to which the identity of a subject or resource can be proved to be the one claimed.
• Resistance - Degree to which the product or system sustains operations while under attack from a malicious actor.

This characteristic represents the degree of effectiveness and efficiency with which a product or system can be modified to improve it, correct it or adapt it to changes in environment, and in requirements. This characteristic is composed of the following sub-characteristics:

• Modularity - Degree to which a system or computer program is composed of discrete components such that a change to one component has minimal impact on other components.
• Reusability - Degree to which a product can be used as an asset in more than one system, or in building other assets.
• Analysability - Degree of effectiveness and efficiency with which it is possible to assess the impact on a product or system of an intended change to one or more of its parts, to diagnose a product for deficiencies or causes of failures, or to identify parts to be modified.
• Modifiability - Degree to which a product or system can be effectively and efficiently modified without introducing defects or degrading existing product quality.
• Testability - Degree of effectiveness and efficiency with which test criteria can be established for a system, product or component and tests can be performed to determine whether those criteria have been met.

Degree to which a product can be adapted to changes in its requirements, contexts of use or sys tem environment. This characteristic is composed of the following sub-characteristics:

• Adaptability - Degree to which a product or system can effectively and efficiently be adapted for or transferred to different hardware, software or other operational or usage environments.
• Scalability - Degree to which a product can handle growing or shrinking workloads or to adapt its capacity to handle variability.
• Installability - Degree of effectiveness and efficiency with which a product or system can be successfully installed and/or uninstalled in a specified environment.
• Replaceability - Degree to which a product can replace another specified software product for the same purpose in the same environment.

This characteristic represents the degree to which a product under defined conditions to avoid a state in which human life, health, property, or the environment is endangered. This characteristic is composed of the following sub-characteristics:

• Operational constraint - Degree to which a product or system constrains its operation to within safe parameters or states when encountering operational hazard.
• Risk identification - Degree to which a product can identify a course of events or operations that can expose life, property or environment to unacceptable risk.
• Fail safe - Degree to which a product can automatically place itself in a safe operating mode, or to revert to a safe condition in the event of a failure.
• Hazard warning - Degree to which a product or system provides warnings of unacceptable risks to operations or internal controls so that they can react in sufficient time to sustain safe operations.
• Safe integration - Degree to which a product can maintain safety during and after integration with one or more components.