Adapting the SQUARE Method for Security Requirements Engineering to Acquisition
• SEI Report
Publisher
Software Engineering Institute
Topic or Tag
Abstract
Organizations that are acquiring software have the same security concerns as organizations that are developing software, but they usually have less control over the actual development process. Depending on the exact situation, the acquisition stakeholders may be heavily involved in security requirements engineering, or they may have a role that is largely limited to reviewing requirements developed by the supplier. In this paper the SQUARE process for security requirements engineering is adapted for different acquisition situations. In the future, it is hoped that other security requirements engineering methods will be adapted to acquisition. The next steps for SQUARE for Acquisition are to use it on actual projects.
Part of a Collection
Security Quality Requirements Engineering (SQUARE)
Cybersecurity Engineering Research: Security Quality Requirements Engineering (SQUARE) Collection
Cite This SEI Report
Mead, N. (2010, February 22). Adapting the SQUARE Method for Security Requirements Engineering to Acquisition. Retrieved September 19, 2026, from https://www.sei.cmu.edu/library/adapting-the-square-method-for-security-requirements-engineering-to-acquisition/.
@techreport{mead_2010,
author={Mead, Nancy},
title={Adapting the SQUARE Method for Security Requirements Engineering to Acquisition},
month={Feb},
year={2010},
institution={Software Engineering Institute, Carnegie Mellon University},
url={https://www.sei.cmu.edu/library/adapting-the-square-method-for-security-requirements-engineering-to-acquisition/},
note={Accessed: 2026-Sep-19}
}
Mead, Nancy. "Adapting the SQUARE Method for Security Requirements Engineering to Acquisition." Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, February 22, 2010. https://www.sei.cmu.edu/library/adapting-the-square-method-for-security-requirements-engineering-to-acquisition/.
N. Mead, "Adapting the SQUARE Method for Security Requirements Engineering to Acquisition," Software Engineering Institute, Carnegie Mellon University. Software Engineering Institute, 22-Feb-2010 [Online]. Available: https://www.sei.cmu.edu/library/adapting-the-square-method-for-security-requirements-engineering-to-acquisition/. [Accessed: 19-Sep-2026].
Mead, Nancy. "Adapting the SQUARE Method for Security Requirements Engineering to Acquisition." Software Engineering Institute, Carnegie Mellon University, Software Engineering Institute, 22 Feb. 2010. https://www.sei.cmu.edu/library/adapting-the-square-method-for-security-requirements-engineering-to-acquisition/. Accessed 19 Sep. 2026.
Mead, Nancy. Adapting the SQUARE Method for Security Requirements Engineering to Acquisition. Software Engineering Institute. 2010. https://www.sei.cmu.edu/library/adapting-the-square-method-for-security-requirements-engineering-to-acquisition/