business requirement

A condition or need — operational, legal, regulatory, contractual, or organizational — that an enterprise must satisfy in order to carry out its mission and sustain its operations, independent of any particular technical solution. In security and compliance frameworks, the term is used compositionally: "business" scopes the requirement to the enterprise's mission and operational context (contrasted with, for example, purely technical or regulatory requirements in isolation), while "requirement" carries its ordinary engineering/governance meaning of a constraint that must be met. NIST uses it to describe the mission and operational context within which security controls must fit, and as business requirements change, security mechanisms such as access controls must adapt accordingly. Federal agencies apply security concepts in accordance with and in the context of the agency's missions, business functions, and environment of operation — "business requirement" being the shorthand for that contextual driver.