business requirement
163512·updated Aug 30, 2026A condition or need — operational, legal, regulatory, contractual, or organizational — that an enterprise must satisfy in order to carry out its mission and sustain its operations, independent of any particular technical solution. In security and compliance frameworks, the term is used compositionally: "business" scopes the requirement to the enterprise's mission and operational context (contrasted with, for example, purely technical or regulatory requirements in isolation), while "requirement" carries its ordinary engineering/governance meaning of a constraint that must be met. NIST uses it to describe the mission and operational context within which security controls must fit, and as business requirements change, security mechanisms such as access controls must adapt accordingly. Federal agencies apply security concepts in accordance with and in the context of the agency's missions, business functions, and environment of operation — "business requirement" being the shorthand for that contextual driver.
Source
) and mission and business requirements (e.g., time zone differences,the sentence this term was read in
generalized from a web lookup of the quoted expression at proposal time Verdict: compositional.
- NIST Special Publication (SP) 800-53 Revision 4 Title
- NIST Special Publication (SP) 1800-3 (Withdrawn), Attribute Based Access Control
- NIST Special Publication 800-39 Managing Information Security Risk
- Security and Privacy Controls for Information Systems and ...
A definition generalized from search results is a draft to react to, not provenance. Confirm it against an authority document before this term is verified.
A web lookup ran when this term was proposed
A condition or need — operational, legal, regulatory, contractual, or organizational — that an enterprise must satisfy in order to carry out its mission and sustain its operations, independent of any particular technical solution. In security and compliance frameworks, the term is used compositionally: "business" scopes the requirement to the enterprise's mission and operational context (contrasted with, for example, purely technical or regulatory requirements in isolation), while "requirement" carries its ordinary engineering/governance meaning of a constraint that must be met. NIST uses it to describe the mission and operational context within which security controls must fit, and as business requirements change, security mechanisms such as access controls must adapt accordingly. Federal agencies apply security concepts in accordance with and in the context of the agency's missions, business functions, and environment of operation — "business requirement" being the shorthand for that contextual driver.
Advisory only. A term this product ships is defined by an authority document, not by a search result.
Proposed during multiword review of this document in the CKI mapping queue.
Attested in
Classifications
Entity Type
Sensitivity
Information Class
Variants
- plural
- business requirements
- possessive
- business requirement's
- pluralpossessive
- business requirements'
Framework definitions
- §1 · attested_usage_reviewer_confirmed
- No definition is given in NIST SP 800-171r3. The term is attested in use at 1 citation in that document; a definition is pending curation.Increment 2: attested in 800-171r3 without a glossary definition.
- §1 · web_lookup_draft
- A condition or need — operational, legal, regulatory, contractual, or organizational — that an enterprise must satisfy in order to carry out its mission and sustain its operations, independent of any particular technical solution. In security and compliance frameworks, the term is used compositionally: "business" scopes the requirement to the enterprise's mission and operational context (contrasted with, for example, purely technical or regulatory requirements in isolation), while "requirement" carries its ordinary engineering/governance meaning of a constraint that must be met. NIST uses it to describe the mission and operational context within which security controls must fit, and as business requirements change, security mechanisms such as access controls must adapt accordingly. Federal agencies apply security concepts in accordance with and in the context of the agency's missions, business functions, and environment of operation — "business requirement" being the shorthand for that contextual driver.DR-088 backfill from the noun definition column