NFR - Document security concept

[DanielaWuensch]

Feature Request

Non-functional Requirement - Document security concept
The EDC should document the security concept in a separate document and guidelines. These documents should keep information about how to securely setup, configure, and operate the EDC.
These documents could also be contain or reference to external documents like security scans, upgrade guides, or technical operating manuals.
The following topics should be covered by the security document:

• Loggs and Audit-Logging
• Data-Protection and Data-Privacy
• Identity and Access Management
• Network and Communication Security
• Application Security
• Configuration and Change Management
• Operational Security

Document security concept and define it as guideline in git to ensure implementation accordingly

Which Areas Would Be Affected?

all, including DPF, CI, build, transfer, etc._

Why Is the Feature Desired?

Security Requirement

Solution Proposal

Document security concept in git

Type of Issue

non-functional requirement

Checklist

Security concept documented and defined as guideline in git to ensure implementation accordingly

[jimmarino]

Some background information: we have already shared the results of a threat modeling and assessment study we did on the EDC codebase. Although it is over a year old, it is still relevant. Has that been reviewed?