ISO IEC 27041-2013 pdf Information technology – Security Guidance on assuring suitability and adequacy of incident investigative methods

Prior to designing a process for use in an examination, a proper set of requirements should be produced, accepted by the client and recorded in accordance with good practice. This set of requirements should be derived from the requirements identified for the complete investigation and may include both functional and non-functional requirements. A requirement is a statement which expresses a need and its associated constraints and conditions. Conditions are measurable qualitative or quantitative attributes which can be used to qualify requirements. Constraints are restrictions on the design or implementation of the solution, such as interfaces to existing systems, physical size limitations or local policies. Each requirement defines an essential capability, characteristic or quality factor. Each individual requirement statement should be necessary, implementation-free (ie. it states only what is required, not how the requirement should be met)，unambiguous, complete, singular and consistent with the remainder of the requirements in the set. Requirements vary in intent and in the kinds of properties they represent. They can be grouped together into similar types to aid in analysis and verification. Examples of types of requirements include: ●Functional – describe the functions or tasks to be performed and will include such considerations as expected inputs and outputs; ●Performance – defines the extent, how well, and under what conditions a function or task is to be performed; Interface – defines how the solution interacts with external systems, or how elements within the solution (including human elements) interact with each other; ●Process – include compliance with local laws and processes or administrative requirements; ●Non-functional – define how a solution is supposed to be, including quality requirements such as portability, reliability, maintainability and security, or human factors requirements such as safety, efficiency or health and wellbeing.
Functional requirements are those stemming directly from investigative needs and which are expected by the users of the process. They do not define how the process should operate but will include such considerations  as expected inputs and outputs. All functional requirements should be satisfied by the investigation.