What does a good security requirement for an application look like? I am talking about functional as well as non-functional security requirements here.
For traceability reasons I consider it important that the requirement is fully testable. I also want it to be technology-independent. What else is considered important for a good security requirement?