old rules for new stuff

Why do we need system-specific security requirements? Can't we just comply with instructions? Yes we can, and we must. But it's not enough.

A new system does new stuff (or familiar stuff in new ways) or we wouldn't bother constructing it. New stuff means new risk components (assets, threat sources, vulnerabilities) and consequently new risk. New risk means we cannot simply rely on old rules. We need to rethink how security is implemented for this very system. System-specific security requirements.