I recently had engaged in a security discussion with my companies cyber security risk lead, discussing security controls and standards they would be holding the project to. The expectation of the Risk Lead was that these controls would trace back to architecturally driven Non-Functional Requirements defined for the project. It would be my responsibility for defining these Non-Functional Requirements for the development team to accomplish in Design or in Sprint.
This made sense for many of the controls defined, however some of the controls are less about qualities and properties of the system and more about expectations and requirements of the SDLC process itself. Eg. Production data should be masked and anonymized before cycling to a Test or QA system.
I argued on the call that it doesn't make sense for a Non-Functional requirement to define anything but a quality attribute of the System, and that the Software Development Lifecycle process is not a component of the system but of the project team.
Their reaction was that I have no idea what I am talking about and that I should do more research about Non-Functional Requirements.
Their conviction led me to question if I really understand Non-Functional Requirements correctly? The literature I read never mentions the scope of quality attributes extending to SDLC processes like cycling production data to a test system. I am not saying that capturing such requirements of the SDLC process is NOT important, I was just arguing that these are not Non-Functional Requirements. Am I wrong?