Our application needs to run in a locked-down operating system. Due to quality and regulatory concerns, all updates shall be prevented or blocked. Therefore, our deployment includes the pre-configured operating system. To make any changes to the OS, admin credentials need to be used.
Some teammates think the "updates blocked" requirement fall in the same domain as the application. I think they are out of scope for the application.
Should system configuration settings have a specification assigned to them? On what document? Should this be part of the SRS with the rest of the application's software specifications or should this be recorded as specifications in another domain?
Testing of the requirement shall happen regardless of where it is documented.
Thanks in advance for your time.