Values for security metadata observation made about security requirements with which a security domain must comply. [ISO IEC 10181-1] Conveys the agreement of an asserter to comply with jurisdictional, community, or contractual (security domains) codes of conduct which an information custodian requires as a condition of authorizing collection, access, use or disclosure.
For example, DURSA, DIRECT Applicability Statement, HIPAA Covered Entity and Business Associate Agreement, and FTC PHR Vendor, Related Entity, and third party agreements.