Confusion about Non functional requirement table for data confidentiality

I have the below table for non functional requirement analysis, I wonder if the below table seems ok for my project. Lets assume this is supposed to be very important quality scenario and should be taken as a NFR (non functional requirement section). I wonder how tester will test it as the allowance must be meet for project success. Should I move this to QA or NFR?

NFR_01: Security: Users PII data confidentiality

1. Description: Users personally identifiable information, preference and history data confidentiality should be very high. System must protect data confidentiality as much as possible.

2. Environment: System already in production, Unwanted access to confidential data happens

3. Stimulus: External entity or internal unauthorised entity

4. Response: System must protect data confidentiality and unauthorised access should be denied

5. Measure: [Users PII data confidentiality] = [100 - [number of attacks attacker succeeded] / [total number of attacks]]

6. Allowance: [Users PII data confidentiality] >= 99.999