¨Identify system security threats and objectives by doing a risk assessment
¨Identify cost-effective technical security countermeasures
¨Identify complementary environmental security countermeasures
¨Determine confidence required in the system security functions
¨Correlate threats and objectives with the functional and environmental security countermeasures and confidence requirements