well as tools and techniques to support the processes. Unfortunately, most of this
work does not explicitly consider security.Work that does is usually concerned
with security requirements in the sense of requirements engineering for the
security functionality in a system, such as access controls. Our concern, however,