their organization’s current knowledge level, processes, and practices, i.e.,
to determine which techniques, tools, etc., are worth furtherinvestigation.
u Information on how to participate in existing software security
activities or to establish new ones.