u Security test cases or scenarios (based on misuse and abuse cases)
u Test data, including attack patterns (see Section 3.2)
u Test oracle (if one is to be used)
u Test tools (white box and black box, static and dynamic)