and design security, security of functionality and components,
verification and test results); (4) outcome (in terms of security
performance, risk reduction, customer satisfaction); (5) risk
management considerations (e.g., threat modeling, attack surface,