u Establish protection levels for system components
u Document system security requirements, threats, and countermeasures
u Develop a system security plan and test procedures.
Even these early life cycle activities are limited to what are, in effect,