controls, and properties of the software elements of information systems.
The quantity and scope of requirements that can be derived from policy
or law depend on the scope and purpose of that policy or law. The language
of such mandates is usually very limited in terms of explicit discussion of