requirements, concerns, and priorities
u Define requirements for risk assessment and testing of software; do so
using language that includes standard representations of software
vulnerabilities (e.g., CommonVulnerabilities and Exposure (CVE), CWE)