with business requirements, benefits, technology, technical
performance, costing, and timescale)
2. Ensuring that security requirements have been defined adequately
3. Ensuring that security controls agreed to during the risk assessment