As with all software, the requirements process for secure software may require
multiple iterations of elicitation and analysis. Requirements engineers should not
feel constrained by conventions that avoid the statement of negative requirements
orthe inclusion of non-actionable requirements.These need to be captured and