software functions, and so may need to be allocated back to the system level.
Certain types of pervasive security requirements may be best addressed as part of
the system’s security policy, e.g., “All input from users must be validated to ensure
its conformance with the expected format and length of that type of input.”