f What specifications, data formats, and protocols are used? Were any test case suites or fuzzing tools
used to evaluate the implementation (e.g. PROTOS)?
g. What is the attack surface of the software (in privileged code and overall)? What metrics are used? Can
the attack surface or attack patterns be described in terms of CAPEC?