another component versus the security functionality (and associated
data/formats) actually provided by the second component
u How to predict and measure the security properties and assurance
levels of individual components and the impact on those properties