method) are intended to be used as a—
u Tool that enables engineering organizations to evaluate their security
engineering practices and define improvements to them
u Method by which security engineering evaluation organizations, such as