u Common language for describing software security weaknesses in
architecture, design, and code
u Standard metric for software security tools that target those weaknesses
u Common baseline standard for identification, mitigation, and