functional-level security requirements