security requirements