Because the system/application domain covers an expansive range of topics, it follows that the baseline standards are diverse. For example, the _____________________ explains how to compose and assess the security of applications.