Understand the environment
Start with the problem, not the feature list.
Define the systems involved, the security need, and the decisions the software should support. Consider how people already work and where useful context is missing.
- Security problem and system context
- Operational needs and existing workflows
- Clear purpose for the software