Check out this post on one of the non-functional requirements for your applications - Security

https://dev.to/aws-builders/non-functional-application-requirements-security-4613