How To Write a Security Requirement

You've just been handed a new payments API to secure. Stakeholders want "good security." Compliance wants "PCI-DSS alignment." Your CISO wants "zero trust." The dev team wants you to stop blocking the