Security Policy Define Vulnerability List of effected packages/resources Possible damage & severity Possible fix