The security assessment documentation shall be