The security design and rationale is captured in a form most effective for its life cycle. In many cases, the security design is reflected in constraints and considerations offered as notes, cautions, or warnings, relative to the overarching system design.