The security design and rationale is captured in a form most effective for its life cycle. In many cases, the security design is reflected in constraints and considerations offered as notes, cautions,or warnings, relative to the overarching system design.