A process used to determine that the security features of a system are implemented as designed and that they are adequate for a proposed application environment.