(example: non-administrators should not modify system binaries),
(example: non-administrators should not view the shadow password file),
(example: the web server should respond to client requests in a timely fashion), and
(example: the ps program should provide exactly the process table information listing functionality described in its documentation - no more, no less.)
The FSA contains a list of integrity, confidentiality, availability, and correctness requirements for the base .Fx system. Many commands, tools, and utilities documented in sections 1, 6, and 8 of the manual are partly responsible for meeting these base system requirements. Consequently, borrowing entries from the list in the FSA is a good way to begin the list of requirements for these commands, tools, and utilities.
Complex servers and subsystems may have their own integrity, confidentiality, availability and correctness requirements in addition to the system-wide ones listed in the FSA. Listing these additional requirements will require some thought and analysis. Correctness requirements will most often deal with configuration issues, especially in cases of programs that can load modules containing arbitrary functionality during run-time.
For low-level features, such as the individual functions documented in sections 2, 3, and 9 of the manual, it is generally sufficient to proceed with only a single correctness requirement: simply that the function behaves as advertised.
A good security considerations section should explain how the feature can be misused to violate each general security requirement in the list. Each explanation should be accompanied by instructions the reader should follow in order to avoid a violation. For the sake of brevity, assume the reader is familiar with all of the concepts in the FSA. When referencing potential vulnerabilities described in the Secure Programming Practices manual page, sprog(7), likewise cross-reference that document rather than replicating information. Whenever possible, refer to this document rather than reproducing the material it contains.