Abstract: A method, system, and medium for performing a security analysis of a system, which is comprised of components and paths wherein a user identifies the components and paths of a system, associates a set of predetermined requirements to the components and paths of a system, and wherein the user selects security services to satisfy the requirements of the paths and components of the system. In at least some embodiments of the invention, the method comprises the publication of reports detailing the components, paths, requirements, and security services of a system as well as the rationale that a security service satisfies the requirements mapped to the components and paths of the system.