security-requirements-classification

Classify data and functional assets by sensitivity, score CIA impact, derive per-tier required controls (authn/authz/encryption/logging/retention/review/masking/monitoring), write functional security requirements with test-how + failure-mode, generate abuse cases, and map requirements to framework control IDs. Not a security audit. Mermaid diagrams with optional PNG export.