Efficacy review of all previous outputs

Corrective actions for noncompliance

Inspection of sensitive activities

Actions that might introduce risk

Organization-specific rules

Technology-specific objectives

Foundational knowledge or regulations