A newly certified CT-SEC tester is asked to justify to management why security testing should be planned and performed from several distinct perspectives rather than only checking documented requirements. Which set of perspectives is explicitly recognized as the basis for planning, performing, and evaluating security tests?