Start with the problem you need to protect.

Describe the data or application, the real workflow or exposure, the current control or gap, and the decision timeline.