moved security requirements into CC classes, minimized set of SOs