Before executing the Risk Management Framework, it is important to understand the concept of security and privacy requirements and the relationship between requirements and controls.