1. A security assessment method for assessing security of a computerized system under development, the system including assets and being managed in accordance with an organization policy, the method including: providing an organizational computerized system development policy; classifying the assets in the system under development, thereby generating asset classification information; and automatically creating at least one security requirement based on said asset classification information and said organization policy.