Security assurance framework -- Part 2: Analysis