Defines assets, threats, trust boundaries, required controls, secure defaults, and implementation guidance for CORS. This reference fixes the adoption boundary, failure behavior, and observable evidence while leaving environment-specific limits configurable.