That which is not security enforcing, but must function correctly for the Target of Evaluation to enforce security.