How do we design a secure system?

We need to establish a structured process to evaluate IT security. What now?