Security assessments are costly and time consuming and cannot be carried out from scratch each time a system is updated or modified. This motivates the need for specific methodology addressing the maintenance of assessment results, in particular, and a component-oriented approach to security assessment in general. This paper presents such a methodology in the setting of model-based security assessment as developed bu the EU-project CORAS. The main focus is on the maintenance part.