Business processes are of major importance in today’s business environments, and their unimpeded execution is crucial for a company’s success. Since business processes are permanently exposed to a variety of threats, organizations are forced to pay attention to security issues. Although the security of business activities is widely recognized as important, business processes and security aspects are often developed separately and without considering different objectives. This paper proposes a methodology that supports corporate decision makers with the elicitation of security requirements based on business processes, for the analysis of threats and vulnerabilities, and for the selection of appropriate security measures.