Start with the problem.

A useful first note is short: what you are building, company stage, environment, current security pressure, and the decision you need to make. A narrow first scope is usually better than a vague “full security review.”