Typically you would start with [0] and it's derivations for specific domains.

The core idea is "The fundamental concept is that any safety-related system must work correctly or fail in a predictable (safe) way."

The interesting question is what to do in corner cases you did not specify explicitly. Typically it is still considered "safe" if you don't do what you would have specified in hindsight, but fall into the defined failure reaction. You also try to make security problems take that path.

Checking that the system does what is specified is called "verification" and the domain of functional safety. Checkin that this is what you actually meant (it actually solves the user's problem) is called "validation" and especially for vehicles called SOTIF [1].

[0] https://en.m.wikipedia.org/wiki/IEC_61508

[1] https://www.iso.org/standard/77490.html