Despite the abundance of technical security and privacy solutions, a significant usability gap persists, as users often struggle to operate them effectively due to a misalignment with their mental models. This frequently leads to poor adoption, insecure behaviors, and unmet security and privacy requirements. To address this, the present paper proposes a mental model-based framework for capturing usable security and privacy (USP) requirements. Our approach integrates i* (a Goal-Oriented Requirements Engineering (GORE)) with a novel conceptualization of mental models, providing an extended modeling language and a systematic methodology. This enables the explicit linking of security and privacy mechanisms to the specific competencies, knowledge, and perceptions of diverse user profiles. The applicability of the framework is demonstrated through an Ambient-Assisted Living example, showing how it bridges the gap between technical objectives and user cognition to ensure protection is both robust and usable.