Risk management and compliance

If you limit yourself only to looking at what is already explicitly documented in the organization in the form of policies, procedures, supporting documentation, and other existing documentation (for example, management artifacts), you’ll find that you have a good picture but not a complete one. At this stage, the picture can be potentially incomplete in two very important ways. First, there can often be other security objectives that are important to the organization but that are unrealized by the authors of policy and procedure documentation. To see this in action, recall the earlier example where we posited a developer who had spent years working inside a particular technology stack (for example working within the Java ecosystem) to the exclusion of all others. They may potentially take that technology stack so much for granted that the idea of stepping outside of it is a place their thought process just won’t naturally go.

The second...