reviews and tests are not useful, particularly as an assurance validation measure,
whether in the context of the Security Test and Evaluation (ST&T) phase of a
government C&A, a third-party IV&V, or a commercial “security push.”
As illustrated in Table 5-11, a range of security reviews, analyses, and