acquisition decisions. Also excluded is discussion of the physical environment
in which software is created or operated. The SOAR also does not address
operational and personnel security considerations and nontechnical risk
management considerations except to the extent that the developer is involved