Measurement WG, for example (see Section 6.1.9.1). The WG’s approach is
typical in its attempt to “leverage” metrics from the software quality arena
(e.g., CMMI) and the information security arena (e.g., CC, SSE-CMM, [121] NIST
Special Publication (SP) 800-55, ISO/IEC 27004).