5. Carrying out and validating the identified fixes for security risks.
Surrounding all of these activities is a sixth, pervasive activity,
Measurement and Reporting. According to Gary McGraw, whose article on the
BSI RMF appears on the DHS BuildSecurityIn portal: [107]