325 Keep in mind that a process improvement model, even a security-enhanced one, will only be as
successful in improving the state of the resulting software as the process it is meant to codify and
discipline. It is just as possible to codify a bad process, and to repeat it with quasi-mechanical
discipline and rigor, as it is a good process.