As with FIPS 200, other information security standards, most notably the
CC, [187] represent another potential source for software security requirements,
though only althrough careful interpretation. (Refer to the Section 5.1.4
discussion of the shortcomings of the CC with regard their lack of language