u Metrics must be adopted to measure security improvements and
enforce accountability.
u Education is a key enabler of security improvements.
Beyond stating these principles, the ASAP guidance provided in the Developing