software do not always map directly to the requirements of the organization
acquiring that software, particularly with regard to security requirements. Many
commercial developers have admitted that security is not considered a major
requirement because of the current practices in acquisition to accept software