and that required activities such as vulnerability disclosure should be
implemented consistently.
In her article, Who is Liable for Insecure Systems, [305] Nancy Mead of
the CMU SEI provides an overview of key published opinions in the United