How about better rules? Clinger-Cohen was probably better than what was before, but SDLC has some industrial-sabotage elements. If bridge building law can specify details, I don't see why SDLC-type law can't ever specify things like automated build pipelines, unit tests. https://twitter.com/krusynth/status/1339249237264117768
Instead these sort of of laws specify a new batch of people (ISSO, ATOs) populated by non-techies documenting that meetings were had & not documenting if things work or are secure.
♡ 0 ↻ 0