https://staragile.com/blog/safe-popm-vs-cspo