https://www.ifsqn.com/forum/index.php/topic/34302-sd308-position-statement-product-vulnerability-assessment/