What Must Be Done Here? Using a Bounded Application-Security Ontology at the Point of Change

The security guidance that bears on code is real but scattered. It lives across secure-development frameworks, verification standards, controls catalogues, threat taxonomies, and, increasingly, normative regimes such as the EU's NIS2 -- and most of it is written for readers other than the enginee...