My challenge with this guidance is the lack of focus in what is truly minimal as this list is quite extensive. As a security practitioner, I would simply threat

My challenge with this guidance is the lack of focus in what is truly minimal as this list is quite extensive. As a security practitioner, I would simply threat model the product and provide minimum requirements to release.