Install the analog the essay only names from the working half of software. CVE, CWE, and the OWASP Top 10 are a catalog of instances and recurrent classes that refuse whole-system coverage. FIPS 140-3, Common Criteria (ISO/IEC 15408), and ISO/IEC 27001 are local certificates that procurement treats as global seals; each disclaims that reading in its own text. Institutions already have the seal and lack the catalog. The named postmortem is the 2008 ratings-agency AAA — FCIC (January 2011), Moody's nearly 45,000 AAA stamps from 2000–2007, 83% of 2006 Aaa MBS tranches later downgraded, CMLTI 2006-NC2 — not Pearson. Competing account: 2008 was issuer-pays and a bad model, so a better seal certifies the pool. Discriminator: post-Dodd-Frank structured ratings with issuer-pays still standing. Author dispositions stay author-owned.