Very good point particularly w.r.t. "remediate vs. mitigate". Do you have any articles/resources/books that you can point to on how it is done for "industrial software"?