KV is missing the point. The problem is not really with generating the documentation, so much as it is with the software engineer lacking understanding of what they are writing about, what the security processes should be. That is why the engineer is at a loss and looking for some kind of a template, to rely on others who have already done the work. With regard to tackling security processes in a startup, one could refer to NIST standards. Maybe not the most suitable per se, but a starting point.
I’ve yet to see a solid execution of how to convey INTENT.
It’s the why vs what issue scaled back a layer. With software and systems you want the user to do solve many problems with your solution, but you never let them know your exact intent and that causes shoehorning.
