Is there any on going research on the degree to which the lack of anonymity, or fear of negative publicity, depress cyber incident reporting [closed]

There are a number of websites and other services that purport to gather vulnerability or incident information, intended to help the IT community. For example the CISA run Automated Indicator Sharing site
exists to

enable real-time exchan… Continue reading Is there any on going research on the degree to which the lack of anonymity, or fear of negative publicity, depress cyber incident reporting [closed]

Distinction among the criteria "implemented correctly", "operating as intended", and "producing the desired outcome"

Throughout the RMF documents, one finds the phrase, a) “implemented correctly, b) operating as intended, and c) producing the desired outcome” with respect to meeting security requirements or control assessments. Some years … Continue reading Distinction among the criteria "implemented correctly", "operating as intended", and "producing the desired outcome"