Unfortunately, where there is software, there are risks from vulnerabilities. In response, the Department of Defense has recently expanded the key document governing acquisition, 5000.02.