Your description of GDM’s policy doesn’t take into account the FSF update.
However, it has yet to be fleshed out: mitigations have not been connected to risk thresholds
This is no longer fully true.
Your description of GDM’s policy doesn’t take into account the FSF update.
This is no longer fully true.