Considerations for projects that dont fit modern repo management practices

[TheFoxAtWork]

In Risk Management, we occasionally need to apply tailored controls or compensating mechanisms that achieve or partially meet the desired outcome. This could be the result of technical limitations, design, or other factors that impact or block security outcomes.

In the course of this group's work, should we consider development of guidance for adopters where projects, by design or technical limitation, cannot provide metadata to align with the metric? Should we guide projects on compensating mechanisms that offset risk their project may present to potential adopters?