DHS about to finalize a draft for U.S. federal agencies https://cyber.dhs.gov/assets/report/bod-20-01-draft.pdf US-specific of course but might be worth citing in SSR2 report on our VD recommendation. fwiw k