Add discussion on CIS controls to security.md (#1044)
Add discussion on CIS controls to security.md (#1044)

Modify the security.md documentation (the assurance case)
to discuss how we address the "critical controls" identified in the
"Center for Internet Security (CIS) Controls" document
<https://www.cisecurity.org/controls/>.
These are a "prioritized set of actions to protect your organization
and data from known cyber attack vectors."

The controls don't map as well as one would like for our circumstance,
but it's useful to walk through them to see if we're missing anything
important.

Signed-off-by: David A. Wheeler <9ae72d22d8b894b865a7a496af4fab6320e6abb2@dwheeler.com>
yannickmoy/cii-best-practices-badge,linuxfoundation/cii-best-practices-badge,yannickmoy/cii-best-practices-badge,linuxfoundation/cii-best-practices-badge,yannickmoy/cii-best-practices-badge,linuxfoundation/cii-best-practices-badge,coreinfrastructure/best-practices-badge,linuxfoundation/cii-best-practices-badge,coreinfrastructure/best-practices-badge,yannickmoy/cii-best-practices-badge,coreinfrastructure/best-practices-badge,coreinfrastructure/best-practices-badge