1. Implementation is a team effort
2. Iterate and improve: start simple and stupid, then expand and improve – don't overthink stuff
3. Integrate into existing workflows, security is not an add on or a checklist
4. 