anchor: Practice 14: Monitor Factors that Affect Risk and Indicate Security Effectiveness
positive: Practice 14: Monitor Factors that indicate security effectiveness and affect risk.
negative: Practice 31: Monitor Factors that Affect Risk and Indicate Security Effectiveness