Thanks. There is no need to keep most security controls for common tools secret, and the more organisations discussing how they do it the better.

For example, a small org with no security people or a non-profit could be made much more secure by following this, so why not publish it?