So, a new feature that adds an ???about??? tab to a website probably doesn???t need to undergo rigorous security testing; however, a new feature that collects users??? social security numbers absolutely should undergo testing (including evaluation whether collection of this PII complies with the organization???s policies, that there is a need to know for this sensitive data, that the sensitive dat