The new SP 800-18r2 guidance pushes security, privacy, and supply chain planning toward a more operational model, with machine-readable maintenance and automation in view.