...
Naively mapping sections to pulldowns would still have (Red) sections with more than 20 reqts, and would need some further breakdown or summarization.
There are a number of SHOULD requirements in security, so we would need to decide how to weight these in any score reporting.