Governance in Legacy SystemsStrategies for applying formal security governance to legacy systems and contracts