Mitigation and residuals, would fix #416 (#418)

charter-template.html

@@ -252,7 +252,15 @@ <h2>Success Criteria</h2>
       Testing efforts should be conducted via the <a href="https://github.com/web-platform-tests/wpt">Web Platform Tests</a> project.</p>
 
     <!-- Horizontal review -->
-    <p>Each specification should contain sections detailing security and privacy implications for implementers, Web authors, and end users.</p>
+
+    <p>Each specification should contain sections detailing 
+    security and privacy implications for implementers, 
+    Web authors, and end users, 
+    as well as recommendations for mitigations.
+    There should be a clear description of the residual risk 
+    to the user or operator of that protocol 
+    after threat mitigation has been deployed.</p>
+
 	  <p><i class="todo">For specifications of technologies that directly impact user experience, such as content technologies, as well as protocols and APIs which impact content: </i>
 		Each specification should contain a section on accessibility that describes the benefits and impacts, including ways specification features can be used to address them, and
 		recommendations for maximising accessibility in implementations.</p>