Security Plans Are Not Living Documents