apparently, "BSIMM is a collection of good ideas" about how to run a security group, iiuc. http://bsi-mm.com/ perhaps too high-level to make explicit mention of caps, but i hope it is in there somewhere.