Risk Management Framework and project management

In 20 years of building and reviewing SSPs, some of the biggest mistakes I see system owners and/or security professionals make is...