At some point, a vaccine is developed, the population develops immunity, or the population starts to die off, so there are fewer people to infect, and then the curve slows and eventually reaches a maximum peak. When the people say that security architecture is about requirements, they should note that there are two different types of requirements. Some assurance requirements are there to assess whether the people control is properly functioning; others try to determine whether the control is actually doing any good. But, in that case, the only assurance requirements available are having signs in the washroom reminding staff to wash their hands or doing lab cultures on swabs from the hands of the staff. But some pieces and parts of security can be incredibly simple. One small shop had a slightly different idea. Used to producing small items for the restaurant trade, the owner noticed that a great many restaurant employees wore billed (baseball) caps.