I think it has to be modular and reusable. Like GDPR compliance spec should be opensourced and reused by all SaaS specs.