Specifically in OpenSSL. Per the official site, OpenSSL 3.0.8 is the most current FIPS compliant version. However, this version has at least 5 known CVEs, including two at 7+. Other than doing a in-depth dive on the specific CVE, working up per-system mitigations, and getting these approved...how does one ever get to anything like "full FIPS compliance" per 3.13.11? Especially if one doesn't have a full team of ISSEC folks working with them, and is a "one-person cybersecurity department"?