BSR should be Vendor-Neutral

Both Platform and Authentication are not



cjp