Where full adoption is out of reach, adopt the parts of FIASSE that the prerequisites do support and name the parts that are on hold. A team with a strong senior bench but no requirements process can start with merge-review threat awareness and SSEM vocabulary in code review, and defer requirements integration until the process exists. A team with a functioning requirements process but a thin bench can start with requirements integration and defer the mentorship-heavy practices. Naming the gaps prevents the partial adoption from being mistaken for full adoption, which is what protects the framework's indicators (Section 8.2) from being read against the wrong baseline.
Degraded-mode adoption is a legitimate posture, not a failure to adopt. What is not legitimate is claiming full adoption while operating without the prerequisites; that produces the pattern where FIASSE gets blamed for outcomes that were structurally out of its reach.