Final answer:
It is true that security assurance and risk identification need to be factored into the schedule and budget for them to be appropriately addressed and taken seriously, mirroring the principle of buying insurance for low-probability but high-consequence events.
Step-by-step explanation:
True, security assurance and risk identification must be included in the schedule and budget if they are to be taken seriously. Including these aspects in the schedule and budget ensures that they are given proper attention and resources, much like how people buy insurance to mitigate low-probability yet potentially devastating events. Developing plans to mitigate catastrophic threats, even with a low probability of occurrence, like 10%, is considered a wise precaution in the same way individuals purchase insurance for these types of risks. The practice of including them in planning helps to avoid the risk of catastrophic loss. The little harm done by the 'wasted' time if the threat doesn't materialize is negligible compared to the potential for a ‘game over’ situation if the threat is ignored and then realized.