The subdimension _Design" fits best in Culture and Organization and is yet not enough for an own dimensions. Putting it into Application Hardening wouldn't cover Infrastructure Hardening.

I (Timo Pagel) observed that awareness is the key to scale security. In case developers and operations understand the value, they will be more engaged in performing tasks. Therefore, the initial usefulness of 3-3,25 on average has been enhanced to a usefulness of 4 . In case you feel different, please open an issue/pull request.