G. K. Butterfield actually said...
This document indicates that CMS postponed a final security assessment screening, but in its place, CMS did put in place a number of mitigation measures, and it concluded that these measures would mitigate any security risk.
Context
Butterfield discusses a document about security measures for HealthCare.gov.
10/29/2013