I have a potential use case for VyOS as a virtual appliance (vDirector, OVA deployment).

This may require compliance to the security standards, hence I wanted to review the present stance and see if anything is outstanding.