Putting MITRE ATT&CK into Practice: The “MAD” Certification Process