the need of systems to conform with governing information security policy. To
date, DoD has neither added software security language to DoDD 8500.1, nor
mandated a separate, comparable policy governing security for software.
Even if the certifier wishes to verify the security properties of the