many organizations are working to develop the necessary language, regulations,
policies, and tools to improve the security of acquired software.
In response to the increasing costs of patching vulnerable software—and
the dwindling “mean time between security breaches” of unpatched systems