Quality assurance of key security activities should be performed
during the development life cycle…to provide assurance that security
requirements are defined adequately, agreed security controls are
developed, and security requirements are met.