testing is not indicative of software security policies and procedures that alone
will provide adequate software assurance.
The main objective of system ST&E is to determine whether the system
as a whole satisfies its information system security requirements, i.e., those