including access to security-competent development or integration
contract services. Parts of the development may be outsourced or
offshored. Risk assessment and/or vulnerability information may be
classified, precluding access by developers without clearances.