a. Which process model or standard is used that specifies the activities/practices that are followed (e.g.
BSIMM, OpenSAMM)?
b. Which security-related frameworks are used, such as ESAPI or built-in frameworks?
c. Which SDLC activities are used to directly prevent or mitigate vulnerabilities in the application