discovered so late in the system life cycle is usually prohibitive. For this reason, it would behoove
accreditors to become better informed about the threats, vulnerabilities, and mitigations that are
unique to the software components of the systems they evaluate, and to mandate inclusion of secure
development practices and security reviews starting in the earliest stages of the life cycle so that he/