In the NIST FIPS Publication 200, Minimum Security Requirements for
Federal Information and Information Systems, the following items can be
construed as relevant to software assurance:
u System and Services Acquisition—“Organizations must…(ii) employ