investigated and evaluated by developers as early in the software life cycle as
possible to allow sufficient time for risk assessment and impact analysis. This
is particularly important for new versions of or replacements for software
components that perform security functions or other critical trusted function,