u Evidence of a developer search for vulnerabilities within the
architecture, including a search for covert channels
u Evidence of the continued maintenance of environment development
controls, including physical security and controls