At this point, more extensive, useful language is likely to be found in
published guidance documents, such as NIST SP 800-53 and the Defense
Information Systems Agency (DISA) Application Security Project’s Application
Security Checklist [186] and Reference Set of Application Security Requirements.