target and exploit them, so that the DiD measures can be adjusted accordingly
to maintain their required level of effectiveness.
Application security falls short of providing an adequate basis for software
security assurance comparable to the quality and safety assurances that can