Section SD1.3.3 of the standard goes on to specify how QA of key security
activities should be performed. This includes making sure QA starts early
in the SDLC and is documented and reviewed at all key stages of the SDLC.
Section SD1.3.4 goes on to state that security risk should be minimized