While software assurance may be addressed as a component of the current
mandated C&A processes, it is not nearly inclusive enough to ensure software
assurance or software security.
Several models exist today, but a general set of criteria would—