e. Which secure coding rules/practices are followed? (e.g. CERT, MISRA, ISO SC-22, custom). How is
conformance enforced (e.g. automated tools during checkin)?
f. What differences, if any, exist between the secure development practices for legacy code, versus newly
developed code?