Ensure that test data is protected and controlled.

Establish a testing process to ensure security functionality is verified and that testing does not introduce new vulnerabilities.

Supervise and monitor outsourced system development to ensure that it meets the organization’s security requirements.

Establish and manage a secure development environment for system development and integration.

Apply security principles to system engineering efforts.

Limit changes to software packages to necessary changes and all changes should be strictly controlled.

Review and test application systems when operating systems change.