The organisation requires the developer to follow a documented development process that addresses security and privacy requirements, identifies standards and tools, documents tool options and configurations, and controls the integrity of changes to the process and tools, and reviews these at a set frequency against defined requirements. The GC discussion advises against identifiable personal information in development and test except in exceptional cases, favouring dummy, scrambled or obfuscated data, and contractual deletion of test data by vendors. 13 enhancements.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.