Management uses applications developed under secure development practices to a prudent level of security, sets security control requirements for every acquired or developed application, involves information security in monitoring development, tests external-facing applications by penetration testing, vulnerability assessment and application security testing before launch or significant change and remediates before production, holds third-party developers to the same controls, and requires that applications support a prudent control set with audit trails and activity logs, user and group profiles, changed and disabled default accounts, timely patching, data entry and processing validation and the further capabilities the booklet lists.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.