Requirement
"Information security requirements shall be identified, specified and approved when developing or acquiring applications."[1]
Explanation
Software security must be considered during the organization's software development initiatives. An example of software development security requirements is the "OWASP Secure Coding Practice". The organization can require that it's software development follows this secure coding practice and require that any software it acquires also meets the same of similar requirements.
