The existence of a documented SDLC that includes the inclusion of appropriate security controls such as checkpoints, secure code review, and developer training