Reviewing and testing the security features in both commercially developed software that was being considered for use and internally developed software prior to its being moved into production.
The software is reviewed and tested for the security features before being put into production.