I was going to make the same observation - typically this will be defined in your secure development policy or similar, and be part of your ISMS controls for whatever frameworks you're aligning to.
It's possible this is more relevant in B2B contexts than B2C
No comments yet.