Require the developer of the system, system component, or system service to implement an explicit process to continuously improve the development process.

Developers of systems, system components, and system services consider the effectiveness and efficiency of their development processes for meeting quality objectives and addressing the security and privacy capabilities in current threat environments.