SA-10: Developer Configuration Management

configuration items under configuration management are defined;

personnel to whom security flaws and flaw resolutions within the system, component, or service are reported is/are defined;