SA-10: Developer Configuration Management

personnel to whom security flaws and flaw resolutions within the system, component, or service are reported is/are defined;

configuration items under configuration management are defined;