What it asks for. Organisations should manage the security life cycle of software they develop, host or acquire to prevent, detect and fix weaknesses before they cause harm. It covers secure development processes, third party components and vulnerability handling.
In practice. Good practice includes a documented secure development process, threat modelling for significant changes, code review and automated testing such as static and dynamic analysis, and an inventory of third party components with tracking of their vulnerabilities. Developers receive secure coding training, environments are separated, and a process exists for receiving and fixing reported vulnerabilities. Evidence includes pipeline configurations, test results, component inventories and records of fixed vulnerabilities.
Common gaps. Third party dependencies are often unmanaged and scan findings pile up without triage. Security testing tends to cover the main application while internal tools and scripts are ignored.