What it asks for. Secure coding principles should be applied to software development. This applies to software developed internally and, through requirements, to software developed by others for the organisation.
In practice. The organisation sets secure coding standards for its languages and frameworks, trains developers on common weaknesses, and builds checks into the pipeline such as static analysis, dependency and secret scanning. Code review includes security considerations, and third party components are tracked and kept up to date. Findings are triaged and fixed within defined timescales. Evidence includes the standards, training records, pipeline configuration, scan results and records of remediation.
Common gaps. Scanning tools are often switched on but their findings pile up unresolved. Third party libraries and low code or scripting work done outside the main engineering teams frequently escape the same standards.