What it asks for. Point (e) requires security in the acquisition, development and maintenance of network and information systems, including vulnerability handling and disclosure. Security has to be considered across the life of systems, not only at deployment.
In practice. Security requirements are defined when buying or building systems, development follows a secure life cycle with testing, change and patch management keep systems maintained, and a vulnerability handling process covers discovery, prioritisation, remediation and coordinated disclosure. Evidence includes procurement requirements, secure development procedures, patch metrics and a vulnerability disclosure policy.
Common gaps. Security requirements are often missing from procurement of off the shelf and SaaS products. Few entities publish a clear way for outsiders such as researchers to report vulnerabilities.