Require the developer of the system, system component, or system service to implement only organization-approved changes to the system, component, or service.
No STIG checks reference this CCI.