The organization requires that information system developers track security flaws and flaw resolution.
No STIG checks reference this CCI.