This policy provides a requirements framework for managing application vulnerabilities using the concept of prevent, find, eliminate before the flawed application can be deployed and its flaws exploited to dteal sensitive information. Flawed (broken) applications are the greatest software development challenge of the day.