PoliciesFormal policies required to legitimise and operationalise the continuous validation of application security.