Our in-company dms used to be just that. An in-company dms. But now it falls under the authority of #iso27002 and I was asked to write secure engineering principles for it. I was happy to find out that the #owasp #asvs offers very good handles for it. But if I decided to makeup some myself, I believe it would also have been accepted. #infosec #webapplication