I've been looking at OWASP Application Security Verification Standard 4.0.2 for a while now, and I'm trying to understand all the checkpoints in detail.
I am not sure what exactly the author of a particular point meant. Therefore, I have a request to you to explain item 1.1.1 from section V1.1 Secure Software Development Lifecycle Requirements.
Section 1.1.1 reads Verify the use of a secure software development lifecycle that addresses security in all stages of development.
How to verify that this requirement is met by the company? What documents are required to verify that the company is complying with the SSDLC? Is it sufficient that all five phases of the SDLC are completed and documented and that security testing has confirmed the security of the solution and/or application? What is your practical experience to verify that this point has been correctly implemented by the organization?