1. Ensure host and network security basics are in place
2. Implement life cycle governance
3. Review security features
4. Use external penetration testers to find problems
5. Identify personally identifiable information (PII) obligations
6. Perform security feature review.
7. Create or interface with incident response
8. Ensure QA performs edge/boundary value condition testing
9. Integrate and deliver security features
10. Identify software defects found in operations monitoring and feed them back to development
11. Use automated tools along with manual review
12. Feed results to the defect management and mitigation system
13. Feed results to the defect management and mitigation system

Source: https://www.bsimm.com/about.html