The organization requires the vulnerability analysis performed by the developers employ organization-defined tools and methods.
No STIG checks reference this CCI.