The organization defines tools and methods to be employed to perform a vulnerability analysis for the information system by the developer.
No STIG checks reference this CCI.