Which document formally defines the security requirements that a third-party software vendor must meet before their product can be integrated into an organization's environment?
