Following several security breaches in their application, an organization is trying to adopt Secure SDLC practices for building their secure software They want to ensure that their software meets certain policies before it can be deployed to production.

They specifically want to automatically perform a SAST scan on the code hase and they want the soff ware to be deployed to production any if the SAST scan produces no critical or high severity security vulnerabilities. If at Jeast one critical or high seventy securty vulnerabillies are found, alerts must be sent to concerned stakeholders and the deployment to production must not happen.

Which of the following secure $50$ LC practices must be used by the organization during initiation phase to achieve this?

Threat modeling

Manual code review

Securty quadity gotes

incident respocise plan

Corifyuratuon review