A.8.29 Security testing in development and acceptance