3.8.4

6.3.3.1 Organizations deploying websites shall ensure that their websites address the OWASP top 10 vulnerabilities.
NOTE: For a comprehensive list of vulnerability scanning tools, please visit the “Vulnerability Scanning Tools” page on the OWASP website.

6.3.3.2 Organizations shall ensure that they understand the OWASP ASVS level they need to meet for each of their websites.

6.4.2.1 Organizations using portable media shall mandate the sole use of organization-owned secure portable media.

6.4.3.1 Organizations using portable media shall:
a. Have strong asset controls for these devices;
b. Require the use of encryption on all of these devices; and
c. Have processes for the sanitization or destruction of portable media prior to disposal.