> developers of critical products may not perform self-assessment and need to involve third-party auditors