The SA-11 controls fail somewhere between the responsibility of the cloud operator and the developer. Some controls (esp SA-11 itself) fall more on the side of the operator (develop a security assessment plan, implement a flaw remediation process), so it makes sense to sync with the OSD team about what they are doing.

Acceptance criteria:

 - reach out to the OSD team about what they are doing wrt the more process-side controls in the SA-11 group and refine our answer based on that