Software security specifications

["i.matilde () gmail com" <i.matilde () gmail com>]

I need to develop a policy that will list security requirements for
new applications developed internally or by contractors, general
specifications like validate input ecc...., I am looking for some good
resources on the subject, any recommendations?

Best Regards,

Shawn