Encrypt all data and files at rest, in transit, and in use: Comprehensive encryption ensures data confidentiality is maintained throughout its lifecycle, meeting the requirement for secure data handling.
Configure SOAR to monitor and intercept files and data leaving the network: A SOAR system provides automated response capabilities to detect and mitigate data exfiltration attempts dynamically.

Given the scenario where the security assessor identified gaps but chose not to report them, the primary violation is with "due diligence." The assessor did not complete the due diligence process by withholding critical information. If the assessor had identified the gaps (due diligence) and then did nothing to address or rectify those gaps (despite knowing about them), that would be a violation of "due care." Due diligence: refers to the investigations and research conducted before taking an action.
Due care: is about taking the necessary steps to mitigate the risks and threats that have been identified through due diligence.
Due diligence need to happen before dual care. In the given scenario, the internal security assessor never did the duel diligence part.

Static Application Security Testing (SAST) is the best method for validating code as it is written.
SAST analyzes the source code or binaries of an application for vulnerabilities before the code is executed, allowing developers to identify and fix security flaws early in the development process.
This method integrates into the development environment and provides real-time feedback, which is critical for ensuring secure coding practices from the start. CASP+ highlights the importance of SAST in secure software development lifecycles (SDLCs) as a proactive measure to prevent security issues before the code is deployed.