The CII Best Practices initiative sets a good set of requirements to qualify. Mission-critical software needs to have a good bus factor, keep its deps up to dat

The CII Best Practices initiative sets a good set of requirements to qualify. Mission-critical software needs to have a good bus factor, keep its deps up to date, have guards in place for the OWASP Top 10 vulns and others (where appropriate), not lean heavily on badness enumeration, etc. We can set requirements for certain types of software to get certified for a level of reliability, taking inspiration from the CII Best Practices. Two ways to qualify for a certification can include testing and formal verification; I won't elaborate on the latter as per your request. Good statement coverage from tests is a necessary but absolutely insufficient requirement for tests; they need good branch coverage, and need to pass a good mutation score threshold. Property-based testing makes this a lot easier. Fuzz-testing is another good follow-up once these get checked off. Software that passes the above checks and more can qualify for manual review, looking for common vulns and warranted practices. Much of what I've brainstormed above applies to complex software; simple/small software is much more manageable and probably doesn't need to be held to such standards.