The asset owner shall have policies and procedures related to identifying and authenticating software services prior to their execution.