Do you have SDLC (Secure Development Lifecycle) in place?

Yes, we are following the waterfall model for SDLC