I have recently taken on the responsibility of developing a set of secure programming guidelines. My intention is to provide, using the OWASP Development Guide as a basis, several levels of requirements that correspond to our Sensitive Information Classification levels.
What kinds of issues should I expect to see as the standards gets developed and what have you found, after the fact, didn't actually work?