b48f56c1__Application_Firewalls___OWASP__Comment
[Criterion] Low complexity Fewer than 1000 hours have been spent purely on implementing the application (not including project management) in the development phase. [Points] 1 [Comment] 
Based on experience, complexity is best measured using the time spent on implementing the application. Lines of code or function points provide very different results, depending on who is doing the counting. Ideally, it would be better to consider the complexity of the architecture, not the time spent on implementation.
Category:OWASP Best Practices: Use of Web Application Firewalls - OWASP