During what phase of the SDLC should the organization consider the security requirements?

• A. Initiation Phase/ Development /Acquisition Phase
• B. Operations/Maintenance
• C. Testing
• D. Disposal

Answer: (A)

Identifying security requirements early in the SDLC ensures security is built into the system from the start rather than added on later. In the initial initiation stage, you define the project’s scope and business goals and capture regulatory, privacy, and risk considerations, establishing clear security objectives. As you move into development and acquisition, those requirements shape the design and architecture, guide the selection of controls, and set expectations for vendors and integrations. This early integration makes it possible to implement appropriate authentication, authorization, data protection, and threat models from the outset, reducing the need for costly rework and minimizing security gaps. Waiting until testing, operations, or disposal often means finding and fixing flaws after they've already been built or deployed, which is far more expensive and risky.