Which statement best describes the development life cycle relation to risk assessment?

• A. Risk assessment is covered in all parts of the development life cycle.
• B. Risk assessment is performed only during deployment.
• C. Risk assessment is irrelevant to the development process.
• D. Risk assessment is done only after system retirement.

Answer: (A)

Risk assessment should be integrated across the entire development life cycle, applied continuously from initial concept through design, implementation, testing, deployment, operation, maintenance, and even retirement. This ongoing approach lets you identify threats, vulnerabilities, and potential impacts early, choose appropriate controls, and adjust the risk posture as the project evolves. Relying on risk assessment only during deployment misses architectural flaws you could fix earlier, and treating risk as irrelevant or something to do after retirement would leave the system exposed and expensive to secure later. By weaving risk assessment into every phase, you create a secure by design process and maintain an up-to-date understanding of residual risk throughout the system’s life.