The risk committee has endorsed the adoption of a security system development life cycle (SSDLC) designed to ensure compliance with PCI-DSS, HIPAA, and meet the organization's mission. Which of the…

Placing 'assessment/acquisition' before 'development/implementation' inverts the correct NIST SSDLC order, as acquisition and development must occur before implementation and assessment can be conducted.

NIST SP 800-64 defines the security-focused system development life cycle with phases ordered as Initiation, Development/Acquisition, Implementation/Assessment, Operations/Maintenance, and Disposal - answer B correctly places Initiation first and follows the logical progression from planning through development, security testing, and sustained operations, which aligns with the standard NIST model.

Beginning with 'Assessment' before 'Initiation' is incorrect because a meaningful security or risk assessment cannot be performed before the system concept, scope, and objectives have been formally defined in the initiation phase.

Starting with 'Acquisition' before 'Initiation' skips the planning and scoping phase that must precede any procurement or development activity in the NIST SSDLC framework.