SDLC is being used for the commissioning of a new platform. To provide an appropriate level of assurance the security requirements that were specified at the project origin need to be carried…

A requirements workshop is used to elicit and define requirements at the beginning of a project, not to verify that requirements were carried through to implementation.

The Security Development Lifecycle (SDL) is a process framework for embedding security activities into development phases, not a verification artifact for tracing individual requirements.

An SRTM creates a documented mapping between each original security requirement and its corresponding design artifacts, test cases, and implemented controls across all SDLC phases. This bidirectional traceability provides auditable assurance that no requirement was dropped or ignored between project origin and implementation, which is exactly what the question asks for.

Secure code review and penetration testing validate the security quality of the implemented code but do not trace implemented controls back to the original documented security requirements.