A company has decided to use the SDLC for the creation and production of a new information system. The security administrator is training all users on how to protect company information while using…

Operations and Maintenance occurs after the system is already live, so training and pre-launch approvals would be too late in this phase.

The Implementation phase of the SDLC is when the system is being deployed and made operational, making it the appropriate time to conduct user security awareness training and obtain formal management authorization before go-live. Security controls such as training users on social engineering and requiring senior management sign-off are hallmarks of the Implementation phase's acceptance and accreditation activities. This phase bridges development and live operation, so all preparatory human and administrative controls are finalized here.

Acquisition and Development focuses on designing, purchasing, and building the system, not on user training or formal management authorization for go-live.

Initiation is the earliest SDLC phase concerned with defining the system's purpose and scope, long before training or approval activities are relevant.