From a governance perspective, which of the following functions MUST approve the agreed-upon criteria for a new technology-enabled service before submitting the final high-level design to project stak

From a governance perspective, Information Security *must* approve the criteria for a new technology-enabled service at an early stage to ensure that security requirements are embedded by design and meet organizational policies and regulatory obligations. Neglecting this early approval can lead to costly redesigns, vulnerabilities, or non-compliance later in the development lifecycle. This is part of a "security by design" principle.

The Project Management Office (PMO) ensures adherence to project processes and methodology but is not primarily responsible for approving the *criteria* related to the fundamental security posture of the service itself.

Quality Assurance (QA) focuses on ensuring the service meets its functional and non-functional requirements and quality standards, but its primary role is not the initial approval of *security criteria*.

Internal Audit provides independent assurance over the effectiveness of governance, risk management, and control processes, typically reviewing *after* controls and criteria have been established and implemented, not approving initial criteria.