During which phase of the software development life cycle should an IS auditor be consulted to recommend security controls?

The correct answer is B. Requirements definition. Involving an IS auditor early in the software development life cycle (SDLC), specifically during the requirements definition phase, ensures that security controls are incorporated into the design from the beginning. This proactive approach helps ensure that security is built…

Submitted by hans_de· Apr 18, 2026Information Systems Acquisition, Development, and Implementation

Question

Options

AFinal acceptance testing
BRequirements definition
CDesign and development
DImplementation of software

How the community answered

(26 responses)

A
4% (1)
B
92% (24)
C
4% (1)

Explanation

Involving an IS auditor early in the software development life cycle (SDLC), specifically during the requirements definition phase, ensures that security controls are incorporated into the design from the beginning. This proactive approach helps ensure that security is built into the system, reducing the likelihood of costly fixes or vulnerabilities being introduced later in the development Waiting until later phases, such as design, development, or implementation, increases the risk of security gaps being overlooked.

Topics

#SDLC#Security Controls#IS Auditor Role#Requirements Definition

Community Discussion

No community discussion yet for this question.

Full CISA Practice