Which of the following is the BEST control to help ensure that security requirements are considered throughout the life cycle of an agile software development project?

By including dedicated security expertise within the agile project team (e.g., a security champion or security architect), security requirements and best practices can be proactively addressed, designed in, and reviewed in every sprint, aligning with the iterative nature of agile development. This continuous integration of security ensures it's not an afterthought.

Reverting to waterfall defeats the purpose of agile development and often pushes security to later stages, contrary to the goal of integrating it throughout the lifecycle.

While documenting requirements is good practice, obtaining internal audit sign-off is a compliance checkpoint rather than a continuous control mechanism embedded within the agile development process itself.

Accreditation is a final approval step before production, but it doesn't ensure security requirements are considered *throughout* the entire development lifecycle, only at the end.