Which of the following would BEST ensure that security is integrated during application development?

Performing application security testing during acceptance testing occurs too late in the development cycle to effectively integrate security into the core design, primarily identifying issues rather than proactively embedding security.

Introducing security requirements during the initiation or design phase of application development, known as "security by design" or "shifting left," ensures security is a fundamental consideration from the project's inception. This proactive approach integrates security throughout the entire development lifecycle, making it more effective and less costly than retrofitting security later.

While employing global security standards is important, introducing explicit security requirements early in the project lifecycle ensures those standards are specifically tailored and applied to the application's unique context and objectives.

Providing training on secure development practices to programmers is a supportive measure, but without clearly defined security requirements from the outset, developers may not know *what* specific security controls or features to implement for a given application.