Application security controls should FIRST be addressed during which stage of the software development life cycle?

The correct answer is C. Requirements gathering. Application security controls should be addressed first during the requirements gathering stage of the software development life cycle (SDLC). This ensures that security is integrated from the beginning, allowing for the identification of security requirements, compliance…

Submitted by the_admin· Apr 18, 2026Information Security Program Development and Management

Question

Options

ACode review
BSoftware design
CRequirements gathering
DSoftware code development

How the community answered

(30 responses)

A
3% (1)
B
3% (1)
C
87% (26)
D
7% (2)

Explanation

Application security controls should be addressed first during the requirements gathering stage of the software development life cycle (SDLC). This ensures that security is integrated from the beginning, allowing for the identification of security requirements, compliance needs, and risk considerations before design and development begin. Addressing security early helps reduce vulnerabilities and costly fixes later in the development process. While design, coding, and reviews are important, security should be a foundational requirement from the start.

Topics

#Secure SDLC#Application Security#Security by Design#Requirements Gathering

Community Discussion

No community discussion yet for this question.

Full CISM Practice