During the procurement of a new information system, it was determined that some of the security requirements were not addressed in the system specification. Which of the following is the MOST likely r

The procurement officer's technical knowledge level does not directly cause security requirements to be absent from the system specification, as procurement officers rely on documented requirements provided by stakeholders rather than generating technical security requirements themselves.

While changing requirements can cause misalignment, this is a less likely and less common root cause than insufficient initial documentation, and the question asks for the MOST likely reason.

The vendor's bidding team composition is irrelevant to whether security requirements are captured in the system specification, since vendors respond to requirements they are given rather than defining the buyer's security needs.

If security requirements are insufficiently described - lacking specificity, measurability, or completeness - vendors cannot accurately interpret or implement them in the system specification. This is a fundamental principle in systems engineering and secure acquisition: requirements must be clearly articulated before they can be addressed. Vague or incomplete requirements documentation is the most direct and common reason for gaps between intended security controls and delivered system specifications.