An organization is implementing security review as part of system development. Which of the following is the BEST technique to follow?

Engaging a third-party auditing firm is a point-in-time activity typically used for compliance validation, not a continuous technique integrated throughout system development.

Reviewing security architecture is only one phase-specific activity focused on design, not a comprehensive technique that spans the entire development lifecycle.

Performing incremental assessments means security is evaluated at each stage of development (requirements, design, coding, testing, deployment), which is the foundational principle of a Secure SDLC (S-SDLC). This approach reduces remediation costs by identifying vulnerabilities early and ensures security is built in rather than bolted on, aligning with frameworks like NIST SP 800-64 and OWASP SAMM.

Penetration testing is a late-stage assessment technique performed after a system is built, making it reactive rather than proactive when integrated into the development process.