A company is moving from the V model to Agile development. How can the information security department BEST ensure that secure design principles are implemented in the new methodology?

Security training improves developer awareness but does not directly ensure that secure design principles are systematically implemented or verified within the Agile development workflow itself.

Mandating non-financial security requirements does not integrate security into the Agile process mechanics; it merely carries over a policy constraint without providing a methodology-native mechanism for tracking or implementing secure design within sprints.

Performing security assessments after each sprint is a reactive, detective control that identifies issues post-development, whereas the question asks for the best way to ensure secure design principles are implemented proactively during development.

In Agile methodology, user stories are the primary mechanism for capturing and tracking requirements within sprints and backlogs. By encoding information security requirements as mandatory user stories, security becomes an integral, trackable, and actionable part of each iteration rather than an afterthought, directly aligning with the 'shift-left' security principle and ensuring secure design is built in from the start of each development cycle.