In which of the following system life cycle processes should security requirements be developed?

Risk management is an ongoing process used to identify, assess, and mitigate risks, but it is not the SDLC phase where security requirements are formally developed and documented.

Business analysis focuses on understanding organizational needs and defining business objectives, not on the technical specification of security requirements for a system.

Information management deals with the governance, storage, and handling of data assets and is not an SDLC phase dedicated to eliciting or developing system security requirements.

System analysis is the phase of the system development life cycle (SDLC) where stakeholder needs are translated into detailed system requirements, including security requirements such as access controls, data protection, and compliance mandates. Identifying security requirements at this stage ensures they are built into the system design from the ground up rather than retrofitted later, following the 'secure by design' principle.