When in the Software Development Life Cycle (SDLC) MUST software security functional requirements be defined?

Defining security requirements after the preliminary design has already been developed is too late in the process, as design decisions may have already been made that conflict with or fail to accommodate necessary security controls.

Vulnerability analysis is a later-phase activity that occurs after requirements and design are established; basing security requirements on vulnerability analysis reverses the proper SDLC order and omits the critical business functional analysis input.

Defining security requirements after the preliminary design but before data security categorization is incorrect because the design phase should not begin until both business analysis and data categorization are complete, making this sequence out of order.

Security functional requirements can only be properly defined once the business functional analysis is complete (so the system's purpose and functions are understood) and the data security categorization has been performed (so the sensitivity and protection needs of the data are known). These two inputs together provide the foundation for determining what security controls and requirements are necessary before any system design work begins, following frameworks like NIST SP 800-64.