It is MOST important that security controls for a new system be documented in:

Documenting security controls within testing requirements ensures that the functionality and effectiveness of these controls are formally verified and validated throughout the system development lifecycle. This allows for rigorous assessment against established criteria, guaranteeing that the controls operate as intended to protect the system before it goes into production.

The implementation plan outlines how controls will be deployed, but it doesn't specify what needs to be tested or the criteria for successful verification of those controls.

System requirements describe the overall functions and non-functional aspects of the system, including security requirements, but the specific documentation of controls for testing goes beyond general system requirements.

The security policy sets the high-level organizational rules and objectives, but it typically doesn't contain the detailed, testable specifications for individual security controls of a new system.