A digital health startup named NovaLine is designing a new platform and wants to manage security risks through every phase of the software development lifecycle. Which practice should be incorporated

Conducting a risk assessment only after project completion is a reactive approach, missing opportunities to mitigate risks early and incurring higher remediation costs.

Integrating security requirements during the architecture and design phase ensures that security is built into the system from the ground up, making it more cost-effective and structurally sound than attempting to bolt it on later and addressing risks proactively.

Cloud Security Command Center is a specific Google Cloud product for security management, not a general practice to incorporate early and continuously across the SDLC.

Providing security training only after coding is finished means developers might have introduced vulnerabilities throughout the coding process due to lack of awareness, making it less effective.

Limiting security testing to the deployment stage is a reactive and insufficient approach, as critical vulnerabilities can be introduced and missed in earlier phases, leading to expensive fixes or breaches.