Which of the following phases of a system development life-cycle is most concerned with establishing a good security policy as the foundation for design?

Question

Options

• ADevelopment/acquisition
• BImplementation
• CInitiation
• DMaintenance

• A
  5% (1)
• C
  85% (17)
• D
  10% (2)

Explanation

Initiation is correct because this earliest phase is where the need for a system is identified and high-level requirements - including security requirements and policy foundations - are established before any design or development begins. Getting security policy right at initiation ensures it shapes all subsequent phases rather than being retrofitted later.

• A (Development/acquisition) is wrong because by this phase the security requirements should already be defined; this phase focuses on building or procuring the system to meet established specs.
• B (Implementation) is wrong because implementation is about installing and activating the system - security controls are being applied, not defined, at this stage.
• D (Maintenance) is wrong because maintenance occurs post-deployment and deals with ongoing operations, patches, and updates, not foundational policy creation.

Memory tip: Think "I" for Inception - Initiation is where you start everything, including security. If you build a house, you decide the security requirements before drawing blueprints, not during construction.

No community discussion yet for this question.