IT projects have gone over budget with too many security controls being added post-production. Which of the following would MOST help to ensure that…

The core issue is the late, and therefore costly, addition of security controls. The most effective solution is to integrate information security into the entire project management lifecycle. This proactive "Security by Design" or "Shift Left" approach ensures that security requirements are identified, relevant controls are selected, and solutions are architected securely from the project's inception. This prevents the need for expensive and disruptive retrofitting of controls post-production, directly addressing the budget overruns and ensuring controls are relevant to the project's specific context and risks.

B. Identifying responsibilities is a governance activity that defines accountability but does not, by itself, ensure the correct controls are implemented throughout the project.

C. A data classification framework is a critical tool for determining protection levels, but simply providing it does not guarantee its application or integration into the project.

D. Providing minimum security requirements establishes a baseline but may not address project-specific risks, thus failing to ensure all relevant controls are applied.

1. ISACA

CISM Review Manual

15th Edition. Domain 2: Information Risk Management

Section 2.6

"System Development Life Cycle (SDLC)." This section emphasizes that integrating security activities into each phase of the SDLC is more effective and less costly than adding security after development is complete. It advocates for security's involvement from the initiation phase through disposal.

2. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-64 Revision 2

Security Considerations in the System Development Life Cycle. Section 2

"The System Development Life Cycle

" states

"By integrating security requirements into the SDLC

agencies can ensure that their IT systems will meet their mission requirements and will be more secure

less vulnerable to attack

and less costly to maintain."

3. National Institute of Standards and Technology (NIST) Special Publication (SP) 800-160 Volume 1

Systems Security Engineering: Considerations for a Multidisciplinary Approach in the Engineering of Trustworthy Secure Systems. Section 2.2

"Life Cycle Processes and the Role of Systems Security Engineering

" details the principle of incorporating security engineering activities throughout the system life cycle to address security issues early

which is more effective and less costly than trying to add security to a system late in the life cycle.