What attribute is MOST likely to be included in the software development lifecycle (SDLC) process?

The attribute most consistently required in a well-governed Software Development Life-Cycle is the integration of security controls and testing at defined gates (requirements, design, coding, test, release). NIST SP 800-64 rev.2 and ISO/IEC 27034 both state that security requirements and verification activities must be embedded in every SDLC phase to ensure vulnerabilities are discovered and remediated before deployment; other operational disciplines (e.g., physical security or financial viability) are managed elsewhere, not within the SDLC workflow itself.

A – Business-continuity tests are performed post-deployment and are not an intrinsic SDLC activity.

B – Vendor financial viability is part of third-party due-diligence, not a software build process element.

D – Physical access reviews relate to facility security, not to the code-centric SDLC phases.

1. NIST SP 800-64 rev.2, §3.2–3.6 (Security in each SDLC phase).

2. ISO/IEC 27034-1:2011, §7.3 (“integrate application security controls into the SDLC”).

3. Shared Assessments Standardized Information Gathering (SIG) 2023, Domain 4, Control 4.3.1 (secure SDLC checkpoints).