The organization is moving from a waterfall to an agile software development methodology, so the software security group must adapt the security…

Identifying primary security and privacy contacts is a foundational activity performed once at the beginning of a project. This task establishes the key stakeholders and communication channels for all subsequent security-related matters. In an Agile adaptation of a secure development life cycle, such setup activities that occur at project inception are categorized as "one-time requirements." They are essential prerequisites that are completed before the iterative sprint cycles begin and are not repeated, unlike activities such as threat modeling new features (every-sprint) or conducting a final penetration test (final security review).

A. Final security review requirement: This is an end-of-cycle activity for final validation before release, not a project initiation task.

B. Bucket requirement: These are typically non-urgent tasks addressed when time permits, whereas identifying key contacts is a critical, upfront necessity.

C. Every-sprint requirement: This is a recurring activity performed in each sprint; identifying contacts is a task that is only performed once.

---

1. Microsoft Security Development Lifecycle (SDL) for Agile Development. Microsoft's official documentation categorizes SDL practices for Agile methodologies. It explicitly lists "One-Time SDL Practices" that are performed once per project. These include foundational tasks like "Appoint Security Advisor" and "Identify Security Champions," which are analogous to identifying primary security and privacy contacts.

Source: Microsoft, "SDL for Agile Development," Security Development Lifecycle documentation. See the section titled "One-Time SDL Practices."

2. OWASP Software Assurance Maturity Model (SAMM) v2. The SAMM framework, while methodology-agnostic, provides a model for integrating security. The "Governance" business function includes the "Strategy & Metrics" (G-SM) practice stream. Activity G-SM-1 involves identifying and assigning roles and responsibilities for security. In an Agile context, this governance activity is established at the project's outset as a foundational, one-time action.

Source: OWASP Foundation, "OWASP SAMM v2," Governance > Strategy & Metrics (G-SM), p. 20.

3. Software Engineering Institute (SEI), Carnegie Mellon University. Publications from the SEI on integrating security into development life cycles emphasize establishing a security foundation at the beginning of a project. This includes defining security roles, responsibilities, and points of contact before iterative development begins. This aligns with the concept of a "one-time requirement."

Source: Allen, J. H., et al. (2008). Software Security Engineering: A Guide for Project Managers. Addison-Wesley Professional. Chapter 10, "Integrating Security into the Life Cycle," discusses the importance of initial security planning and role definition.