ISC2 CISSP Practice Question

The correct answer is the requirements phase because security requirements should be identified and documented at the earliest possible stage of development. Establishing security requirements during the requirements phase ensures they're treated with the same importance as functional requirements and properly incorporated into subsequent design and implementation decisions.

**The design phase **is too late for initial security requirements definition. While security architecture designs are created during this phase, they should be based on security requirements already established. Delaying security considerations until the design phase can result in architectural decisions that are difficult to secure properly.

**The implementation phase **is significantly too late to begin considering security requirements. By this point, the architecture is established, and major changes to accommodate security needs would be expensive and time-consuming. Security during implementation should focus on following secure coding practices based on previously established requirements.

The testing phase is entirely too late for defining security requirements. At this point, the application is largely built, and discovering that it doesn't meet fundamental security needs would require substantial rework. The testing phase should verify that the implementation meets the security requirements defined much earlier in the lifecycle.