A CAD replacement project skipped security requirements analysis and plans to "bolt on" controls the week before go-live. What lifecycle guidance should the security architect insist on?
Select an answer to reveal the explanation.
Short Explanation
Bolting locks on after the house is built is expensive and leaky. Security has to ride every stage—from requirements through ops and retirement—not show up as a go-live surprise.
Full Explanation
Secure information-system lifecycle practice requires security activities across requirements, design, implementation, operations, and disposal. For a CAD replacement, the security architect must insist that controls and assurance tasks are integrated at each stage rather than bolted on the week before go-live. Early requirements drive architecture (authentication, segmentation, logging, data protection); late add-ons miss dependencies, break schedules, and leave acceptance criteria unmet.
Confining security to disposal documentation after retirement ignores the operational life of the system. Waiting for the first production breach to discover requirements is reactive and harmful to public safety systems. Limiting security to a login-page logo without lifecycle checkpoints provides branding without control.
Exam caveat: CISSP treats security as a lifecycle property of systems engineering—shift-left requirements and continuous attention through operations and retirement, not a go-live surprise.
Operational check: gate CAD project phases on security requirements sign-off, threat modeling, secure design review, implementation testing, operational runbooks, and disposal plans; refuse go-live without evidence of those checkpoints; track residual risks with named owners.