Before accepting a vendor-built citizen portal, the city must confirm security requirements were actually met. Which lifecycle activity does that describe?
Select an answer to reveal the explanation.
Short Explanation
Do not take the vendor's word that the locks work—check. Verification and validation are the "show me" steps before you accept the portal. Skipping them is buying a mystery box.
Full Explanation
Before accepting a vendor-built citizen portal, the city must perform verification and validation that security requirements were implemented and that the system meets stakeholder security needs. Verification checks build-against-spec (controls present and configured as required); validation checks fitness for purpose (the portal actually protects citizen data and municipal processes under realistic use). V&V prior to acceptance is the lifecycle gate that prevents undocumented residual gaps from becoming production debt.
Asset depreciation accounting tracks finance, not control effectiveness. Marketing copy approval without technical checks accepts claims instead of evidence. Immediate production cutover with no acceptance testing skips the assurance gate entirely.
Exam caveat: CISSP IS lifecycle language distinguishes V&V and acceptance from mere delivery; security requirements deserve the same gates as functional requirements.
Operational check: map each security requirement to test cases; execute configuration reviews, vulnerability tests, and access-control exercises; record defects; require remediation or formal risk acceptance before sign-off; retain V&V evidence for auditors and future change baselines.