A city permitting portal went live last quarter, yet new dependency CVEs keep appearing. What Domain 8 practice should continue as part of SDLC sustainment?
Select an answer to reveal the explanation.
Short Explanation
Go-live is not the finish line—it's the start of keeping the car on the road. Patching vulns and updating dependencies after launch is normal sustainment, not optional busywork. Civic apps that freeze forever just age into soft targets.
Full Explanation
Secure development does not end at go-live for a municipal permitting portal. Domain 8 treats operations and maintenance as continuing SDLC phases in which vulnerability remediation, dependency updates, configuration hygiene, and monitoring remain mandatory while the application serves residents. New CVEs appear because libraries age, adversaries research, and the public attack surface stays live; sustainment is how the city keeps residual risk within appetite rather than treating launch as a security finish line.
Freezing every library at the go-live versions until the next capital project sounds thrifty but creates a known-vulnerable estate. Attackers preferentially scan civic systems that advertise outdated package banners; deferred patching converts yesterday's approved baseline into today's soft target. Capital-project cadence is far slower than vulnerability disclosure, so freeze policies misalign municipal risk with real threat timelines.
Replacing secure SDLC gates with annual tabletop exercises alone confuses continuity planning theater with engineering control. Tabletops exercise decision-making; they do not scan code, block weak builds, or remediate transitive dependencies. Gates and sustainment tooling operate continuously; annual discussions cannot substitute for them.
Deleting the threat model because production monitoring exists reverses cause and effect. Monitoring detects symptoms; the threat model documents assets, trust boundaries, and abuse cases that drive design and test priorities. Production telemetry complements—not replaces—maintained threat models as features and integrations change.
Exam caveat: CISSP expects recognition that secure SDLC responsibilities persist through maintenance; launch does not transfer all duty to operations monitoring alone. Operational check: confirm patch SLAs, SCA/CVE intake, and ownership for each civic app remain staffed after go-live, and that emergency freezes are time-boxed with documented compensating controls rather than silent permanent freezes.