An organization's architecture review board approves all new solution designs, but its review criteria cover only cost, performance and interoperability. Several approved designs later required expensive security rework. Which action would BEST address the underlying problem?
Select an answer to reveal the explanation.
Short Explanation
Fixing security after the walls are up is like rewiring a house after the drywall's done: possible, but you'll pay for it. The cheap moment is the blueprint review, so put security criteria in the standards the board already uses. Watch out for answers that test or budget around the problem instead of designing it out.
Full Explanation
The root cause here is that security is absent from the point where design decisions are made. Architecture review boards exist to make sure designs comply with enterprise standards and principles; if those standards contain security principles such as least privilege, segmentation, secure defaults and data protection requirements, every design is evaluated against them before money is spent on building. That makes security part of the architecture rather than a later correction, which is far cheaper. Adding a penetration test before go-live still discovers problems after the build, so the rework remains, only slightly earlier. Assessing solutions once they are in production is later still and turns design flaws into live exposures. Raising contingency budgets accepts the waste as normal and treats the cost symptom rather than the governance gap. Exam caveat: the information security manager does not need to chair the board; the requirement is that security criteria are embedded and that security has a voice in the review. Operational check: review the board's published standards and approval checklist, confirm security principles are listed as mandatory criteria, and sample recent approvals to verify they were evaluated.