A healthcare provider is specifying a new cloud application. Its regulatory obligations require that every access to patient records be logged, recording who accessed which record and when. How should this obligation be handled in the SDLC?
Select an answer to reveal the explanation.
Short Explanation
A regulation saying 'log every access' is a requirement waiting to be written down. You turn it into a security requirement during requirements, so design builds it and testing proves it. Hoping the platform's logs or the provider's certificate covers it is the trap; they can't see who opened which patient record inside your app.
Full Explanation
Regulatory and legal obligations are a primary source of security requirements in the secure SDLC. An obligation to record every access to patient records is translated during requirements into a documented, testable non-functional requirement: which events are logged, which fields each entry carries, such as user identity, record identifier, action and timestamp, how logs are protected from tampering, and how long they are retained. Design then places the logging in the application where record access actually happens, and testing verifies it. Platform logging configured after deployment captures infrastructure and management events, but the provider's logs cannot see which patient record a user opened inside the application, so application-level audit events must be designed in. Leaving the decision to users after go-live turns a legal obligation into an optional preference. A provider's compliance attestation covers the provider's controls for its own scope; it does not make a customer's application compliant, because the customer owns its application and data responsibilities. Exam caveat: non-functional requirements describe qualities such as security, auditability and performance rather than features, and regulators judge the outcome, not the intention. Operational check: confirm each regulatory requirement maps to a requirement identifier, a design element and a passing test that generates the expected audit record.