A city applications team wants to push a new citizen-portal build straight to production tonight. Which policy requirement should stop that deploy until security gates are complete?
Select an answer to reveal the explanation.
Short Explanation
Think of the SDLC security policy as the bridge inspector: no traffic onto the live bridge until the inspection passes. Production is the bridge—security gates have to clear before the new build rolls onto it.
Full Explanation
An SDLC security policy embeds mandatory security activities—threat modeling, secure coding standards, code review, and testing—into the path to production. Requiring those gates before release is how governance prevents unsafe builds from becoming operational risk. Unrelated facilities or inventory policies do not govern application release criteria.