A city applications team wants to push a new citizen-portal build straight to production tonight. Which policy requirement should stop that deploy until security gates are complete?
Select an answer to reveal the explanation.
Short Explanation
Think of the SDLC security policy as the bridge inspector: no traffic onto the live bridge until the inspection passes. Production is the bridge—security gates have to clear before the new build rolls onto it.
Full Explanation
A software development lifecycle security policy embeds mandatory security activities into how municipal applications move from idea to production. For a citizen-portal release, that policy typically requires threat modeling or secure design review, secure coding standards, code review, testing, and an explicit security gate before production promotion. The gate is what stops a same-night deploy when security review is incomplete: production is treated as a controlled change, not a convenience lane for the applications team. A physical key-control policy for the data-center cage door addresses facility access to hardware. It matters for physical security of servers, but it does not govern application change management, code review, or whether a new portal build is allowed onto the live environment. Cage keys cannot block a bad software release. A visitor badge policy for the public library lobby manages guest identity and access in a public facility. Library visitor controls have no bearing on SDLC gates for citizen-portal software and cannot enforce security review before release. A printer toner inventory policy for the clerk's office is an office-supply control. Inventory of consumables does not define secure development requirements, production promotion criteria, or security sign-off for application builds. Exam caveat: Match the policy type to the risk domain in the stem. When the scenario is about pushing software to production, the relevant governance control is an SDLC security policy with pre-release review—not physical access, visitor, or supply policies that sound security-adjacent but address different assets. Operational check: Verify the SDLC security policy names required gates, who can approve exceptions, and how production pipelines enforce those gates technically so teams cannot bypass review by deploying overnight under time pressure.