Which statement describes a secure Software Development Life Cycle (SDLC)?

• A. It integrates security into every SDLC phase.
• B. It focuses only on testing after deployment.
• C. It excludes security considerations to speed delivery.
• D. It duplicates security in one phase only.

Answer: (A)

Embedding security across all SDLC phases means treating security as an integral, ongoing concern rather than something added at the end. This approach makes security a factor from the initial requirements and threat modeling, through design and secure coding practices, into testing, deployment, and ongoing maintenance. By considering security at every stage, you catch and fix vulnerabilities earlier when they’re cheaper and easier to address, reduce the risk of breaches, and meet compliance and trust expectations.

Relying only on testing after deployment misses many issues that were introduced earlier and may be too late or costly to remediate once a product is live. Excluding security to speed delivery ignores the ongoing risk landscape and can leave systems exposed. Duplicating security in one phase isn’t enough because threats span the entire lifecycle; a single-phase focus leaves other stages vulnerable.