CompTIA Security+ SY0-701 Practice Question

Security risk assessments should be performed during the requirements gathering phase of the Software Development Lifecycle. This allows the development team to identify potential security requirements early on and integrate necessary security controls in the design of the software, rather than retrofitting them at a later stage, which is often less effective and more costly. Integrating security in the early stages, known as 'shifting left', is considered a best practice for developing secure software. The other options are stages where security assurances can continue to be applied and validated, but the initial risk assessment's integration point is fundamental during requirements gathering.