Exam CRISC topic 1 question 823 discussion

Agree with C

C. it's more cost-effective to determine controls in the early design phase. Controls should ideally be defined during the design phase of system development because it is more cost-effective to consider security and control requirements at an early stage rather than trying to retrofit controls into a system after it has been developed. Identifying controls during the design phase allows for a more integrated and efficient approach to security and risk management in the system's architecture and functionality. While technical specifications are indeed defined during the design phase, the primary reason for defining controls at this stage is to ensure that security and risk management are an integral part of the system's design and development process. This proactive approach helps prevent vulnerabilities and issues from arising later in the development lifecycle.

Agree it is C.

Can I confirm which discussion exam topic should i be using as reference if im taking the COBIT 5 Implementation exam

I think the correct answer is C. its more cost-effective to determine controls in the early design phase.