Exam CRISC topic 1 question 654 discussion

C. Identify information security controls in the requirements analysis. The best way to ensure that information security risk factors are mitigated when developing in-house applications is to identify information security controls during the requirements analysis phase. This means integrating security considerations into the early stages of the application development process. By doing so, you can define security requirements, identify potential risks, and specify controls that need to be implemented to mitigate those risks.

Agree with C.

Without a doubt: Tasks that determine the needs or conditions to meet a new or altered solution, accounting for multiple perspectives, e.g., balancing stakeholder needs and constraints, allocation of requirements to components, breaking down complex requirements to lower level requirements (CMMI).

A: is my choice. Include information security control specifications in the business case. Specifications are used in the development of applications. C: Identify information security controls in the requirements analysis is identifying something in the requirements analysis. Requirements have to finalized and approved to become specifications.