CISA Practice Question: Information Systems Acquisition, Development, and Implementation
During which phase of the SDLC should security requirements be formally documented and approved by the business owner?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Requirements phase
Security requirements must be identified and approved early to ensure proper controls are built into the system. The requirements phase is the appropriate stage for this.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Design phase
Why it's wrong here
Design translates approved requirements into technical specifications, so documenting security requirements here inverts the sequence: the business owner would be approving controls before knowing what they must satisfy. It tempts because design is where security architecture is decided, which is correct once requirements are already baselined.
- ✓
Requirements phase
Why this is correct
Security requirements must be captured alongside functional requirements so they are baselined and approved before design begins. Documenting them in the requirements phase lets the business owner formally accept them, preventing costly retrofitting of controls during coding or testing.
- ✗
Testing phase
Why it's wrong here
Testing verifies built functionality against already-approved criteria; documenting and obtaining business-owner sign-off here means requirements were never baselined, so defects trace to nothing. It is tempting because testing does surface security gaps, and in iterative models test findings legitimately feed the next increment's requirements.
- ✗
Development phase
Why it's wrong here
The development phase builds against already-approved specifications; documenting security requirements here causes costly rework and weak business sign-off. It is tempting because developers implement controls, but formal documentation and approval belong in the requirements phase, before design begins.
Go deeper
Related to this question
About these practice questions
One of 934 original CISA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISA exam.