ISC Systems Lifecycle Management Practice Question
During a waterfall-to-Agile transition, the development team wants to bypass formal Security Requirements Traceability Matrix (SRTM) documentation in favor of user stories. How should the ISSMP reconcile this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Require all security requirements to be embedded into the definition of done (DoD) and documented as security user stories.
The ISSMP should ensure security requirements are documented as 'Abuse Cases' or 'Security User Stories' within the existing Agile backlog management tool to maintain traceability.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Require all security requirements to be embedded into the definition of done (DoD) and documented as security user stories.
Why this is correct
Integrating security into the DoD and user stories ensures traceability without hindering velocity.
- ✗
Mandate that the project manager create a manual SRTM separately from the development tasks.
Why it's wrong here
Manual processes in an Agile environment are inefficient and often ignored.
- ✗
Deny the transition until full waterfall documentation is restored.
Why it's wrong here
Rigid adherence to waterfall is not feasible in Agile environments; integration is key.
- ✗
Allow the team to omit security requirements to speed up deployment.
Why it's wrong here
Security requirements must never be omitted regardless of the methodology.
About these practice questions
One of 219 original ISC practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official (ISC)² exam blueprint
This ISC practice question is part of Courseiva's free (ISC)² certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the ISC exam.