Free CISM Exam Dumps Preview

Because the attack is successful and still in progress, the immediate priority is containment. Isolating the affected network segment restricts attacker movement and further damage while allowing unaffected operations to continue. Impact assessment and root-cause reporting follow containment, while shutting down the entire network would be unnecessarily disruptive.

Continuous monitoring determines whether security controls continue to operate as designed and achieve their intended results as systems and threats change. This ongoing evidence reveals degradation or failure that requires correction. Minimizing gaps, supporting availability, and meeting compliance obligations may result, but the primary focus is control effectiveness.

An incident response plan depends on assumptions about people, communications, resources, authority, and response conditions. Testing is most valuable when it verifies that these assumptions remain valid and exposes dependencies that fail under realistic conditions. Thoroughness can then be improved from the results, while recovery order and the business impact analysis belong primarily to continuity activities.

Business process owners understand the objectives, priorities, dependencies, and risk concerns of the operations they manage. Engaging them reveals whether security activities support those business needs and whether protection priorities match the strategy. Performance indicators can measure chosen activities, but owners provide the direct business perspective needed to judge alignment.

Residual risk represents the exposure that remains after existing controls and treatment measures are considered. Senior management needs this information to decide whether remaining risk is within tolerance or requires further action. A threat profile and mitigation actions are useful components, but neither alone communicates the organization's current remaining exposure.

Internal stakeholders responsible for security, operations, ownership, and management need prompt notification so the organization can coordinate assessment and response. They can establish scope, activate procedures, preserve information, and determine further reporting obligations. Regulators, the board, or law enforcement may be contacted later when the incident's impact and applicable requirements support escalation.

Isolation and forensic work have already preserved the affected environment and gathered investigative information. The next recovery step is to rebuild the server from trusted original media and apply relevant patches, producing a known baseline while addressing applicable weaknesses. A backup could contain compromised or vulnerable components, and quarantine or shutdown repeats containment actions already completed.

Security policies express management's direction and expectations for protecting information and guide decisions across the organization. Their primary function is communication at a governing level, not prescribing the detailed steps used to perform individual tasks. Procedures describe execution, while standards and supporting controls translate policy expectations into more specific boundaries and practices.

Identified business drivers connect information security governance to the outcomes executives are responsible for, such as supporting operations, managing risk, and meeting obligations. This connection demonstrates why executive commitment is necessary. Frameworks, improvement models, and security strategies are more persuasive after their business purpose is established.

Before implementing a SIEM, the organization must identify the controls to be monitored and the security objectives that monitoring should support. That scope determines which events are relevant and what monitoring outcomes are needed. Reporting features, vendor terms, and support matter operationally, but they cannot establish what the implementation is intended to monitor.

A key risk indicator is useful only when its movement can be interpreted as a change in a particular risk. Linking KRIs to specific risks is difficult because the relationship must be meaningful enough to support decisions and escalation. Limiting, aggregating, or reporting indicators becomes useful only after each indicator has a clear risk connection.

A lost personal device containing corporate information creates a potential security incident requiring coordinated action. Initiating incident response first activates the established process for assessment, containment, communication, and documentation. Specific actions such as disabling access or resetting the device should follow that process according to the device's exposure and available controls.

A breach at a vendor does not by itself establish what organizational data, systems, or obligations are affected. The security manager should first assess the impact to determine scope, severity, and potential consequences for the healthcare organization. Those findings provide the basis for accurate management escalation, contractual action, and any required regulatory notification.

A server certificate binds the e-commerce server's identity to the cryptographic credentials used for secure communication. Verifying that certificate, including the identity it represents and its validity, confirms that the client is communicating with Organization A rather than merely using an encrypted connection. A URL, IP address, or browser SSL indication alone does not authenticate the organization.

Security information and event management centralizes event and log information received from multiple systems. By correlating and normalizing those records, a SIEM supports consistent categorization and handling of incidents across the organization. Detection or prevention tools alone do not provide the same enterprise-wide aggregation function.

A governance framework must fit the organization it will govern. Understanding the business and cultural attributes first reveals objectives, decision structures, risk attitudes, and practical expectations that the framework must support. Tools, skills, external reviews, and cost analysis are meaningful only after that organizational context is established.

A cost-benefit analysis compares the investment and operating costs of the technical control with the value of its expected risk reduction and business benefits. This gives management a financial and operational basis for approval. A risk assessment establishes need, but it does not alone demonstrate that the proposed investment is worthwhile.

Organizational risk appetite defines the amount and type of risk the enterprise is prepared to accept while pursuing its objectives. Comparing proposed security projects against that boundary enables consistent prioritization of initiatives that address unacceptable exposure. Individual incidents, privacy obligations, or ROI figures provide narrower inputs.

Incident categories provide a consistent basis for assessing what is affected and how serious the event is. That assessment establishes risk severity and incident priority, which then drive resource allocation, communication, containment, and response decisions. Those later actions depend on first determining the incident's relative significance and urgency.

Security metrics give senior management visibility into whether security objectives, accountability, and risk oversight operate within the organization's governance structure. Monitoring them therefore helps keep information security aligned with corporate governance. Budget alignment, IT coordination, and mitigation progress are narrower concerns that may be represented by particular measures.

Incident response with a cloud provider requires coordinated action across organizational boundaries. Defined escalation processes establish when and how an incident is raised, who must be involved, and where decision authority resides, enabling timely joint response. Technical capability and audit information are useful inputs, but they do not ensure that the correct parties act when an incident occurs.

A security information and event management system collects and correlates event information to identify suspicious activity and generate alerts. That function discovers conditions that may indicate an incident, making the system a detective control. It does not primarily prevent the activity or correct the underlying condition after detection.

Embedding security governance in corporate governance places information security within management's established authority, oversight, and decision-making structure. This creates management accountability for security objectives and risk decisions. Awareness, resilience, and security-by-design can improve as outcomes, but accountability is the broad governance benefit that enables them.

IoT architecture diversity creates a broad and inconsistent protection problem because devices can differ in design, interfaces, capabilities, and operating environments. A uniform control approach may therefore be difficult to apply across the population. Vendor reputation, training, and policies can influence security management, but they do not remove the underlying architectural variation.

Incident notification effectiveness depends on how quickly information moves from detection through reporting to the start of response. Measuring elapsed time across those points reveals delays in recognition, communication, or activation of responders. Downtime cost and incident counts measure other outcomes, while time to resolution extends beyond the notification process.

Emerging technology introduces new opportunities and risks that must be evaluated against business objectives and risk appetite. Effective risk governance supplies decision authority, accountability, and consistent criteria for accepting, treating, or avoiding those risks. This enables adoption decisions while keeping technology use aligned with the organization's risk direction.

Because the outsourced process will expose critical business information to a third party, its security requirements must be defined during the request-for-proposal. This allows candidate providers to be evaluated against the protections the process needs and enables those obligations to be included in the agreement. Metrics and reporting methods can follow from those requirements.

The risk owner is accountable for the business exposure and has the authority to select among treatment options such as reducing, transferring, avoiding, or accepting the risk. Approval belongs with that owner because treatment affects business objectives and residual risk. Security and risk specialists analyze and recommend options but do not replace ownership.

A security information and event management system centralizes events and logs from multiple systems and correlates them across time and sources. This gives the incident response team a unified view of user activity, relationships, and abnormal patterns that may indicate an insider threat. Single-purpose network or access tools provide narrower visibility and less cross-system context.

Data classification rules identify which information is confidential and prescribe handling requirements appropriate to that sensitivity. Applying those rules helps personnel and systems consistently store, transmit, label, and dispose of information in ways that prevent inadvertent disclosure. A removable-media restriction addresses only one disclosure channel.

Consolidating security operations gives a global organization a unified view of events and patterns across locations. That enhanced visibility helps analysts recognize coordinated or distributed threats that separate teams might see only as isolated activity. Cost savings may occur, but the strongest security reason is the improved ability to understand enterprise-wide threats and coordinate action against them.

Appropriate performance metrics connect the intrusion prevention system's operation to measurable security value over time. Presenting trends in effectiveness and relevant outcomes gives management a repeatable basis for deciding whether annual maintenance remains justified. Market ranking, competitive pricing, or a single penetration test does not demonstrate the system's continuing contribution as directly.

Approval establishes the policy requirement, but administrators must receive and understand it before compliance can reasonably be expected. The first action is therefore to ensure the policy has been communicated to the system administrators responsible for changing the default usernames. A compliance assessment is meaningful after the requirement has been conveyed and implementation can occur.

An unknown malware infection is an active security incident, so the incident response plan must be invoked first to coordinate identification, containment, eradication, and communication. Continuity or disaster recovery may become necessary if business services cannot continue or must be restored, but those decisions follow the initial incident assessment and response.

Before planning compliance work, the information security manager must validate whether the new regulation applies to the organization, its locations, activities, or information. Applicability establishes whether a compliance obligation exists and defines its scope. Escalation, legal interpretation, and monitoring industry reaction follow from that initial determination.

Major changes in the business operating environment can alter critical processes, dependencies, facilities, resources, and recovery priorities. Because a continuity plan is built around these conditions, its strategies and assumptions must be updated when they change materially. Successful tests may confirm the existing plan, while risk trends or leadership changes do not necessarily alter continuity requirements.

A gap analysis compares the organization's current security capabilities with its desired state. The resulting differences identify where controls, governance, resources, or processes need improvement, giving strategy development a clear basis for prioritizing effort. A vulnerability assessment is narrower, while project plans are created after priorities have been established.

An information security steering committee brings together business and security perspectives for governance decisions. Because it represents organizational priorities across functions, it can provide the most relevant input for aligning security strategy with business goals. An individual officer offers expertise, but not the same breadth of enterprise representation.

The criticality of a vendor's service indicates the business impact if that service is disrupted, compromised, or unavailable. It therefore provides a consistent basis for assigning vendor risk levels and directing greater oversight toward relationships with greater organizational consequences. A breach history or individual compensating control describes only part of the overall exposure.

A recognized framework creates value only when its scope and requirements fit the organization's objectives, risks, operations, and obligations. Applicability to organizational needs is therefore the first consideration when choosing one. Ease, measurement capability, and cost-benefit matter after confirming that the framework addresses the environment it is expected to govern.

The revision must first be reviewed for applicability to the business so the organization can identify relevant changes, gaps, obligations, and effects on certification. That analysis supplies the basis for estimating cost, modifying policies, and communicating required action to leadership. Acting before understanding applicability could produce incomplete or unnecessary changes.

The applications cannot enforce the new password standards, but the significance of that gap has not yet been established. Determining the potential impact first clarifies affected assets, exposure, and business consequences. That information is needed before deciding whether to revise the standard, implement compensating controls, or replace applications.

Appropriate service level agreements define the cloud provider's expected monitoring and response performance in measurable terms. They create a shared basis for evaluating whether events are detected and handled within required timeframes. Technical support availability alone does not establish response obligations, and a right to audit assesses compliance rather than setting ongoing service expectations.

Concern about data exposure must first be translated into an evaluated business risk. A risk assessment identifies relevant use, exposure, likelihood, and impact, enabling appropriate recommendations for senior management. Training or blocking access selects a treatment before the risk is evaluated, while a business impact analysis focuses on disruption rather than exposure risk.

Preparation must establish how information will move among responders, management, affected parties, and other stakeholders before an incident occurs. A communication plan defines contacts, responsibilities, and communication paths so coordination can begin promptly. Detailed response and forensic procedures are used during later incident-handling activities.

Key performance indicators translate compliance activity into measurable results that can be compared with targets and tracked over time. This gives senior management a concise view of current performance, trends, and areas requiring attention. Risk assessments and impact analyses address exposure or consequence, while benchmarks provide comparison rather than direct status against the organization's compliance goals.

A security investment is justified by the risk treatment it was intended to produce. The post-implementation review should therefore determine whether the anticipated risk reduction was actually delivered. Financial benefits, internal requirements, and industry standards may matter, but they do not establish whether the security objective of the investment was achieved.

Conducting a walk-through makes participants trace the disaster recovery plan's actions, roles, dependencies, and decision points before a real disruption. This can expose unclear instructions or impractical assumptions that would prevent successful execution. Merely updating, communicating, or reviewing one procedure does not validate how the complete plan will operate.

The review identified delayed decision-making about shutdown, so management should improve the incident response criteria that guide that decision. Clear thresholds based on incident conditions and impact allow stakeholders to determine promptly when shutdown is warranted. Testing can reveal delays, but it does not resolve ambiguous decision rules; containment procedures address execution after the decision is made.

Regular performance reports show executive management whether the information security program is meeting objectives, reducing risk, and using resources effectively. Trends and measurable results support continued oversight and investment. A steering committee provides governance, but evidence of program effectiveness is what most directly helps retain executive support over time.

Role-based access control assigns permissions to defined job roles and then associates users with the appropriate roles. Administrators can manage common access at the role level instead of repeatedly maintaining separate permissions for each user and resource. This reduces effort during onboarding, job changes, and departures while keeping access tied to job responsibilities.

Containment is intended to limit an active incident's reach and immediate damage. Isolating affected systems interrupts their connection to unaffected resources and helps prevent further spread while investigation continues. Removing every instance belongs to eradication, and final root-cause analysis or long-term vulnerability mitigation follows the urgent containment action.

A policy exception deliberately permits operation outside a required security rule, creating or retaining risk. It is acceptable only when that exposure reflects the organizational risk appetite. Approval and periodic review support governance of the exception, but neither makes an exception appropriate if its residual risk exceeds what the organization is willing to accept.

The emergency patch addresses an active exposure, but deploying it without testing could disrupt the critical systems it is intended to protect. The primary concern is therefore the ability to test the patch before deployment, balancing urgent remediation with the need to avoid introducing operational failure.

Containerization separates corporate applications and data from the employee's personal environment on the same device. This boundary allows corporate information to be managed and protected without relying on the security of the entire unsecured device. Policies and certification provide governance, while containerization directly isolates the data at issue.

The head of the call center owns the business process that depends on the application and is therefore accountable for the risk that IT failures pose to call center objectives. This owner can evaluate operational impact and decide on treatment priorities. IT and security leaders provide technical management and advice, but the affected business owner retains the risk.

Regular steering committee meetings demonstrate active governance because responsible leaders repeatedly review security direction, risks, priorities, and performance and make decisions across the organization. The existence of policies or completion of operational activities shows particular controls are present, but not that ongoing governance oversight is functioning.

A global policy should establish baseline standards that apply consistently to all locations, then add supplemental standards where local laws or regulations impose different or stronger requirements. This preserves an organization-wide minimum while accommodating regional obligations. A single corporate or industry standard alone cannot address every jurisdictional variation.

A post-incident review converts experience from an incident into stronger future protection. By examining what happened, how controls performed, and where response or prevention failed, the organization can identify specific control improvements. Root-cause identification supports this analysis, but the primary objective is to apply the findings to improve controls.

An information security steering committee creates a formal connection between security leadership and enterprise decision-makers. Through shared oversight, priorities, resources, risk decisions, and strategic direction can be integrated with broader governance. A documented framework or policy describes structure, while the committee actively embeds security governance into enterprise decisions.

End users understand the detailed activities, dependencies, timing needs, and practical constraints of the business processes they perform. Their participation helps continuity plans reflect specific business needs and workable recovery arrangements. An enterprise-wide view and balancing technical risk are broader management responsibilities, not the users' primary advantage.

A significant risk affecting a core business function requires a treatment decision that balances business impact, available resources, and accepted exposure. Senior management has the authority and accountability to make that decision when effective remediation cannot be funded. Custodians and security personnel can advise or implement controls, but they do not accept major business risk.

Senior management has primary governance accountability for ensuring the organization complies with applicable regulations. Management establishes direction, assigns responsibility, provides resources, and oversees corrective action. Legal counsel interprets obligations, enterprise risk management evaluates exposure, and control owners operate controls, but these roles support rather than replace executive accountability.

The process manager understands how the business process operates, which resources and dependencies it requires, and what interruption would mean for its outputs and stakeholders. That operational knowledge places this role in the best position to evaluate business impact. Security and IT managers can supply technical input, but they do not own the full business-process perspective.

Information security architecture provides a structured blueprint that translates security requirements into consistent designs and control patterns across systems. This reduces fragmented implementation and supports integration as the environment evolves. Deployment speed and cost may improve, but consistent implementation of requirements is the principal reason for the architecture.

Aligning policies to the most stringent global regulations establishes a consistent baseline capable of satisfying the strongest applicable data security obligations across locations. This reduces the risk that a weaker organizational rule leaves a regulated operation noncompliant. Executive approval and stakeholder review support governance, but neither independently establishes substantive regulatory alignment.

Significant risks identified through an assessment must be formally recorded so they can be assigned, evaluated, treated, accepted, and tracked through closure. Entering them in the organization's risk register creates that authoritative record and supports consistent oversight beyond a one-time report to a particular function.

Anonymization reduces leakage risk by removing or transforming identifying information so the research data cannot be tied to particular customers. It addresses both customer names and the link between identity and purchase history while retaining data for analysis. Encrypting only names would leave the data's identifying relationships insufficiently addressed.

A risk with both immaterial impact and very low likelihood has minimal significance to the organization. Accepting it avoids spending resources on treatment that would be disproportionate to the expected exposure. Mitigation, avoidance, and transfer are more suitable when reducing the likelihood or impact justifies their cost and operational consequences.

The exposure concern arises as identities, roles, systems, and entitlements from the two companies are combined. Reviewing access rights throughout the acquisition integration allows conflicts and excessive privileges to be identified at the points when they are introduced and corrected before they persist. This continuing review addresses the changing access environment created by the integration.

Email leakage commonly depends on users making poor decisions about recipients, content, attachments, or handling of private information. Awareness training addresses these behaviors by teaching personnel how to recognize sensitive data and use email safely. Phishing exercises target a narrower threat, while signature verification addresses message authenticity rather than disclosure by a sender.

A significant application code change can alter vulnerabilities, control effectiveness, data exposure, and business impact. Updating the risk assessment determines whether the previous risk conclusions and treatments remain valid before relying on the changed application. User acceptance testing addresses business functionality and does not replace reassessment of security risk.

Security must support what the HR processes are intended to accomplish. Assessing their business objectives first establishes the required outcomes, information flows, and priorities against which security requirements can be designed. Benchmarking, investment analysis, and awareness activities become meaningful only after the organization understands the processes they are meant to support.

Adequate funding demonstrates that senior management is continually committing organizational resources to the information security program. That commitment enables planned controls, staffing, and strategic initiatives to be sustained. Incident response, metrics, and awareness programs are useful program components, but their existence alone does not demonstrate ongoing executive support as directly.

When disaster recovery is outsourced, the service level agreement must define how quickly the provider is required to restore the service. Recovery time objectives establish this maximum restoration interval and connect provider performance to the organization's continuity needs. Recovery point objectives concern tolerable data loss, but the outsourced recovery function's central service commitment is timely restoration.

A gap analysis compares the existing information security program with the new regulatory requirements. It identifies which obligations are already satisfied, which controls or processes are deficient, and where remediation is needed. This assessment must precede implementation planning because the organization first needs a defined difference between its current and required states.

The immediate deficiency is that responders took actions without the required approval. Training the incident response team on escalation procedures teaches when authority must be elevated, whom to contact, and when action must pause for a decision. Monitoring would detect behavior after it occurs, while changing roles is unnecessary unless the defined authority itself is unclear or unsuitable.

The control owner needs authority and accountability for the control's operation, maintenance, resources, and performance. Because the email filter is an operational technology control within the email environment, the head of the IT department is best positioned to manage it and ensure it functions as intended. Information security can define requirements and oversee risk without operating the control.

An information security steering committee brings business and security leadership into a common governance forum. It can connect security priorities, investments, and risk decisions to organizational strategy and resolve competing business needs. More assessments, training, or budget may improve individual activities but do not create this governance alignment.

Before training, policies, or controls are designed for emerging technologies, the organization must understand the potential security risk created by their use. Risk assessment identifies relevant exposure and business impact, providing a basis for proportionate treatment. Designing controls first could address the wrong conditions or impose unnecessary restrictions.

Threats should be prioritized according to the harm they could cause to business operations. Potential operational impact connects a threat to interrupted services, impaired objectives, and other business consequences. Vulnerability severity and the industry threat landscape are useful inputs, but neither establishes organizational priority without considering impact.

Data classification identifies the sensitivity and business importance of the information being considered for cloud use. That classification establishes the protection requirements against which availability, shared storage, and location must be evaluated. Without knowing the data's classification first, the organization cannot determine which cloud safeguards and handling conditions are appropriate.

Spear phishing targets human judgment with tailored messages intended to induce unsafe actions. A company-wide information security awareness plan prepares personnel to recognize suspicious approaches, verify unusual requests, and follow reporting procedures, reducing the chance that the attack succeeds. Vulnerability controls and an IPS address technical exposure, while daily log review detects activity after an attempted compromise.

Phishing succeeds by persuading users to disclose information, open harmful content, or approve deceptive requests. Educating users helps them recognize suspicious messages, verify requests, avoid unsafe actions, and report attempts. Spam filters reduce some messages, but user judgment remains necessary for phishing that reaches them through any channel.

A security information and event management system collects and correlates event information so potentially significant activity can be identified and monitored across systems. This facilitates visibility into risk occurrences and supports timely investigation. It does not primarily value business impact, maintain policy repositories, or provide continuity through log redirection.

Security involvement in procurement places security requirements, risk criteria, and contractual protections into the negotiation while terms can still be changed. This prevents the organization from committing to a service before its concerns are addressed. Legal review, audits, and policy communication can support the engagement but do not replace early security participation.

Technical metrics measure operational characteristics such as control availability, detection results, processing performance, and failure rates. These observations show whether specific controls are operating effectively. Overall risk management, resource allocation, and strategic alignment require business context and governance measures beyond technical data, so they cannot be determined from technical metrics alone.

Continuity planning must begin by identifying the business processes whose interruption would materially affect the organization. Their criticality then drives impact analysis, recovery objectives, application dependencies, resource requirements, and suitable recovery strategies. Selecting resources or a recovery approach first would lack the business priorities needed to justify those decisions.

Establishment of security governance creates common authority, accountability, policies, and oversight for all branches. That enterprise-level direction allows security requirements to be applied consistently despite differences in local operations. Decentralizing governance would make variation more likely, while process maturity alone does not establish organization-wide direction.

Even though the denial of service attack failed, the discovered weaknesses remain potential exposure and require accountable treatment. Tracking and reporting each weakness through final resolution assigns ownership, preserves visibility, and confirms that corrective action is completed. Deferring issues can leave them exploitable, while eliminating everything regardless of cost ignores risk-based prioritization.

When direct financial return is difficult to calculate, estimated reduction in risk expresses the initiative's principal business value. It shows how the investment may lower the likelihood or impact of adverse events and supports comparison with the organization's risk tolerance. Cost, maturity, and efficiency measures do not capture the security outcome as directly.

The organization's vision and mission define its purpose, direction, and intended outcomes. Information security strategy should derive from that foundation so protection priorities enable the enterprise rather than operate independently of it. Gap analyses, policies, and compliance obligations shape implementation after the strategic direction is established.

The new control reduces vulnerability risk but interferes with business operations, so the organization needs a treatment that addresses both conditions. Evaluating compensating control options can identify another safeguard that provides comparable risk reduction with less disruption. Simply educating users does not resolve the operational impact of the control.

System logs preserve event sequences, timestamps, actions, and other details needed to reconstruct an incident and determine its root cause. Clearing those logs destroys direct investigative information and may prevent reviewers from establishing what occurred. Failed antivirus updates may have contributed to the event, but they do not damage the investigation as severely as removing the records needed to analyze it.

Senior management needs the business significance of control noncompliance in order to make informed risk decisions. Explaining its impact on the organization's risk profile connects the audit findings to exposure, priorities, and possible treatment. Technical remediation records alone do not show leadership how the failures change organizational risk.

An information security governance program establishes who owns security decisions, accepts risk, allocates resources, and oversees performance. This establishment of accountability is foundational because governance cannot operate when authority and responsibility are unclear. Audit compliance, tactical solutions, and incident monitoring are activities or outcomes that depend on that governance structure.

Consent provides a legitimate basis for an individual to understand and agree to the collection and processing of personal data where consent is required. Collecting data without it directly undermines individual choice and creates a fundamental privacy violation. Storage demands and resource usage are operational concerns, while an outdated policy does not necessarily establish unauthorized collection.

For a newly assembled team, a tabletop exercise provides a structured first opportunity to discuss an incident scenario, confirm roles, and work through decisions and communications. It exposes gaps in coordination and shared understanding without requiring a disruptive technical exercise. The members' individual experience does not yet demonstrate that they can operate effectively as one response team.

The organization's data owner is accountable for determining how information must be handled throughout its lifecycle, including retention and destruction. That authority remains with the organization when storage or processing is outsourced to a cloud provider. Provider personnel may execute the schedule, but they should not decide the business and compliance requirements for the data.

Application security controls should first be addressed during requirements gathering, when business needs and protection obligations are defined. Early security requirements guide design, development, testing, and acceptance, reducing the need for costly later changes. Design and coding implement those requirements, while configuration management controls system changes after key security decisions have already been made.