Which DSAC domain would involve ensuring the software development life cycle is secure?

• A. Governance
• B. Software Assurance
• C. Incident Response
• D. Network Security

Answer: (B)

Securing the software development life cycle means embedding security into every phase of creating and maintaining software. This is the focus of Software Assurance. It covers applying secure coding standards, threat modeling, security testing (static and dynamic analysis, code reviews, fuzzing), architecture and design reviews for security, and managing risks across the software supply chain throughout requirements, design, implementation, testing, deployment, and maintenance. The goal is to make security an integral part of the SDLC rather than an afterthought after code is written.

Governance centers on policy, oversight, and risk management at a higher level; Incident Response focuses on detecting, containing, and recovering from security incidents; Network Security protects network infrastructure and traffic. Thus, the domain that directly addresses making the SDLC secure is Software Assurance.