Which SDLC principle is applied to Annex B?

• A. Security is optional in development.
• B. Integrate security into each development phase from requirements to deployment and operations.
• C. SDLC concerns only deployment, not design.
• D. Security testing is the last step.

Answer: (B)

The principle being tested is that security should be woven into every phase of the development lifecycle, from requirements through deployment and ongoing operations. Annex B emphasizes addressing security from the outset and continuing it through design, implementation, testing, and operations, rather than treating security as a final add-on. By defining security requirements early, modeling threats during design, applying secure coding and testing throughout development, and maintaining security in deployment and operations, you gain stronger protection, reduce rework, and achieve continuous assurance. Security as optional, or limited to a single phase, or placed only at the end, conflicts with this integrated, ongoing approach.