The correct answer is A because security must be defined as a requirement early in system development projects. Security requirements translate business, regulatory, privacy, risk, and control expectations into specific project deliverables. When requirements are defined early, security can be built into architecture, design, development, testing, and deployment. If requirements are not defined at the beginning, security may be added later as a costly or incomplete afterthought. Assigning resources based on business impact is useful, but resource planning should follow a clear understanding of the required security outcomes. Reviewing the security policy may provide guidance, but it does not by itself integrate security into the project. Embedding a security representative can support integration, but the representative still needs defined requirements to guide the project team. CISM program management emphasizes integrating information security into life cycle processes and business initiatives as early as possible. Therefore, defining security requirements is the first and most important step to ensure security is built into system development projects.
Reference: CISM Information Security Program Development and Management; SDLC security, security requirements, project integration, and secure development principles.