Application security controls should be addressed first during the requirements gathering stage of the software development life cycle (SDLC). This ensures that security is integrated from the beginning, allowing for the identification of security requirements, compliance needs, and risk considerations before design and development begin. Addressing security early helps reduce vulnerabilities and costly fixes later in the development process. While design, coding, and reviews are important, security should be a foundational requirement from the start.