Integrating testing early helps identify security vulnerabilities and configuration issues before they reach production, reducing remediation costs and time. Reference: [Security Guidance v5, Domain 10 - Application Security]

A key component of governance in cybersecurity is defining roles and responsibilities. Governance ensures that the right people within an organization are assigned specific duties related to security and that they are held accountable for those responsibilities. This helps establish clear lines of authority and accountability, ensuring that everyone knows what they are responsible for in terms of security practices, policies, and procedures.
While standardizing technical specifications, defining tools and technologies, and enforcing penetration testing are important elements of a cybersecurity strategy, defining roles and responsibilities is essential for overall governance to ensure that security practices are consistently followed.

Using IAM roles/identities provided by cloud providers instead of static secrets (like passwords or API keys) significantly reduces the risk of credential leakage. IAM roles enable dynamic and temporary credentials, meaning that they are automatically rotated and do not need to be manually stored or managed. This eliminates the need for hardcoding sensitive credentials into code or configuration files, which can often lead to accidental exposure or misuse if not properly secured.
Lowering storage costs is not a direct benefit of using IAM roles over static secrets. Facilitating data encryption is important for security, but IAM roles are not specifically focused on data encryption. Improving system performance is not a primary benefit of using IAM roles over static secrets. The main advantage is security-related, specifically the reduction in credential leakage risks.