Explanation/Reference:
Explanation:
Risk should be addressed as early in the development of a new application system as possible. In some cases, identified risks could be mitigated through design changes. If needed changes are not identified until design has already commenced, such changes become more expensive. For this reason, beginning risk assessment during the design, development or testing phases is not the best solution.

Section: INFORMATION SECURITY PROGRAM MANAGEMENT
Explanation:
An information security manager must understand the business needs that motivated the change prior to taking any unilateral action. Following this, all other choices could be correct depending on the priorities set by the business unit.

Section: INFORMATION RISK MANAGEMENT

Section: INFORMATION SECURITY GOVERNANCE