The security design process ensures that proper security controls, security objectives, and security goals are properly initiated within the System Development Life Cycle (SDLC). The security design process is a set of activities that define and implement the security requirements and architecture for a system or a network. The security design process is integrated into the SDLC, which is a framework that guides the development, testing, deployment, and maintenance of a system or a network. The security design process ensures that the security aspects are considered and addressed from the beginning of the SDLC, and that the security controls, objectives, and goals are aligned with the business needs and the risk appetite of the organization. The other options are not what the security design process ensures within the SDLC, as they either do not involve initiation, do not relate to security design, or do not match the SDLC phases. References: CISSP - Certified Information Systems Security Professional, Domain 8. Software Development Security, 8.1 Understand and integrate security in the Software Development Life Cycle (SDLC), 8.1.2 Identify and apply security controls in development environments, 8.1.2.1 Security design process; CISSP Exam Outline, Domain 8. Software Development Security, 8.1 Understand and integrate security in the Software Development Life Cycle (SDLC), 8.1.2 Identify and apply security controls in development environments, 8.1.2.1 Security design process

Explanation:

Exam 1 Q70-2

Risk transfer is the practice of passing on the risk in question to another entity, such as an insurance company. Let us look at one of the examples that were presented above in a different way.
For your exam you should know below information about risk assessment and treatment: A risk assessment, which is a tool for risk management, is a method of identifying vulnerabilities and threats and assessing the possible impacts to determine where to implement security controls. A risk assessment is carried out, and the results are analyzed. Risk analysis is used to ensure that security is cost-effective, relevant, timely, and responsive to threats. Security can be quite complex, even for well-versed security professionals, and it is easy to apply too much security, not enough security, or the wrong security controls, and to spend too much money in the process without attaining the necessary objectives. Risk analysis helps companies prioritize their risks and shows management the amount of resources that should be applied to protecting against those risks in a sensible manner.
A risk analysis has four main goals:
Identify assets and their value to the organization.
Identify vulnerabilities and threats.
Quantify the probability and business impact of these potential threats.
Provide an economic balance between the impact of the threat and the cost of the countermeasure.
Treating Risk
Risk Mitigation Risk mitigation is the practice of the elimination of, or the significant decrease in the level of risk presented. Examples of risk mitigation can be seen in everyday life and are readily apparent in the information technology world. Risk Mitigation involves applying appropriate control to reduce risk. For example, to lessen the risk of exposing personal and financial information that is highly sensitive and confidential organizations put countermeasures in place, such as firewalls, intrusion detection/prevention systems, and other mechanisms, to deter malicious outsiders from accessing this highly sensitive information. In the underage driver example, risk mitigation could take the form of driver education for the youth or establishing a policy not allowing the young driver to use a cell phone while driving, or not letting youth of a certain age have more than one friend in the car as a passenger at any given time.
Risk Transfer Risk transfer is the practice of passing on the risk in question to another entity, such as an insurance company. Let us look at one of the examples that were presented above in a different way. The family is evaluating whether to permit an underage driver to use the family car. The family decides that it is important for the youth to be mobile, so it transfers the financial risk of a youth being in an accident to the insurance company, which provides the family with auto insurance. It is important to note that the transfer of risk may be accompanied by a cost. This is certainly true for the insurance example presented earlier, and can be seen in other insurance instances, such as liability insurance for a vendor or the insurance taken out by companies to protect against hardware and software theft or destruction. This may also be true if an organization must purchase and implement security controls in order to make their organization less desirable to attack. It is important to remember that not all risk can be transferred. While financial risk is simple to transfer through insurance, reputational risk may almost never be fully transferred.
Risk Avoidance Risk avoidance is the practice of coming up with alternatives so that the risk in question is not realized. For example, have you ever heard a friend, or parents of a friend, complain about the costs of insuring an underage driver? How about the risks that many of these children face as they become mobile? Some of these families will decide that the child in question will not be allowed to drive the family car, but will rather wait until he or she is of legal age (i.e., 18 years of age) before committing to owning, insuring, and driving a motor vehicle.
In this case, the family has chosen to avoid the risks (and any associated benefits) associated with an underage driver, such as poor driving performance or the cost of insurance for the child. Although this choice may be available for some situations, it is not available for all. Imagine a global retailer who, knowing the risks associated with doing business on the Internet, decides to avoid the practice. This decision will likely cost the company a significant amount of its revenue (if, indeed, the company has products or services that consumers wish to purchase). In addition, the decision may require the company to build or lease a site in each of the locations, globally, for
which it wishes to continue business. This could have a catastrophic effect on the company's
ability to continue business operations
Risk Acceptance
In some cases, it may be prudent for an organization to simply accept the risk that is presented in
certain scenarios. Risk acceptance is the practice of accepting certain risk(s), typically based on a
business decision that may also weigh the cost versus the benefit of dealing with the risk in
another way.
For example, an executive may be confronted with risks identified during the course of a risk
assessment for their organization. These risks have been prioritized by high, medium, and low
impact to the organization. The executive notes that in order to mitigate or transfer the low-level
risks, significant costs could be involved. Mitigation might involve the hiring of additional highly
skilled personnel and the purchase of new hardware, software, and office equipment, while
transference of the risk to an insurance company would require premium payments.
The executive then further notes that minimal impact to the organization would occur if any of the
reported low-level threats were realized. Therefore, he or she (rightly) concludes that it is wiser for
the organization to forgo the costs and accept the risk. In the young driver example, risk
acceptance could be based on the observation that the youngster has demonstrated the
responsibility and maturity to warrant the parent's trust in his or her judgment.
The following answers are incorrect:
Risk Transfer - Risk transfer is the practice of passing on the risk in question to another entity,
such as an insurance company. Let us look at one of the examples that were presented above in a
different way.
Risk avoidance - Risk avoidance is the practice of coming up with alternatives so that the risk in
question is not realized.
Risk Mitigation - Risk mitigation is the practice of the elimination of, or the significant decrease in
the level of risk presented.
The following reference(s) were/was used to create this question:
CISA Review Manual 2014 Page number 51
and
Official ISC2 guide to CISSP CBK 3rd edition page number 534-536

Although important, The monitoring of threat activity for adjustment of technical controls is not facilitated by a Business Continuity Planning
The following answers are incorrect:
All of the other choices are facilitated by a BCP: the continuation of critical business functions the rapid recovery of mission-critical business operations the reduction of the impact of a disaster