Risk Management Integration with Life Cycle

A security manager should understand that risk management activities are not one-time events. Risk management is a continuous process. For effective risk management, the related activities should be integrated with the process life cycle.

System Development Life Cycle

A security manager should be aware of the following system development life cycle (SDLC) phases:

Phase	Description
Phase 1: Initiation/Feasibility	The Objective, purpose, and scope of the system are discussed, finalized, and documented. In this phase, the system design is finalized and approved. Internal controls should also be incorporated during the initial design stage. During the feasibility phase (planning or initiation), the process for change management should be defined. It is very important to prevent scope creep...