Domain 3 · Objective reference 3.10 · Chapter 28 of 62
Manage security across the system lifecycle
About 5 minutes · Current ISC2 outline effective 15 April 2024; the announced 15 April 2027 replacement requires separate mapping
Session only. Enable saving or download a backup from this course’s hub.
Completion is self-reported and does not certify understanding.
See it · Try it · Recall it
Picture the topic
Remember this: Security begins before acquisition and survives until disposal.
Explore the anchors
Establish requirements architecture and assurance.
Concept matching activity
Match this task or description to its concept:
Implement validate maintain and monitor.
Choose a concept before checking the explanation.
A quick way to study this topic
- Hide the explanation and redraw these three anchors from memory.
- Explain the difference between the anchors in your own words.
- Apply the distinction to the worked example below. Check the full lesson for assumptions and exceptions.
- Recall it again tomorrow, then after a few days. A memory hint is a retrieval cue, not a replacement for understanding.
Original academy illustrations and fictional exercises. These are learning simulations, not a real virtual machine, network assessment or measure of job readiness. Activities reset when you leave or reload; they do not change quiz scores.
What this chapter explains
- Concepts and mechanisms
- Design, evidence and tradeoffs
Concepts and mechanisms
The system lifecycle connects stakeholder needs, requirements, architecture, implementation, integration, verification, deployment, operation and retirement. Verification checks conformance to specified requirements; validation asks whether the resulting capability serves the intended need in context. Security acceptance should be defined early enough to influence design and acquisition, not added only after delivery.
Design, evidence and tradeoffs
Trace requirements to design decisions and evidence. Operations need configuration, monitoring, support, recovery and change processes, while retirement needs access removal, data disposition and dependency transition. New architecture or data use can invalidate old assurance. Preserve material assumptions and residual risks through handoffs so the operational owner does not inherit an unexplained security claim. Reuse components only with an evaluation of their suitability for the new context.
Worked example
A delivered application meets its documented technical tests but lacks the recovery behavior required for the business service. Validation identifies the unmet need.
Check your understanding
How can verification succeed while validation fails?
Show explanation
The implementation can meet its written specification while the specification or resulting capability does not adequately serve the intended business use.
Source and study boundary
Official syllabus source. The reference identifies the topic being taught. Explanations and examples are original academy material; a topic link does not establish independent approval or sufficient exam mastery.