Software development processes must be developed how?

• A. Based on industry standards and/or best practices
• B. Based on internal preferences only
• C. No particular standard
• D. Only for external software

Answer: (A)

Developing software processes based on industry standards and best practices ensures you’re using proven, repeatable steps that address security throughout the development lifecycle. Standards provide validated guidance, common terminology, and tested controls that reflect real-world threats and outcomes from many organizations, which helps you build secure software consistently and makes audits smoother. Relying on internal preferences alone can lead to inconsistent practices and gaps in security because there’s no external validation or baseline. There’s also no reason to limit secure development to external software only—internal applications benefit from the same disciplined, security-minded approach. That’s why basing processes on industry standards and best practices is the strongest choice.