Exam CISM Topic 2 Question 647 Discussion

Explanation
Performing a vulnerability analysis is the best option to ensure that a new application complies with information security policy because it helps to identify and evaluate any security flaws or weaknesses in the application that may expose it to potential threats or attacks, and provide recommendations or solutions to mitigate them. Reviewing the security of the application before implementation is not a good option because it may not detect or prevent all security issues that may arise after implementation or deployment. Integrating security functionality at the development stage is not a good option because it may not account for all security requirements or challenges of the application or its environment. Periodically auditing the security of the application is not a good option because it may not address any security issues that may occur between audits or after deployment. References:
https://www.isaca.org/resources/isaca-journal/issues/2017/volume-2/secure-software-development-lifecycle
https://www.isaca.org/resources/isaca-journal/issues/2016/volume-4/integrating-assurance-functions