A cloud migration project asks for a security review only one week before launch. What program improvement best prevents recurrence?

1. Ban all cloud projects
2. Require only a longer final report
3. Delegate every requirement to the provider without review
4. Embed security requirements and checkpoints in the delivery lifecycle