Security requirements are added to projects, but nobody verifies them at acceptance. What program step is missing?

1. Evidence-based validation that the requirements were implemented effectively
2. A different meeting-room location
3. A second project slogan
4. A larger number of requirements regardless of need