An agile team says that short iterations remove the need to define security requirements. How should an auditor respond?

1. Agree because controls apply only to waterfall projects
2. Require all iterative work to stop permanently
3. Security requirements and acceptance criteria should be integrated into the iterative process
4. Replace security testing with the sprint's attendance sheet