primarily because when an organization is developing custom software, it can
directly control all aspects of the SDLC.
At the beginning of the SDLC, an initial system-level risk assessment
focusing on the business assets, threats, likelihood of risks, and their potential