CRISC: Certified in Risk and Information Systems Control

The number of projects that go live without a security review directly identifies exceptions to the control requiring security consideration before deployment. A security review provides evidence that security requirements were addressed as part of project delivery; bypassing it is a clear indicator that lifecycle security requirements may not have been managed.