There are SDL activities and best practices during A$1$ phase. Which of the following statement is not relevant to A$1$ phase?

Question $2$ options:

Business risk should be considered during A$1$ phase.

The software security team creates the overall SDL project execution.

Privacy impact assessment should be planned during A$1.$

Early engagement of software security members is important.