A development team is beginning a new project to build a customer-facing loan application portal that will process sensitive financial data. The security architect wants to ensure that security cost and effectiveness are optimized across the entire effort. At which point in the software development lifecycle should security requirements first be formally defined and documented to achieve the lowest remediation cost?