Application Security

From a risk assessment point of view can anyone
help to provide me the following check lists
to:-

1. classify an application in terms of CIA and
sensitivity and legality
2. Question to ask during the feasibility
study, requirements definition, development,
testing, rollout and related stages of SDLC

I am looking out for proper checklists that
will capture the security state of an
application planned to be launched. My idea is
to have process in place so that I can later
audit to provide a security clearance.