SDLC
SDLC (Software Development Life Cycle) is a formalized sequence of software development phases: planning, analysis, design, implementation, testing, deployment, maintenance. Secure SDLC (SSDLC) adds security controls to each phase.
What is SDLC?
SDLC (Software Development Life Cycle) is a formalized sequence of software development phases — planning, testing, deployment, and maintenance. SDLC standardizes the process, enables quality control, budget and schedule predictability, and regulatory compliance (ISO 27001, PCI DSS, SOC 2, NIS2).
7 phases of SDLC
- Planning — business goals, budget, schedule, kickoff
- Requirements analysis — user stories, use cases, non-functional requirements (performance, security, compliance)
- Design — architecture, UX/UI, data model, tech stack selection, threat modeling
- Implementation — coding, code review, unit tests, SAST scanning
- Testing — integration, UAT, performance, security (DAST, pentest)
- Deployment — release plan, rollback plan, monitoring configuration
- Maintenance — patching, development, incident response, deprecation
SDLC models
| Model | Characteristics | When to use |
|---|---|---|
| Waterfall | Linear, rigid phases | Known requirements, regulatory (MIL, aerospace) |
| V-Model | Waterfall + tests per phase | Safety-critical, medical |
| Incremental | Incremental module delivery | Large projects, phaseable |
| Spiral | Iterative with risk focus | High risk, R&D |
| Agile/Scrum | 2-4 week iterations, adaptive | Volatile requirements, startups |
| DevOps/DevSecOps | Continuous delivery + security | SaaS, digital products |
Secure SDLC (SSDLC) — security per phase
Requirements → security as non-functional requirement (OWASP ASVS levels) Design → threat modeling (STRIDE, PASTA, LINDDUN), security architecture review Implementation → secure coding standards (OWASP Top 10, CWE Top 25), SAST (SonarQube, Checkmarx), SCA (Snyk, Dependabot) Testing → DAST (OWASP ZAP, Burp), IAST, penetration testing, fuzz testing Deployment → secure CI/CD (signed artifacts, SBOM, policy-as-code, OPA), IaC scanning (Checkov, Terrascan) Maintenance → vulnerability management, patch management, SIEM, incident response
Why SSDLC?
Vulnerability remediation cost by detection phase:
| Detection phase | Relative cost |
|---|---|
| Requirements | 1× |
| Design | 5-10× |
| Implementation | 10-20× |
| Testing | 20-50× |
| Production | 100-1000× |
Shift-left security = detect vulnerabilities as early as possible → maximum savings.
Secure SDLC standards
- OWASP SAMM — Software Assurance Maturity Model (5 domains, 4 maturity levels)
- BSIMM — benchmark based on 130+ organizations
- Microsoft SDL — 12 practices, historical leader
- NIST SSDF (SP 800-218) — Secure Software Development Framework (mandatory for US federal suppliers from 2024)
- ISO/IEC 27034 — application security framework
- PCI Secure SLC — for payment applications
Explore our services
Frequently asked questions
+ What is SDLC?
SDLC (Software Development Life Cycle) is a formalized software development cycle — a sequence of phases from concept to production maintenance: planning, requirements analysis, design, implementation, testing, deployment, maintenance. SDLC standardizes the process, enables quality control and regulatory compliance (ISO 27001, PCI DSS, SOC 2).
+ What are the phases of SDLC?
Standard SDLC covers 7 phases: (1) Planning — goals, schedule, budget, (2) Requirements analysis — gathering and formalizing functional and non-functional requirements, (3) Design — architecture, technical design, technology selection, (4) Implementation — coding, (5) Testing — unit, integration, security, UAT, (6) Deployment — production release, (7) Maintenance — support, fixes, development.
+ How does SDLC differ from SSDLC?
SDLC describes the development process itself, SSDLC (Secure SDLC) adds security controls to each phase: threat modeling in design, security requirements in requirements, SAST/SCA in implementation, DAST and pentest in testing, security monitoring in maintenance. SSDLC enforces shift-left security — detecting vulnerabilities earlier costs 10-100× less than after deployment.
+ SDLC vs Agile — are they mutually exclusive?
No. SDLC is a framework (phases and goals), Agile is an execution method (iterations). In Agile, each sprint is a mini-SDLC: planning → design → implement → test → deploy → review. Modern SDLC (DevSecOps) combines Agile sprints with automation: CI/CD pipelines with quality gates, Infrastructure-as-Code, continuous security testing. V-Model, Waterfall remain traditional approaches — rigid but required in some regulations (MIL-STD, DO-178C).
+ Which standards describe Secure SDLC?
Key ones: (1) OWASP SAMM (Software Assurance Maturity Model) — framework for assessing SDLC security maturity, 5 domains, 4 levels, (2) BSIMM (Building Security In Maturity Model) — benchmark of 100+ practices from 130+ organizations, (3) Microsoft SDL — 12 security practices, (4) NIST SSDF (SP 800-218) — mandatory for US federal suppliers from 2024, (5) ISO/IEC 27034 — application security standard.