Software Development Life Cycle (SDLC)

The Software Development Life Cycle is the structured set of phases a system moves through: requirements gathering, design, development, testing, deployment, operations and maintenance, and eventual disposal. CISSP treats security as a property of the whole cycle, not a phase of its own. Security requirements are captured alongside functional ones, threat modeling happens during design, secure coding standards govern development, security testing runs before and after release, and disposal includes sanitising data and retiring credentials.

The load-bearing principle is cost. A flaw found while writing requirements costs almost nothing to correct; the same flaw found in production can cost orders of magnitude more, plus the breach it may already have enabled. That is why “add security at the end” is the exam’s recurring wrong answer. Whenever a scenario offers a choice between engaging security early or reviewing the finished product, the early option wins, and the earliest phase offered is usually the best one.

Exam relevance: if a scenario asks when security should first be involved in a project, the answer is the requirements phase, or the earliest phase listed. If it describes security review happening only before go-live, that is the problem to fix. Contrast the SDLC, which is the phase model itself, with DevSecOps, which is the culture and tooling that automates security into a continuous delivery pipeline built on that model.