iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The software development life cycle (SDLC) is a way to organize the work of designing, creating, and maintaining software. It is not just the coding stage, and it does not have one universally required list of phases. Teams choose a lifecycle approach for their situation and should integrate security into it from the start.
What is the software development life cycle?
NIST defines an SDLC as “a formal or informal methodology for designing, creating, and maintaining software (including code built into hardware).” The definition covers software’s life beyond initial implementation: work also includes shaping what to build and supporting and maintaining it.
In practice, SDLC names the way a team organizes that work. It gives people a framework for making decisions and coordinating activities, but the label does not guarantee that every team performs the same tasks in the same order. NIST identifies waterfall, spiral, agile, and agile approaches combined with software development and IT operations (DevOps) practices as examples of lifecycle models. These are alternative approaches, not a single mandatory sequence.
For that reason, a fixed phase count should not be treated as a universal SDLC standard. A team may describe its work using phases, iterations, or another structure. The useful question is what its chosen approach requires at each point, and how decisions and feedback carry through the work.
#1 Best Overall
What are the main SDLC models?
The model names below identify broad approaches. They do not, by themselves, specify every project activity or establish which model will be fastest, cheapest, safest, or best. Compare a team’s actual working practices rather than assuming a label determines its results.
| Model or approach | What the name indicates | What the label alone does not establish |
|---|---|---|
| Waterfall | A recognized SDLC model identified by NIST. | A universal phase list, project outcome, or suitability for a particular team. |
| Spiral | A recognized SDLC model identified by NIST. | A universal phase list, project outcome, or suitability for a particular team. |
| Agile | A recognized SDLC model identified by NIST. | A guarantee of a specific feedback cadence, delivery speed, or project result. |
| Agile with DevOps practices | An approach NIST identifies as combining agile with software development and IT operations practices. | A guarantee that security is built in or that operations and development are coordinated effectively. |
To decide whether an approach fits, examine how your team organizes work and incorporates feedback, as well as its product, constraints, and responsibilities. NIST’s list is a useful set of examples, not an evidence-based ranking or a project-specific recommendation.
Where does security fit into the SDLC?
Security should be considered throughout the lifecycle, not left solely to a check at the end. NIST notes that few lifecycle models explicitly address security in detail, so a team needs to deliberately integrate secure-development practices into whichever model it uses. NIST’s stated aims include reducing vulnerabilities, limiting the potential effects of exploiting vulnerabilities that were not detected or addressed, and addressing root causes to help prevent recurrence.
Free tools Windows power users keep installed
One-click scans. No signup required.
The Secure Software Development Framework (SSDF) is NIST’s set of secure-development practices for this purpose. It is guidance that can be integrated into an SDLC; it is not a replacement lifecycle model, nor a synonym for Agile or DevOps. NIST describes the framework as building on established guidance, including material from BSA, OWASP, and SAFECode. See the NIST SSDF project page.
A NIST DevSecOps reference model illustrates how security and feedback can recur across lifecycle work: an early phase establishes secure-development and security requirements and incorporates secure design, while continuous feedback informs later work. This is a notional reference model, not a prescribed process every team must adopt. Read the NIST DevSecOps reference model.
How should you choose and apply an SDLC?
- Describe the work your team needs to organize. Include design, creation, and maintenance rather than treating coding as the whole lifecycle.
- Choose a working approach that suits the context. Waterfall, spiral, agile, and agile with DevOps practices are examples, not a universal menu with one best answer.
- Make security practices explicit. Integrate secure-development activities into the chosen approach, using the SSDF as guidance where appropriate.
- Plan for feedback. Decide how information from ongoing work can inform later decisions, rather than assuming feedback belongs only at a final review.
These steps are a practical framing, not a NIST-mandated phase sequence. The team’s process should make its responsibilities and decision points clear without implying that one lifecycle diagram fits every project.
Rank #4
What is current NIST guidance?
NIST SP 800-218 Version 1.1, published February 3, 2022, provides the cited SDLC definition and secure-development guidance. NIST also listed SP 800-218 Rev. 1 Version 1.2 as an initial public draft dated December 17, 2025; its public-comment period closed January 30, 2026. That listing identifies the document as a draft. The available listing does not establish whether a final version has since been issued, so consult NIST’s Version 1.2 draft page for its status. The Version 1.1 publication is available as the NIST SP 800-218 PDF.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Best Value
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
