- CSRC Home
- Projects / Research
- news & events
CSD is currently developing three documents addressing Information Security in the System Development Life Cycle (SDLC). The brochure is available for download from this site:
Info Sec in the SDLC Brochure (Adobe Acrobat, approximately 2.5 mb)
Many SDLC models exist that can be used by an organization to effectively develop an information system. A traditional SDLC is a linear sequential model. This model assumes that the system will be delivered near the end of its life cycle. More complex models have been developed to address the evolving complexity of advanced and large information system designs.
A general SDLC includes five phases: initiation, acquisition/development, implementation/assessment, operations/maintenance, and sunset (disposition). Each of the five phases includes a minimum set of security tasks needed to effectively incorporate security in the system development process. Including security early in the information SDLC will usually result in less expensive and more effective security than adding it to an operational system.
The following questions should be addressed in determining the security controls that will be required for a system: