The software development life cycle (SDLC) is the way a team organizes the design, creation, and maintenance of software. It is broader than coding: it gives teams a framework for making decisions across a product’s life, while leaving them room to choose an approach that fits their work.
What is the software development life cycle?
NIST defines an SDLC as “a formal or informal methodology for designing, creating, and maintaining software (including code built into hardware).” The definition matters because an SDLC is not one universal checklist or a synonym for programming. It is the way work is organized across the software’s life.
As an Amazon Associate I earn from qualifying purchases.
Teams may use a formal process or a lighter-weight one. NIST names waterfall, spiral, agile, and agile combined with software development and IT operations (DevOps) practices as examples of lifecycle models. Those are different approaches, not a single mandatory sequence of phases. NIST does not prescribe one phase list that every team must follow. NIST SP 800-218, Version 1.1 (February 3, 2022)
Free tools Windows power users keep installed
One-click scans. No signup required.
What are the main SDLC models?
Waterfall, spiral, agile, and agile with DevOps are useful names for discussing how software work may be organized. The NIST source establishes them as lifecycle-model examples, but it does not provide a basis for ranking them or claiming one is universally faster, cheaper, safer, or better.
#1 Best Overall
- Waterfall: A named lifecycle model.
- Spiral: A named lifecycle model.
- Agile: A named lifecycle model.
- Agile with DevOps practices: A lifecycle approach that combines agile with software development and IT operations practices.
To choose an approach, a team can ask how it wants to organize the work and incorporate feedback, then adapt its process to the project. The model labels alone do not determine a project’s outcome.
Where does security fit into the SDLC?
Security should be deliberately addressed within whichever lifecycle a team chooses, rather than treated only as a final check. NIST SP 800-218 Version 1.1 notes that few lifecycle models explicitly cover security in detail. Its Secure Software Development Framework (SSDF) recommends practices that can be integrated into an SDLC to reduce vulnerabilities, limit the potential effects of exploiting vulnerabilities that go undetected or unaddressed, and address root causes to help prevent recurrence. NIST SP 800-218, Version 1.1
The SSDF is security guidance to incorporate into a team’s chosen lifecycle; it is not a replacement lifecycle model, nor a synonym for Agile or DevOps. NIST describes it as a set of fundamental secure development practices based on established guidance. NIST Secure Software Development Framework project page
Make security a recurring concern
NIST’s DevSecOps notional reference model shows an early phase establishing secure development and security requirements and incorporating secure design. It also describes continuous feedback that informs later lifecycle work. This illustrates how security and feedback can recur across the lifecycle instead of being confined to one stage. NIST NCCoE DevSecOps notional reference model
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What is the current status of NIST’s SSDF guidance?
NIST published SP 800-218 Version 1.1 on February 3, 2022. NIST also listed SP 800-218 Rev. 1, SSDF Version 1.2, as an initial public draft published December 17, 2025; the public comment period closed January 30, 2026. The cited listing identifies that document as a draft, and does not establish whether NIST has since issued a final version. NIST SP 800-218 Rev. 1 Version 1.2 initial public draft listing
Quick Recap
Best Value
Rank #4
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
