Software development lifecycle step-by-step guidance

Below are phase-by-phase actions, mandatory deliverables and practical checklists to guide implementation.

Initiation

Goal: Establish security and privacy expectations and identify risks before design work begins.

Actions:

Appoint project sponsor, system owner and security lead.
Perform initial Threat and Privacy Risk Assessment (documented).
Define security and privacy objectives of CIA, non-repudiation and legal requirements.
Draft a Security and Privacy Plan with milestones, roles and budget for security activities.
Require security awareness briefing for project stakeholders.

Goal: Ensure requirements include explicit privacy and security criteria.

Define functional, privacy and security requirements. Include purpose limitation and data minimization requirements.
Conduct Privacy Impact Assessment (PIA) and update risk register.
Translate risks into measurable security requirements like encryption, RBAC, logging and retention.
For procurement: include security clauses, acceptance criteria and tender security evaluation.
For third parties: require evidence of prior security audits and contractual data protection obligations.

Goal: Design an architecture that enforces privacy and security by construction.

Produce security architecture diagrams showing trust boundaries, data flows and classification.
Apply Data Flow Mapping and Data Classification (sensitive vs non-sensitive).
Embed privacy controls: data minimization, consent capture points, and user-facing
Specify encryption, key management, segmentation, and secure default configurations.
Plan for logging, monitoring, and auditability (what to log, how long, who has access).
Document fallback modes and failure behaviors to avoid privacy leaks or insecure defaults.

Goal: Implement secure, privacy-aware code and configurations.

Adopt secure coding standards (OWASP, CERT) and include them in the definition of done.
Use automated static analysis (SAST), dependency scanning and secret detection in CI/CD pipelines.
Enforce strong access controls for development environments and use separate secrets management.
Perform regular code reviews focused on security and privacy by identifying hard-coded secrets and data exposures.
Implement privacy-enhancing techniques (pseudonymization, tokenization) where feasible.
Maintain secure build and deployment scripts; avoid embedding credentials in code.

Goal: Verify security and privacy controls work as intended.

Create a security test plan covering unit, integration, system, and acceptance tests.
Include privacy test cases validating consent, data minimization, and access controls.
Conduct vulnerability scanning and dynamic application security testing (DAST).
Arrange independent penetration testing for critical systems and production environments.
Perform usability testing to ensure privacy settings and notices are clear and actionable.
Run regression tests after patches and new features to prevent reintroducing vulnerabilities.

Goal: Deploy securely with correct configurations, access controls and monitoring in place.

Apply secure configuration baselines and hardening to servers, databases and network devices.
Enforce RBAC and configure least privilege for all accounts; set up MFA for admin accounts.
Enable and protect audit logging; ensure log storage and retention meet policy requirements.
Conduct a production penetration test and address critical findings before go-live.
Publish privacy notices and provide user controls for consent and data management.
Establish monitoring and alerting (IDS/IPS, SIEM) and define on-call incident responders.

Goal: Sustain security and privacy posture throughout operations.

Maintain a schedule for vulnerability scanning, patch management, and configuration reviews.
Conduct periodic privacy and security control reviews and update PIAs as needed.
Ensure change management enforces security reviews and testing before changes are applied.
Continue training for administrators and users; run phishing and awareness programs.
Keep data retention schedules and securely sanitize or delete data when no longer required.
Keep an incident response plan current and conduct tabletop exercises regularly.

Goal: Safely retire or replace systems while preserving required records and preventing data leakage.

Plan archival or migration of records according to legal retention requirements.
Sanitize media and verify secure deletion of sensitive data using approved methods.
Revoke access, disable accounts and remove credentials tied to decommissioned systems.
Update documentation to reflect where data was moved and how it can be accessed or destroyed.
Notify stakeholders and offer users guidance to export or delete their data where applicable.