Security Considerations in the System Development Life Cycle

Published

October 16, 2008

Author(s)

Richard L. Kissel, Kevin M. Stine, Matthew A. Scholl, Hart Rossman, J Fahlsing, Jessica Gulick

Abstract

The purpose of this guideline is to assist agencies in building security into their IT development processes. This should result in more cost-effective, risk-appropriate security control identification, development, and testing. This guide focuses on the information security components of the System Development Life Cycle (SDLC). Overall system implementation and development is considered outside the scope of this document. Also considered outside scope is an organization’s information system governance process. The guideline describes the key security roles and responsibilities that are needed in development of most information systems. Sufficient information about the SDLC is provided to allow a person who is unfamiliar with the SDLC process to understand the relationship between information security and the SDLC. [Supersedes SP 800-64 Rev. 1 (June 2004): http://www.nist.gov/manuscript-publication-search.cfm?pub_id=151285]

Citation

Special Publication (NIST SP) - 800-64 Rev 2

Report Number

800-64 Rev 2

NIST Pub Series

Special Publication (NIST SP)

Pub Type

NIST Pubs

Supercedes Publication

Security Considerations in the Information System Development Life Cycle

Download Paper

DOI Link

Keywords

Computer Security, Cyber Security, FISMA, SDLC, System Development Life Cycle

Citation

Kissel, R. , Stine, K. , Scholl, M. , Rossman, H. , Fahlsing, J. and Gulick, J. (2008), Security Considerations in the System Development Life Cycle, Special Publication (NIST SP), National Institute of Standards and Technology, Gaithersburg, MD, [online], https://doi.org/10.6028/NIST.SP.800-64r2 (Accessed October 9, 2025)