Integrate Security and Privacy Into Every Applicable SDLC Phase

Defines SDLC Privacy as governed integration of approved processing purposes, personal-information requirements, Privacy principles, controls, rights support, evidence, supplier obligations, and disposition.

Best Practice: Integrate Security and Privacy Throughout the Lifecycle

Integrate Privacy purpose, minimization, Design, controls, evidence, monitoring, individual-rights support, supplier obligations, and data disposition throughout the lifecycle.

Benefits: Building Security and Privacy in from the earliest applicable phase catches design-level exposure while it is still cheap to fix, rather than discovering it during a pre-Production review when redesign is expensive and the Release date is already at risk. It also keeps individual-rights support and data-disposition obligations attached to the Solution for its full operating life, not just its launch.

Best Practice: Define Required Security and Privacy Treatment

Benefits: A defined treatment table gives Security and Privacy reviewers a consistent basis for evaluating any Release, rather than reinventing scope and depth each time. It also makes clear which controls a lower-risk change can skip and which a higher-risk change with sensitive data or profiling cannot, so review effort tracks actual exposure instead of applying uniformly to everything.

Best Practice: Apply Security and Privacy Across Applicable SDLC Phases

Apply this discipline continuously from Intake through Retirement, translating the governing principle into testable requirements during Design and Build, generating decision-ready evidence through integration and acceptance testing, verifying the authorized state in Production and Operations, and closing remaining obligations at Retirement.

Benefits: Carrying Security and Privacy requirements through Requirements, Design, Build, and testing means the evidence needed for Production authorization and eventual certification accumulates naturally instead of being assembled retroactively under deadline pressure. Retirement-stage closure of access and data further prevents orphaned credentials and forgotten datasets from becoming a later breach or compliance finding.

Best Practice: Govern Security and Privacy Decisions and Evidence

Establish named ownership — Solution, Release, discipline, evidence, and Risk — proportionate to the work’s actual criticality and reversibility. Keep Risks, exceptions, and Technical Debt visible in authoritative systems, not buried in narrative updates. Generative AI may assist with analysis and drafting, but accountable decisions remain with named human authorities.

Benefits: Naming a Risk Owner and evidence producers before work begins prevents Security and Privacy findings from being deferred by default because no one is clearly accountable for resolving them. Keeping Risk acceptance and Production authorization as human decisions — even when AI assists with the analysis — preserves a defensible chain of accountability if a control later fails.

Example

For a public customer portal, security and privacy begin during Intake with data classification and regulatory screening. Requirements Capture defines authentication, consent, retention, and privacy needs. Design includes threat modeling, secure patterns, and least-privilege access. Build applies secure coding and dependency controls. SIT and specialized testing verify vulnerabilities, integrations, and privacy behavior. Production readiness confirms monitoring, incident response, and rollback. Operations tracks threats, access, incidents, and control effectiveness, while retirement governs data retention and secure disposal.

Best Practice: Advance Maturity Deliberately for Integrate Security and Privacy Into Every Applicable SDLC Phase

At Crawl maturity, apply a manual threat-and-privacy checklist during Design and before Production, reviewed by a designated Security or Privacy contact. At Walk maturity, integrate Security and Privacy requirements and evidence collection into the standard Utilization Profile for every applicable phase, with defined triggers for deeper review. At Run maturity, embed automated security scanning, privacy-impact tooling, and policy-as-code checks directly into the delivery pipeline, with a human reviewer confirming findings that require judgment.

Benefits: A manual checklist at Crawl maturity catches the most consequential exposure without requiring dedicated security tooling the enterprise doesn’t yet have. Integrating requirements into the standard Utilization Profile at Walk maturity means Security and Privacy participation happens consistently rather than depending on someone remembering to loop them in. Automating scanning and policy checks at Run maturity catches routine issues continuously, freeing reviewers to focus on the genuinely ambiguous findings automation can’t resolve.

Best Practice: Avoid Common Antipatterns in Integrate Security and Privacy Into Every Applicable SDLC Phase

Enterprises should avoid treating Security and Privacy review as a single pre-Production gate rather than a continuing discipline. By the time a dedicated review occurs late in delivery, Architecture and data-handling decisions are already locked in, so findings arrive too late to fix without expensive rework or a delayed Release.

Benefits: Avoiding this antipattern keeps Security and Privacy involved from Requirements and Design onward, when issues are still cheap to correct. It reduces the frequency of late-stage redesign and keeps Release schedules from being held hostage to findings that earlier involvement would have caught.

Connections to Related IF4IT Practices and Inventories

Weave security, privacy, Risk, compliance, audit, and authorization controls through the decisions and responsibilities addressed in this chapter so evidence, exceptions, residual Risk, and accountable approvals stay visible and governed.

Use the Non-Functional Requirements (NFRs) Framework for Software Systems to tie quality expectations to validation methods, test evidence, acceptance criteria, readiness gates, and Production assurance.