Study guide
1.4 System Development Life Cycle and Information Life Cycle Management
ISC2 Certified in Governance, Risk and Compliance CGRC
Track your progress as you read
Finished sections get a check mark.
1 Introduction & Exam Overview
0.1 ISC2 CGRC Exam Structure, Logistics & Passing Strategy 0.2 NIST RMF 7-Step Lifecycle & GRC Architecture
2 Chapter 1: Security and Privacy Governance, Risk Management, and Compliance Program
1.1 Enterprise Governance & GRC Frameworks 1.2 Security and Privacy Objectives: CIA, Non-Repudiation and Privacy Concepts 1.3 Multi-Tier Risk Management & Assessment Methodologies 1.4 System Development Life Cycle and Information Life Cycle Management 1.5 Establishing and Operating the Compliance Program 1.6 Legal, Regulatory & Federal Compliance Drivers 1.7 Privacy Governance, Organizational Roles & ISC2 Code of Ethics
3 Chapter 2: Scope of the System
2.1 System Boundary Definition, Architectural Context & Types 2.2 Identifying Information Types with NIST SP 800-60 2.3 System Categorization Process & Impact Analysis (FIPS 199 / SP 800-60) 2.4 Impact and Risk Determination Under Non-Federal Frameworks 2.5 System Registration, Environment & Interconnection Agreements
4 Chapter 3: Selection and Approval of Framework, Security, and Privacy Controls
3.1 Control Catalogs & NIST SP 800-53 Rev. 5 Structure 3.2 Control Allocation & Inheritance Models 3.3 Control Tailoring, Scoping & Overlay Guidance 3.4 Data Handling and Marking Requirements 3.5 Documenting Control Selection and Securing Stakeholder Agreement 3.6 Continuous Monitoring Strategy & Control Selection Approval
5 Chapter 4: Implementation of Security and Privacy Controls
4.1 Developing the Implementation Strategy: Resourcing, Funding and Timeline 4.2 Identifying Control Types: Management, Operational, Technical and Functional Classes 4.3 System Security and Privacy Plan (SSP/SSPP) Development 4.4 Security Engineering Principles & Technical Control Implementation 4.5 Secure Baseline Configuration & System Hardening 4.6 Implementing Compensating and Alternate Controls 4.7 DevSecOps, SDLC Integration & Supply Chain Risk Management 4.8 Documenting Control Implementation: Policies, Procedures, Plans and Risk Registers
6 Chapter 5: Assessment/Audit of Security and Privacy Controls
5.1 Security Assessment Plan (SAP) & Assessor Independence 5.2 Assessment Methods, Objects & Depth/Coverage 5.3 Assessment Execution, Vulnerability Scanning & Testing 5.4 Preparing the Initial Assessment/Audit Report 5.5 Selecting Risk Responses: Avoid, Accept, Share, Mitigate, Transfer 5.6 Stakeholder Collaboration, Corrective Action and Reassessment 5.7 Security Assessment Report (SAR) & Risk Findings Analysis 5.8 Developing the Risk Response Plan: Prioritization and Resources
7 Chapter 6: System Compliance and Authorization
6.1 The Core Authorization Package & Supporting Artifacts 6.2 Plan of Action and Milestones (POA&M) Architecture & Management 6.3 System Risk Acceptance Criteria and Stakeholder Concurrence 6.4 Authorization Decision Process & Decision Types 6.5 Residual Risk Acceptance, Terms of Authorization & Continuous ATO 6.6 Documenting and Communicating the Compliance Decision
8 Chapter 7: Compliance Maintenance and Continuous Monitoring
7.1 Continuous Monitoring Strategy & Operations (NIST SP 800-137) 7.2 Configuration Management & Security Impact Analysis (NIST SP 800-128) 7.3 Incident Response and Contingency Activities in Sustained Compliance 7.4 Awareness, Training, Evidence Collection and Monitoring-Strategy Revision 7.5 Ongoing Remediation, POA&M Sustainment & Annual Reviews 7.6 Event-Driven Reauthorization & System Decommissioning
1.4 System Development Life Cycle and Information Life Cycle Management
Key Takeaways Explain This Topic AI
The RMF is designed to execute inside the SDLC, not after it: categorization belongs in initiation and control selection in development/acquisition, because retrofitting controls after deployment is the most expensive failure mode CGRC tests.
The five classic SDLC phases are initiation, development/acquisition, implementation/assessment, operations/maintenance, and disposal, and each maps to specific RMF steps.
The information life cycle — create, store, use, share, archive, destroy — is tracked per data type, not per system, and drives retention, marking, and sanitization requirements.
Records retention schedules are legal obligations that can forbid early deletion just as firmly as privacy rules forbid excessive retention.
Marking requirements travel with the data across every life-cycle stage and every interconnection, which is why they are decided during control selection rather than at disposal.
Last updated: August 2026
System Development Life Cycle and Information Life Cycle Management
CGRC Domain 1 requires demonstrated knowledge of both the System Development Life Cycle (SDLC) and the information life cycle for each data type processed, stored, or transmitted . These are two different clocks running at once. The SDLC governs when governance activities happen to the system; the information life cycle governs what must happen to the data regardless of which system currently holds it.
1. The SDLC and Why RMF Lives Inside It
NIST SP 800-37 Rev. 2 is explicit that the RMF is not a bolt-on compliance exercise executed after a system is built. It is designed to run concurrently with the SDLC . The exam rewards candidates who can place an RMF task in the correct SDLC phase.
SDLC Phase Core Activity Concurrent RMF Work Key Artifacts Started
1. Initiation Define mission need, concept, and high-level requirements. Prepare and Categorize (Steps 0–1). Identify information types and set the FIPS 199 category. Categorization document, initial boundary description, PTA
2. Development / Acquisition Design, code, or procure the system. Select (Step 2). Tailor the baseline; write security and privacy requirements into the contract or design. SSP draft, continuous monitoring strategy, SLAs
3. Implementation / Assessment Build, configure, integrate, and test. Implement and Assess (Steps 3–4). Harden to a baseline; independent assessment. SSP control statements, SAP, SAR, initial POA&M
4. Operations / Maintenance Run the system in production; manage change. Authorize and Monitor (Steps 5–6). Ongoing assessment and change control. ATO decision document, SIA records, ISCM reports
5. Disposal Retire, migrate, or decommission. Monitor task on system disposal. Sanitize media, retain records, revoke authorization. Disposal plan, sanitization certificates, revocation memo
The Cost Curve Argument
The governance case for early integration is economic, and CGRC states it in cost terms. A security requirement identified during initiation is a paragraph in a requirements document. The same requirement discovered during assessment is a redesign; discovered in operations , it is a POA&M item, a compensating control, and an accepted residual risk that the Authorizing Official now carries. Defect-remediation cost rises by roughly an order of magnitude per phase deferred. When an exam item asks for the "most cost-effective" way to address a control gap, the answer almost always involves moving the activity earlier in the life cycle.
Important
Requirements traceability is the mechanism. Security and privacy requirements derived from the tailored baseline must be traceable from the requirements document, through design and code, to the assessment objective that tests them. An untraceable requirement is one that will not be built and will not be tested.
Acquisition Is a Life-Cycle Control Point
When a system is procured rather than built, the leverage point moves to the contract . Security requirements that are not in the statement of work are not enforceable later without a costly modification. This is why SP 800-53 places SA (System and Services Acquisition) controls in the baseline and why supply chain expectations, SBOM delivery, assessment rights, incident-notification timelines, and data-return-and-destruction clauses must be negotiated before award , not after.
2. The Information Life Cycle
The information life cycle is tracked per data type , because a single system routinely holds several types with different legal obligations. A human-resources platform may simultaneously hold personnel records, medical accommodation files, and payroll data — each with different retention, marking, and disposal rules.
Stage Governance Question Typical Control Anchors
Create / Collect Do we have authority and a stated purpose? Is collection minimized? PT-2 (authority), PT-3 (purpose), PT-4 (consent), SA-8
Store Where does it reside, at what impact level, with what encryption? SC-28, MP-4, CP-9 (backups inherit the impact level)
Use / Process Is use limited to the stated purpose? Who can access it? AC-2, AC-6 (least privilege), PT-2
Share / Transmit Is disclosure authorized? Is the receiving party bound by agreement? CA-3, SC-8, AC-21, ISAs/MOUs
- Archive Does the retention schedule require continued custody? AU-11, SI-12, CP-9
- Destroy Has retention expired and is the method appropriate to the media? MP-6, SP 800-88 Rev. 1
- Data Flow Mapping
You cannot protect data whose movement you cannot describe. A data flow map documents where each type enters the boundary, every internal component that stores or processes it, every egress point, and every external party that receives it. This map is what makes three separate obligations satisfiable at once: it feeds the authorization boundary description in Domain 2, it identifies every interconnection requiring an ISA, and it is the evidence base for a Privacy Impact Assessment . Systems whose data flows are undocumented consistently fail assessment because the assessor cannot determine whether the control set is complete.
Retention Cuts Both Ways
Candidates reliably remember that privacy law demands data minimization and prompt deletion. The exam also tests the opposite obligation.
Deleting too late violates minimization and use-limitation principles, and expands breach exposure.
Deleting too early can violate a federal records schedule, a litigation hold, or a statutory retention mandate — a far more serious legal failure.
The governing instrument is the records retention schedule , which is a legal artifact, not a technical preference. When a litigation hold is issued, it overrides the retention schedule and suspends all scheduled destruction for the affected records until counsel releases it. Automated deletion jobs that ignore legal holds are a classic audit finding.
Marking Travels With the Data
Marking and labelling requirements ( Controlled Unclassified Information (CUI) categories , classification banners, privacy designations) are decided during control selection precisely because they must be applied at creation and must persist through every subsequent stage — including archives, backups, exports, and transfers across interconnections. Marking applied only at the point of disclosure is applied too late; by then, unmarked copies already exist in backups and downstream systems.
3. Disposal Is a Governance Event
Disposal is the phase organizations most often execute informally, and it is heavily represented on the exam. A compliant disposal includes: confirming retention obligations are satisfied and no legal hold applies; selecting a sanitization method appropriate to the media type per NIST SP 800-88 Rev. 1 ; obtaining and retaining certificates of sanitization or destruction ; preserving records that must outlive the system; updating the enterprise inventory; and formally revoking the authorization. Handing a drive to a recycler without a certificate leaves the organization unable to prove sanitization occurred — which, from an auditor's perspective, is indistinguishable from not having done it.