Security Architecture and Engineering · Topic 8 of 8
Information System Lifecycle
Managing the information system lifecycle, from stakeholder needs and requirements through design, verification, operation and secure retirement.
- 3 min
- Security belongs in every lifecycle stage, starting with requirements.
- Verification checks against specifications; validation checks against real needs.
- Functional requirements say what; assurance requirements say how confidence is gained.
What it is
Every system moves through a lifecycle, from the first business need to final retirement. Security must be present at every stage: requirements written in, design reviewed, controls verified, operations monitored and data removed at the end. Security added late costs more and protects less.
How it works
Lifecycle stages and security activities
| Stage | Security activities |
|---|---|
| Stakeholder needs and requirements | Identify security, privacy and compliance needs with the business; classify the data |
| Requirements analysis | Turn needs into testable security requirements |
| Architectural design | Threat modeling, secure design principles, select controls |
| Development / implementation | Secure coding, hardened configurations, protected build environment |
| Integration | Secure interfaces between components, test combined behaviour |
| Verification and validation | Verification: built to the specification. Validation: meets the real need. Security testing and assessment |
| Transition / deployment | Authorization to operate, secure configuration, training, handover |
| Operations and maintenance | Patching, monitoring, change and configuration management, periodic reassessment |
| Retirement / disposal | Migrate or archive data, sanitize media, revoke access and certificates, update inventory |
Verification asks "did we build it right?" (meets the specification). Validation asks "did we build the right thing?" (meets the user's need).
Requirements: functional and assurance
- Functional security requirements say what the system must do (for example "lock an account after five failed attempts").
- Assurance requirements say how confidence will be gained that it does so (testing, reviews, evaluation).
Change and configuration management across the lifecycle
Once a baseline is approved, changes go through change control: request, impact analysis (including security), approval, testing, implementation and documentation. Configuration management keeps the record of what is deployed so audits can compare reality with the approved baseline.
Retirement done right
Retirement is a security event: data must be migrated or archived according to retention rules, media sanitized to match its type and sensitivity, accounts, keys and certificates revoked, firewall rules and DNS entries removed, and the inventory updated. Forgotten systems that still run become unpatched entry points.
Relationship to the software lifecycle
The system lifecycle includes hardware, people, processes and data as well as software. Domain 8 covers the software development lifecycle in detail; this objective focuses on managing the whole system from need to disposal.
A worked scenario
A company retires an old customer portal after moving to a new one. A year later, an attacker breaches the old portal, which was never turned off and still held customer data. Proper retirement would have migrated or archived the data, decommissioned the server, sanitized the storage and removed its DNS records and firewall openings.
How the exam asks about this
- "When should security requirements be defined?" At the start, with stakeholder needs.
- "Which activity confirms the system meets the user's actual need?" Validation.
- "What must happen when a system is retired?" Data handled per retention, media sanitized, access and certificates revoked, inventory updated.
What to remember for the exam
- Security belongs in every lifecycle stage, starting with requirements.
- Verification checks against specifications; validation checks against real needs.
- Functional requirements say what; assurance requirements say how confidence is gained.
- Change and configuration management protect the approved baseline.
- Retirement includes data, media, access, certificates and inventory.
A decommissioned but still running system is a common and avoidable source of breaches. Retirement must be complete and verified.
Common mistakes
Adding security at the testing stage only.
Confusing verification with validation.
Treating retirement as switching off the application while data and access remain.
Check yourself
At which lifecycle stage should security requirements first be identified?
At the stakeholder needs and requirements stage.
What does validation confirm?
That the system meets the real needs of its users.
Name three security tasks when retiring a system.
Sanitize media, revoke accounts, keys and certificates, and archive or migrate data per retention rules.
Topic 8 of 8 in Security Architecture and Engineering
Test yourself on Security Architecture and Engineering
The full ISC2 CISSP question bank has 1,113 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISC2. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.