SFS 7: Software Development Lifecycle
Assess how software moves through requirements, design, implementation, testing, release, operation, and decommissioning with traceable changes.
Scope and boundaries
This set covers the delivery process for applications and services, including source control, build inputs, CI/CD pipelines, test execution, release approval, deployment, rollback, and retirement. Its questions should make ownership and the relationship between source changes and delivered artifacts explicit. Evidence may include repository records, pipeline results, and deployment records. Security requirements and risk treatment belong to SFS 8, independent security findings to SFS 9, and interface-specific controls to SFS C.
The sixteen questions
Each SF position is one question. Both positions run from 0 to F.
| SF | Question page | Authoring record |
|---|---|---|
| 0 | SF 0 | 0070 |
| 1 | SF 1 | 0071 |
| 2 | SF 2 | 0072 |
| 3 | SF 3 | 0073 |
| 4 | SF 4 | 0074 |
| 5 | SF 5 | 0075 |
| 6 | SF 6 | 0076 |
| 7 | SF 7 | 0077 |
| 8 | SF 8 | 0078 |
| 9 | SF 9 | 0079 |
| A | SF A | 007A |
| B | SF B | 007B |
| C | SF C | 007C |
| D | SF D | 007D |
| E | SF E | 007E |
| F | SF F | 007F |
From questions to a profile
Only reviewed, accepted 0/1 assessments can populate the sixteen-bit set profile. SF 0 is the most significant bit and SF F the least significant bit. The completed result uses four hexadecimal digits, including leading zeros. A catalog definition does not establish a completed assessment profile.
Read assessment and validation, then encoding. A set profile preserves individual answers; it is not a summed security score.