1.4 System Development Life Cycle and Information Life Cycle Management
Key Takeaways
- The RMF is designed to execute inside the SDLC, not after it: categorization belongs in initiation and control selection in development/acquisition, because retrofitting controls after deployment is the most expensive failure mode CGRC tests.
- The five classic SDLC phases are initiation, development/acquisition, implementation/assessment, operations/maintenance, and disposal, and each maps to specific RMF steps.
- The information life cycle — create, store, use, share, archive, destroy — is tracked per data type, not per system, and drives retention, marking, and sanitization requirements.
- Records retention schedules are legal obligations that can forbid early deletion just as firmly as privacy rules forbid excessive retention.
- Marking requirements travel with the data across every life-cycle stage and every interconnection, which is why they are decided during control selection rather than at disposal.
System Development Life Cycle and Information Life Cycle Management
CGRC Domain 1 requires demonstrated knowledge of both the System Development Life Cycle (SDLC) and the information life cycle for each data type processed, stored, or transmitted. These are two different clocks running at once. The SDLC governs when governance activities happen to the system; the information life cycle governs what must happen to the data regardless of which system currently holds it.
1. The SDLC and Why RMF Lives Inside It
NIST SP 800-37 Rev. 2 is explicit that the RMF is not a bolt-on compliance exercise executed after a system is built. It is designed to run concurrently with the SDLC. The exam rewards candidates who can place an RMF task in the correct SDLC phase.
| SDLC Phase | Core Activity | Concurrent RMF Work | Key Artifacts Started |
|---|---|---|---|
| 1. Initiation | Define mission need, concept, and high-level requirements. | Prepare and Categorize (Steps 0–1). Identify information types and set the FIPS 199 category. | Categorization document, initial boundary description, PTA |
| 2. Development / Acquisition | Design, code, or procure the system. | Select (Step 2). Tailor the baseline; write security and privacy requirements into the contract or design. | SSP draft, continuous monitoring strategy, SLAs |
| 3. Implementation / Assessment | Build, configure, integrate, and test. | Implement and Assess (Steps 3–4). Harden to a baseline; independent assessment. | SSP control statements, SAP, SAR, initial POA&M |
| 4. Operations / Maintenance | Run the system in production; manage change. | Authorize and Monitor (Steps 5–6). Ongoing assessment and change control. | ATO decision document, SIA records, ISCM reports |
| 5. Disposal | Retire, migrate, or decommission. | Monitor task on system disposal. Sanitize media, retain records, revoke authorization. | Disposal plan, sanitization certificates, revocation memo |
The Cost Curve Argument
The governance case for early integration is economic, and CGRC states it in cost terms. A security requirement identified during initiation is a paragraph in a requirements document. The same requirement discovered during assessment is a redesign; discovered in operations, it is a POA&M item, a compensating control, and an accepted residual risk that the Authorizing Official now carries. Defect-remediation cost rises by roughly an order of magnitude per phase deferred. When an exam item asks for the "most cost-effective" way to address a control gap, the answer almost always involves moving the activity earlier in the life cycle.
[!IMPORTANT] Requirements traceability is the mechanism. Security and privacy requirements derived from the tailored baseline must be traceable from the requirements document, through design and code, to the assessment objective that tests them. An untraceable requirement is one that will not be built and will not be tested.
Acquisition Is a Life-Cycle Control Point
When a system is procured rather than built, the leverage point moves to the contract. Security requirements that are not in the statement of work are not enforceable later without a costly modification. This is why SP 800-53 places SA (System and Services Acquisition) controls in the baseline and why supply chain expectations, SBOM delivery, assessment rights, incident-notification timelines, and data-return-and-destruction clauses must be negotiated before award, not after.
2. The Information Life Cycle
The information life cycle is tracked per data type, because a single system routinely holds several types with different legal obligations. A human-resources platform may simultaneously hold personnel records, medical accommodation files, and payroll data — each with different retention, marking, and disposal rules.
| Stage | Governance Question | Typical Control Anchors |
|---|---|---|
| Create / Collect | Do we have authority and a stated purpose? Is collection minimized? | PT-2 (authority), PT-3 (purpose), PT-4 (consent), SA-8 |
| Store | Where does it reside, at what impact level, with what encryption? | SC-28, MP-4, CP-9 (backups inherit the impact level) |
| Use / Process | Is use limited to the stated purpose? Who can access it? | AC-2, AC-6 (least privilege), PT-2 |
| Share / Transmit | Is disclosure authorized? Is the receiving party bound by agreement? | CA-3, SC-8, AC-21, ISAs/MOUs |
| Archive | Does the retention schedule require continued custody? | AU-11, SI-12, CP-9 |
| Destroy | Has retention expired and is the method appropriate to the media? | MP-6, SP 800-88 Rev. 1 |
Data Flow Mapping
You cannot protect data whose movement you cannot describe. A data flow map documents where each type enters the boundary, every internal component that stores or processes it, every egress point, and every external party that receives it. This map is what makes three separate obligations satisfiable at once: it feeds the authorization boundary description in Domain 2, it identifies every interconnection requiring an ISA, and it is the evidence base for a Privacy Impact Assessment. Systems whose data flows are undocumented consistently fail assessment because the assessor cannot determine whether the control set is complete.
Retention Cuts Both Ways
Candidates reliably remember that privacy law demands data minimization and prompt deletion. The exam also tests the opposite obligation.
- Deleting too late violates minimization and use-limitation principles, and expands breach exposure.
- Deleting too early can violate a federal records schedule, a litigation hold, or a statutory retention mandate — a far more serious legal failure.
The governing instrument is the records retention schedule, which is a legal artifact, not a technical preference. When a litigation hold is issued, it overrides the retention schedule and suspends all scheduled destruction for the affected records until counsel releases it. Automated deletion jobs that ignore legal holds are a classic audit finding.
Marking Travels With the Data
Marking and labelling requirements (Controlled Unclassified Information (CUI) categories, classification banners, privacy designations) are decided during control selection precisely because they must be applied at creation and must persist through every subsequent stage — including archives, backups, exports, and transfers across interconnections. Marking applied only at the point of disclosure is applied too late; by then, unmarked copies already exist in backups and downstream systems.
3. Disposal Is a Governance Event
Disposal is the phase organizations most often execute informally, and it is heavily represented on the exam. A compliant disposal includes: confirming retention obligations are satisfied and no legal hold applies; selecting a sanitization method appropriate to the media type per NIST SP 800-88 Rev. 1; obtaining and retaining certificates of sanitization or destruction; preserving records that must outlive the system; updating the enterprise inventory; and formally revoking the authorization. Handing a drive to a recycler without a certificate leaves the organization unable to prove sanitization occurred — which, from an auditor's perspective, is indistinguishable from not having done it.
An agency is drafting the statement of work to procure a commercial case-management platform. At which point does the organization have the greatest practical leverage to impose SBOM delivery, incident-notification timelines, and assessment rights on the vendor?
A records-management automation job is scheduled to purge closed investigative files once their seven-year retention period expires. Agency counsel issues a litigation hold covering a subset of those files two weeks before the purge date. What is the correct governance outcome?
Why does the CGRC body of knowledge require that data marking and labelling requirements be determined during control selection rather than at the point of disclosure?