1.4 System Development Life Cycle and Information Life Cycle Management
Key Takeaways
The RMF is designed to execute inside the SDLC, not after it: categorization belongs in initiation and control selection in development/acquisition, because retrofitting controls after deployment is the most expensive failure mode CGRC tests.
The five classic SDLC phases are initiation, development/acquisition, implementation/assessment, operations/maintenance, and disposal, and each maps to specific RMF steps.
The information life cycle — create, store, use, share, archive, destroy — is tracked per data type, not per system, and drives retention, marking, and sanitization requirements.
Records retention schedules are legal obligations that can forbid early deletion just as firmly as privacy rules forbid excessive retention.
Marking requirements travel with the data across every life-cycle stage and every interconnection, which is why they are decided during control selection rather than at disposal.
System Development Life Cycle and Information Life Cycle Management
CGRC Domain 1 requires demonstrated knowledge of both the System Development Life Cycle (SDLC) and the information life cycle for each data type processed, stored, or transmitted. These are two different clocks running at once. The SDLC governs when governance activities happen to the system; the information life cycle governs what must happen to the data regardless of which system currently holds it.
1. The SDLC and Why RMF Lives Inside It
NIST SP 800-37 Rev. 2 is explicit that the RMF is not a bolt-on compliance exercise executed after a system is built. It is designed to run concurrently with the SDLC. The exam rewards candidates who can place an RMF task in the correct SDLC phase.
| SDLC Phase | Core Activity | Concurrent RMF Work | Key Artifacts Started |
|---|---|---|---|
| 1. Initiation | Define mission need, concept, and high-level requirements. | Prepare and Categorize (Steps 0–1). Identify information types and set the FIPS 199 category. | Categorization document, initial boundary description, PTA |
| 2. Development / Acquisition | Design, code, or procure the system. | Select (Step 2). Tailor the baseline; write security and privacy requirements into the contract or design. | SSP draft, continuous monitoring strategy, SLAs |
| 3. Implementation / Assessment | Build, configure, integrate, and test. | Implement and Assess (Steps 3–4). Harden to a baseline; independent assessment. | SSP control statements, SAP, SAR, initial POA&M |
| 4. Operations / Maintenance | Run the system in production; manage change. | Authorize and Monitor (Steps 5–6). Ongoing assessment and change control. | ATO decision document, SIA records, ISCM reports |
| 5. Disposal | Retire, migrate, or decommission. | Monitor task on system disposal. Sanitize media, retain records, revoke authorization. | Disposal plan, sanitization certificates, revocation memo |
The Cost Curve Argument
The governance case for early integration is economic, and CGRC states it in cost terms. A security requirement identified during initiation is a paragraph in a requirements document. The same requirement discovered during assessment is a redesign; discovered in operations, it is a POA&M item, a compensating control, and an accepted residual risk that the Authorizing Official now carries. Defect-remediation cost rises by roughly an order of magnitude per phase deferred. When an exam item asks for the "most cost-effective" way to address a control gap, the answer almost always involves moving the activity earlier in the life cycle.
Important
Requirements traceability is the mechanism. Security and privacy requirements derived from the tailored baseline must be traceable from the requirements document, through design and code, to the assessment objective that tests them. An untraceable requirement is one that will not be built and will not be tested.
Acquisition Is a Life-Cycle Control Point
When a system is procured rather than built, the leverage point moves to the contract. Security requirements that are not in the statement of work are not enforceable later without a costly modification. This is why SP 800-53 places SA (System and Services Acquisition) controls in the baseline and why supply chain expectations, SBOM delivery, assessment rights, incident-notification timelines, and data-return-and-destruction clauses must be negotiated before award, not after.
2. The Information Life Cycle
The information life cycle is tracked per data type, because a single system routinely holds several types with different legal obligations. A human-resources platform may simultaneously hold personnel records, medical accommodation files, and payroll data — each with different retention, marking, and disposal rules.
| Stage | Governance Question | Typical Control Anchors |
|---|---|---|
| Create / Collect | Do we have authority and a stated purpose? Is collection minimized? | PT-2 (authority), PT-3 (purpose), PT-4 (consent), SA-8 |
| Store | Where does it reside, at what impact level, with what encryption? | SC-28, MP-4, CP-9 (backups inherit the impact level) |
| Use / Process | Is use limited to the stated purpose? Who can access it? | AC-2, AC-6 (least privilege), PT-2 |
| Share / Transmit | Is disclosure authorized? Is the receiving party bound by agreement? | CA-3, SC-8, AC-21, ISAs/MOUs |
| Archive | Does the retention schedule require continued custody? | AU-11, SI-12, CP-9 |
| Destroy | Has retention expired and is the method appropriate to the media? | MP-6, SP 800-88 Rev. 1 |
Data Flow Mapping
You cannot protect data whose movement you cannot describe. A data flow map documents where each type enters the boundary, every internal component that stores or processes it, every egress point, and every external party that receives it. This map is what makes three separate obligations satisfiable at once: it feeds the authorization boundary description in Domain 2, it identifies every interconnection requiring an ISA, and it is the evidence base for a Privacy Impact Assessment. Systems whose data flows are undocumented consistently fail assessment because the assessor cannot determine whether the control set is complete.
Retention Cuts Both Ways
Candidates reliably remember that privacy law demands data minimization and prompt deletion. The exam also tests the opposite obligation.
- Deleting too late violates minimization and use-limitation principles, and expands breach exposure.
- Deleting too early can violate a federal records schedule, a litigation hold, or a statutory retention mandate — a far more serious legal failure.
The governing instrument is the records retention schedule, which is a legal artifact, not a technical preference. When a litigation hold is issued, it overrides the retention schedule and suspends all scheduled destruction for the affected records until counsel releases it. Automated deletion jobs that ignore legal holds are a classic audit finding.
Marking Travels With the Data
Marking and labelling requirements (Controlled Unclassified Information (CUI) categories, classification banners, privacy designations) are decided during control selection precisely because they must be applied at creation and must persist through every subsequent stage — including archives, backups, exports, and transfers across interconnections. Marking applied only at the point of disclosure is applied too late; by then, unmarked copies already exist in backups and downstream systems.
3. Disposal Is a Governance Event
Disposal is the phase organizations most often execute informally, and it is heavily represented on the exam. A compliant disposal includes: confirming retention obligations are satisfied and no legal hold applies; selecting a sanitization method appropriate to the media type per NIST SP 800-88 Rev. 1; obtaining and retaining certificates of sanitization or destruction; preserving records that must outlive the system; updating the enterprise inventory; and formally revoking the authorization. Handing a drive to a recycler without a certificate leaves the organization unable to prove sanitization occurred — which, from an auditor's perspective, is indistinguishable from not having done it.
An agency is drafting the statement of work to procure a commercial case-management platform. At which point does the organization have the greatest practical leverage to impose SBOM delivery, incident-notification timelines, and assessment rights on the vendor?
During operations and maintenance, when continuous monitoring data reveals which vendor obligations matter most
During the independent security control assessment, when the assessor can compel vendor cooperation
During disposal, when the data-return and destruction clauses are finally exercised
During development/acquisition, by writing the requirements into the contract before award
A records-management automation job is scheduled to purge closed investigative files once their seven-year retention period expires. Agency counsel issues a litigation hold covering a subset of those files two weeks before the purge date. What is the correct governance outcome?
The litigation hold supersedes the retention schedule, and destruction of the covered records must be suspended until counsel releases the hold
The retention schedule governs because it is an approved records instrument, so the purge proceeds as scheduled
Both obligations are satisfied by purging the records and retaining only their cryptographic hashes as proof of prior existence
The system owner may proceed with the purge provided a certificate of sanitization is filed with the Authorizing Official
Why does the CGRC body of knowledge require that data marking and labelling requirements be determined during control selection rather than at the point of disclosure?
Because marking requirements are computed automatically from the FIPS 199 availability impact rating once the baseline is approved
Because markings must be applied at creation and persist through storage, archival, backup, and every interconnection, so late marking leaves unmarked copies already propagated
Because only the Authorizing Official may approve markings, and that approval expires if it is granted after the assessment concludes
Because NIST SP 800-88 requires that all media carry a destruction marking before it may be placed into production service
Sections you finish are checked off in the contents.