Software Development Life Cycle (SDLC): Phases, Models, Methods and Security Explained

Updated September 2026 · Written and maintained by the Progression Agency strategy team

The software development life cycle is the sequence of phases a piece of software goes through from idea to retirement: planning, requirements, design, development, testing, deployment and maintenance. This guide explains each phase, compares the main SDLC models and methods, and covers the security and tooling that modern teams add to the cycle.

What is the software development life cycle?

The software development life cycle (SDLC) is the structured process teams follow to plan, build, test, release and maintain software. It exists so that requirements are understood before code is written, quality is checked before release, and the software keeps working after launch. Explaining the software development life cycle to a business audience is simple: it is the route from a problem statement to working, supported software, with checkpoints along the way.

The phases of the software development life cycle

Each phase answers a question. Skipping one does not save time; it moves the cost to a later phase where it is more expensive.

1. Planning phase in the software development life cycle

The planning phase defines the business goal, the users, the scope of a first release, the budget and timeline, the team and the main risks. Its output is a project charter or a written first-release scope. This is also where build-versus-buy is decided; see software consulting.

2. Requirements analysis

Requirements describe what the software must do (functional) and how well it must do it (non-functional: performance, security, accessibility, compliance). In agile methods they are captured as user stories and refined continuously rather than frozen up front.

3. Design

Design covers architecture (systems, data model, integrations, hosting), interface design (flows and screens; see UI/UX design) and technical decisions such as frameworks and security controls.

4. Development

Engineers implement the design in code, with version control, code review and automated tests written alongside features. In agile models development happens in sprints that each end with working software.

5. Testing

Unit, integration, end-to-end, performance, security and user acceptance testing verify that the software meets requirements. Modern teams automate most of this and run it on every change.

6. Deployment

The software is released to users: through app stores, web hosting or enterprise distribution, usually via a CI/CD pipeline with staged rollouts and the ability to roll back.

7. Maintenance

Bugs are fixed, dependencies and platforms updated, performance monitored and new features added. Maintenance is the longest phase and where most of the total cost of ownership sits.

Software development life cycle models

An SDLC model is the arrangement of the phases. The models below are the ones you will meet in practice; the right one depends on how well the requirements are known and how costly change is.

Waterfall

Phases run once, in order, each completed before the next starts. It suits well-understood, regulated or contract-fixed projects and fails when requirements change mid-build.

V-model

A waterfall variant that pairs each development phase with a corresponding test phase (requirements with acceptance tests, design with integration tests), common in safety-critical software.

Iterative and incremental

The software is built in repeated cycles, each adding capability. Feedback from one cycle shapes the next, which suits products whose requirements become clear with use.

Spiral

Cycles driven by explicit risk analysis: each loop plans, analyzes risk, builds and evaluates. Used for large, high-risk systems.

Agile (Scrum, Kanban)

All phases run inside short sprints or a continuous flow, delivering working software every few weeks with continuous customer feedback. See agile software development for the manifesto, Scrum roles and events.

DevOps and continuous delivery

Agile extended into operations: automated pipelines integrate, test and deploy every change, with monitoring feeding back into the backlog. Most modern web and mobile teams run an agile-plus-DevOps model.

Software development methods and processes

Methods are the practices used inside a model: how work is planned, reviewed and released. The most common methods of software development today are Scrum, Kanban, Extreme Programming practices such as test-driven development and pair programming, lean software development, and DevOps practices such as continuous integration and continuous delivery.

Security in the software development life cycle

A secure software development life cycle adds security activities to every phase instead of a single audit before release: threat modeling in design, secure coding standards and dependency scanning in development, security testing before deployment and patching in maintenance. The NIST Secure Software Development Framework (SSDF) describes these practices, and the OWASP Top 10 lists the risks most worth designing out.

Software development lifecycle tools

Each phase has tools that make it repeatable. The list below reflects what most modern teams use; the choice matters less than using them consistently.

Which SDLC model should you choose?

Choose by how well you know the requirements and how expensive change is. Fixed-scope, regulated or contractual work suits waterfall or V-model. Products that will change with user feedback, which is most business software, suit agile with DevOps practices. Large systems with unknown risks suit spiral or iterative approaches. Whatever the model, keep the phases and add security to each one.

How Progression Agency runs the software development life cycle

We plan a written first release, refine requirements as user stories, design architecture and interface together, build in two-week sprints with automated tests and code review, release through CI/CD pipelines with staged rollouts, and support the software after launch. See custom software development and mobile app development.

Frequently asked questions