CGRC · Question #244
What is the 2nd SDLC phase; which maps to the RMF steps 3 & 4 (Implement, Assess)? Response:
The correct answer is B. Operation/Maintenance. The second phase of the System Development Life Cycle (SDLC) is Operation/Maintenance, which aligns with the RMF steps of Implement and Assess. This phase involves deploying the system and continuously monitoring and evaluating its security posture.
Question
What is the 2nd SDLC phase; which maps to the RMF steps 3 & 4 (Implement, Assess)? Response:
Options
- ADevelopment/Acquisition
- BOperation/Maintenance
- CCriticality/Sensitivity
- DMission/business process
How the community answered
(46 responses)- A13% (6)
- B78% (36)
- C7% (3)
- D2% (1)
Why each option
The second phase of the System Development Life Cycle (SDLC) is Operation/Maintenance, which aligns with the RMF steps of Implement and Assess. This phase involves deploying the system and continuously monitoring and evaluating its security posture.
Development/Acquisition is typically the phase before Operation/Maintenance, focusing on building or procuring the system, not primarily on implementation and assessment within an operational context.
In common SDLC models, especially those aligned with federal cybersecurity frameworks, the 'Operation/Maintenance' phase is where the system is deployed and used. This phase naturally maps to the RMF steps of 'Implement' (putting controls in place) and 'Assess' (evaluating control effectiveness) as part of continuous operation and monitoring.
Criticality/Sensitivity refers to information categorization, not an SDLC phase.
Mission/business process is a context for system development, not a specific SDLC phase.
Concept tested: SDLC phases and RMF step mapping
Source: https://csrc.nist.gov/glossary/term/SDLC
Topics
Community Discussion
No community discussion yet for this question.