# What Is SDLC? Phases, Models, and How to Choose One > SDLC is the software development life cycle, from planning to maintenance. Learn the 7 phases, models from waterfall to agile, and how to choose one. **URL:** https://www.ciptadusa.com/blog/sdlc-adalah **Type:** blog **Author:** PT Cipta Dua Saudara **Category:** Engineering **Published:** 2026-10-15 **Cover:** https://www.ciptadusa.com/media/uploads/blog/2026-10/1792062600664-sdlc-adalah-20261015.webp ## Article SDLC stands for Software Development Life Cycle: a phased framework for planning, building, testing, releasing, and maintaining software. IBM defines the SDLC as a structured and iterative methodology that development teams use to build, deliver, and maintain high-quality and cost-effective software systems ([source](https://www.ibm.com/think/topics/sdlc)). Its phases cover planning, requirements analysis, design, coding, testing, deployment, and maintenance. How those phases run depends on the SDLC model you choose, such as waterfall, V-model, iterative, spiral, or agile. This article explains what the SDLC is, why it matters, the seven phases and their deliverables, the main SDLC models and when each fits, how the SDLC relates to DevOps and security, and which documents to ask for when you hire a software development partner. ## What the SDLC Means The SDLC breaks software development into distinct, repeatable, and interdependent phases. Each phase has its own objectives and deliverables that feed the next one ([source](https://www.ibm.com/think/topics/sdlc)). AWS adds that the goal of the SDLC is to minimize project risks through forward planning, by splitting the work into tasks you can assign, complete, and measure ([source](https://aws.amazon.com/what-is/sdlc/)). Two similar terms are worth separating: - **Software development life cycle.** Covers the development and testing of software components. - **System development life cycle.** A broader superset that covers the software, hardware, people, and processes that make up a system, including organizational training and policy changes ([source](https://aws.amazon.com/what-is/sdlc/)). The SDLC is also different from ALM (Application Lifecycle Management). ALM covers the entire life of an application until it is retired, so one application can go through multiple SDLCs during its lifetime ([source](https://aws.amazon.com/what-is/sdlc/)). ## Why the SDLC Matters for Software Projects For a business owner, the SDLC is a way to know what the vendor or internal team is working on, what each step produces, and when a decision is needed. IBM notes that the SDLC helps stakeholders estimate project costs and timeframes, identify challenges, and address risk factors early in the cycle ([source](https://www.ibm.com/think/topics/sdlc)). AWS summarizes the benefits as follows ([source](https://aws.amazon.com/what-is/sdlc/)): - Visibility of the development process for all stakeholders. - More efficient estimation, planning, and scheduling. - Better risk management and cost estimation. - Systematic software delivery. Without clear phases, key decisions such as the first-release scope or the testing standard get made mid-project, and the cost of change grows. If you are building a budget, we break down the cost components in [how much a web app costs](https://www.ciptadusa.com/en/blog/biaya-pembuatan-aplikasi-berbasis-web). ## The 7 SDLC Phases and Their Deliverables IBM summarizes seven key SDLC phases that practitioners broadly agree on ([source](https://www.ibm.com/think/topics/sdlc)): | Phase | Main activities | Deliverable | | --- | --- | --- | | 1. Planning | Define scope, goals, and initial requirements | Initial project plan | | 2. Analysis | Gather and review detailed requirements | Requirements documentation | | 3. Design | Define architecture, interfaces, and database | Software design document (SDD) | | 4. Coding | Write code based on the SRS and SDD | Working software | | 5. Testing | Find and fix bugs and security flaws | Tested software | | 6. Deployment | Release to the production environment | Software available to users | | 7. Maintenance | Fixes, updates, and further development | Maintained new versions | ### 1. Planning The team defines the problem to solve, who the users are, and how the software will interact with other systems. This phase also sets what is out of scope so the project does not balloon. The output can be an initial software requirements specification (SRS) that details functions, resources, risks, and schedule ([source](https://www.ibm.com/think/topics/sdlc)). ### 2. Requirements Analysis High-level ideas become a practical implementation plan: user needs, feasibility testing, compliance and security requirements, and available IT resources. By the end of this phase, the team understands the project's functional and technical specifications ([source](https://www.ibm.com/think/topics/sdlc)). ### 3. Design The team designs the architecture, navigation, user interface, and database, including how the software connects to existing applications. Threat modeling can start here, for example by adding strong authentication when identity theft is judged a significant risk ([source](https://www.ibm.com/think/topics/sdlc)). Prototypes from this phase can be shown to users before any code is written. ### 4. Coding Developers write the code, build supporting APIs and interfaces, and split the project into smaller tasks. Depending on the model, code reviews and testing can already run during this phase ([source](https://www.ibm.com/think/topics/sdlc)). If the team uses AI coding tools, IBM warns that code that is not reviewed carefully can introduce bugs that surface much later in the life cycle. ### 5. Testing The QA team runs unit, integration, system, and acceptance testing (UAT), plus security vulnerability checks. IBM notes that testing can account for almost 33% of system development costs, so the level of testing should be a deliberate decision: too little lets bugs reach production, too much delays the release ([source](https://www.ibm.com/think/topics/sdlc)). ### 6. Deployment The software moves to the production environment. AWS explains that development and testing happen on separate copies (the build or testing environment), so customers can keep using the production version while the software is being changed ([source](https://aws.amazon.com/what-is/sdlc/)). Releases can be gradual, for example a beta for a limited group of users, supported by manuals and training. We cover the technical guardrails in [Next.js security and deployment](https://www.ciptadusa.com/en/blog/nextjs-security-deployment). ### 7. Maintenance The SDLC does not end at go-live. This phase covers updates, patches, new use cases, and fixing bugs that users find ([source](https://www.ibm.com/think/topics/sdlc)). We explain the types of work and cost ranges in [app maintenance cost per month](https://www.ciptadusa.com/en/blog/biaya-maintenance-aplikasi). ## SDLC Models An SDLC model sets the order and repetition of the phases above. IBM lists waterfall, V-model, agile, lean, iterative, spiral, big bang, and RAD as well-known models ([source](https://www.ibm.com/think/topics/sdlc)). ### Waterfall All phases run in sequence, and each new phase depends on the outcome of the previous one. Waterfall brings discipline and a tangible output at the end of each phase, but leaves little room for change once a phase is complete. AWS considers it suitable for small projects where requirements can be pre-defined accurately ([source](https://aws.amazon.com/what-is/sdlc/)). ### V-Model A variation of waterfall, also called the verification and validation model. Each development phase has a matching testing phase, so bugs can be found early. The structure is still linear, which makes it less flexible when requirements change ([source](https://www.ibm.com/think/topics/sdlc)). ### Iterative and Incremental The team starts with a small set of requirements or an initial version (MVP), then refines it through later versions ([source](https://www.ibm.com/think/topics/sdlc)). Risk is easier to manage because requirements can change between iterations, but repeated cycles can lead to scope changes and underestimated resources ([source](https://aws.amazon.com/what-is/sdlc/)). ### Spiral Combines repeated cycles with a sequential flow, with risk analysis in every loop. It suits large and complex projects that require many changes, but it can be expensive for smaller projects with a limited scope ([source](https://aws.amazon.com/what-is/sdlc/)). ### Agile (Scrum and Kanban) Agile runs the SDLC phases in short cycles and releases small, incremental changes. It fits projects where the client is willing and able to take part in regular discussions and progress reviews ([source](https://www.ibm.com/think/topics/sdlc)). Two well-known agile frameworks are: - **Scrum.** Work is organized into fixed-length Sprints of one month or less, starting with Sprint Planning and ending with a Sprint Review and Retrospective ([source](https://scrumguides.org/scrum-guide.html)). - **Kanban.** A continuous workflow without timeboxes; all tasks are shown on a board so the team can see the remaining work ([source](https://www.ibm.com/think/topics/sdlc)). AWS points out the risk of agile: overreliance on customer feedback can lead to excessive scope changes ([source](https://aws.amazon.com/what-is/sdlc/)). ### RAD, Prototyping, and Big Bang RAD (Rapid Application Development) relies on fast prototyping and user feedback instead of long planning, with more regular progress tracking than big bang. Big bang is an informal approach with no planning or requirements analysis; IBM considers it high risk and workable only for small projects with clear parameters ([source](https://www.ibm.com/think/topics/sdlc)). ### SDLC Models at a Glance | Model | Fits | Main risk | | --- | --- | --- | | Waterfall | Stable requirements defined up front | Mid-project changes are costly | | V-model | Stable requirements with strict testing needs | Less flexible | | Iterative | Products that start from an MVP | Scope grows between iterations | | Spiral | Large, complex, high-risk projects | Expensive for small projects | | Agile | Active client reviews, evolving needs | Excessive scope changes | | Big bang | Very small projects with clear parameters | No planning, high risk | This summary is compiled from [IBM](https://www.ibm.com/think/topics/sdlc) and [AWS](https://aws.amazon.com/what-is/sdlc/). ## How to Choose an SDLC Model for Your Project IBM suggests choosing a model based on a few questions: are the requirements clearly defined or likely to change, how complex is the project, and how experienced is the development team ([source](https://www.ibm.com/think/topics/sdlc)). For business projects, add two more questions: 1. **How much time can you give to reviews?** Agile needs a client who is willing to join regular discussions and progress reviews, while waterfall suits stakeholders who want to be involved only at major milestone reviews ([source](https://www.ibm.com/think/topics/sdlc)). 2. **Is the contract fixed-scope or flexible?** A fixed-scope, fixed-price contract requires requirements to be locked early, so it aligns with a sequential approach. A sprint-based or time-based contract leaves room for change between iterations. Models can also be combined: planning and analysis happen up front to lock the first-release scope, then the build runs in sprints. This is the pattern behind our [custom software development](https://www.ciptadusa.com/en/services/software) service: Discover, Design, Build, Ship, and Scale, with two-week sprints and a demo every Friday. ## SDLC, DevOps, and the Secure SDLC DevOps combines and automates the work of software development and IT operations teams through continuous integration and continuous delivery (CI/CD). In DevOps, planning, coding, testing, deployment, and monitoring continue throughout the product's life instead of being separate phases ([source](https://www.ibm.com/think/topics/sdlc)). Security also needs to be part of every phase. NIST notes that few SDLC models explicitly address software security in detail, so secure development practices need to be added to each model. For that purpose, NIST published the Secure Software Development Framework (SSDF), SP 800-218, in February 2022 ([source](https://csrc.nist.gov/pubs/sp/800/218/final)). This approach is known as the secure SDLC or DevSecOps: code reviews, architecture analysis, and penetration testing run throughout the process, not only at the end ([source](https://aws.amazon.com/what-is/sdlc/)). For a list of web application risks to check, see our review of the [OWASP Top 10 2025](https://www.ciptadusa.com/en/blog/owasp-top-10-2025-changes-analysis). ## An Example of the SDLC in a Business Project The following is a hypothetical illustration, not a client case study. A distributor wants to replace spreadsheet-based order tracking with an internal web app. 1. **Planning.** The first release is limited to order entry, delivery status, and a daily report. Accounting integration is moved to the next release. 2. **Analysis.** The team interviews admin, sales, and warehouse staff, then writes an SRS covering the order flow and role-based access. 3. **Design.** Wireframes and a clickable prototype are tested with admin staff before coding. The database design and API are agreed. 4. **Coding.** Modules are built sprint by sprint, with code review on every change. 5. **Testing.** QA runs automated tests, then admin and sales staff run UAT based on real scenarios. 6. **Deployment.** Active orders are migrated, and the app is released to one branch first, then to all branches. 7. **Maintenance.** User-reported bugs are handled, and the accounting integration enters the next SDLC cycle. If an app like this grows into customer records and a sales pipeline, you are building a CRM. We explain its meaning and types in [what is CRM](https://www.ciptadusa.com/en/blog/crm-adalah). ## SDLC Documents to Request from Your Vendor When you hire a software development partner, ask for each phase's deliverables in writing. This list follows the deliverables described by IBM and AWS ([source](https://www.ibm.com/think/topics/sdlc), [source](https://aws.amazon.com/what-is/sdlc/)): - **Project plan and SRS.** Scope, exclusions, schedule, and risks. - **Design document (SDD), wireframes, or prototype.** Architecture, database design, and screen flows. - **Test plan and results.** Including UAT scenarios that you sign off. - **Release notes and deployment guide.** Separate staging and production environments, and a rollback method. - **Technical documentation and code handover.** So another team can continue maintenance. - **Maintenance agreement.** Scope of fixes, response times, and the cost of changes. For a fuller guide to choosing a vendor, read [choosing a software development company in West Java](https://www.ciptadusa.com/en/blog/pilih-jasa-pembuatan-software-jawa-barat-20260907) and [when a business needs custom software](https://www.ciptadusa.com/en/blog/kapan-bisnis-butuh-software-custom-2026). ## FAQ ### What does SDLC stand for? SDLC stands for Software Development Life Cycle. In an information systems context, the same acronym can mean System Development Life Cycle, which has a broader scope ([source](https://aws.amazon.com/what-is/sdlc/)). ### What are the phases of the SDLC? The seven SDLC phases are planning, analysis, design, coding, testing, deployment, and maintenance ([source](https://www.ibm.com/think/topics/sdlc)). AWS describes a six-phase version because requirements gathering is folded into the planning phase ([source](https://aws.amazon.com/what-is/sdlc/)). ### What is the difference between the SDLC and agile? The SDLC is the overall framework of software development phases. Agile is one model for running those phases, in short, repeated cycles. Scrum and Kanban are frameworks within agile. ### Which is better, waterfall or agile? Neither is better for every project. Waterfall fits when requirements are stable and can be defined up front. Agile fits when needs are still evolving and the business side can take part in regular reviews ([source](https://aws.amazon.com/what-is/sdlc/)). ### What is a secure SDLC? A secure SDLC builds security practices into every phase, from design to maintenance. A reference you can use is the NIST Secure Software Development Framework (SP 800-218) ([source](https://csrc.nist.gov/pubs/sp/800/218/final)). ## Build Software with a Process You Can Follow PT Cipta Dua Saudara builds web apps, mobile apps, internal dashboards, and API integrations with phases the client can see: two-week sprints, a demo every Friday, staging and production environments, and a handover of code and documentation. See the details in [custom software development](https://www.ciptadusa.com/en/services/software), start with [IT consulting](https://www.ciptadusa.com/en/services/consulting) if the project scope is not yet clear, or browse [our work](https://www.ciptadusa.com/en/works). For CRM needs, we also develop [Zetta CRM](https://www.ciptadusa.com/en/incubating/zetta-crm), an open-source, self-hosted CRM for AI agent-based workflows. --- *Markdown version of https://www.ciptadusa.com/blog/sdlc-adalah — generated for AI agents and LLM crawlers.*