What are the key components of a documented Software Development Life Cycle (SDLC)?

A documented Software Development Life Cycle (SDLC) should include key components such as code storage, deployment processes, change management, and compliance considerations. These elements help ensure consistency, quality, and security in software development.

Code Storage and Deployment

One of the foundational elements of any SDLC is understanding where your code is stored and how it is deployed. Brad pointed out that "where is code stored and how is code deployed or built and deployed if it has to get built" are the bare minimum requirements for an SDLC ▶ 28:01. This ensures that everyone on the team is working from the same version of the code and that there is a clear process for moving code from development to production.

At HealthCo, Scott observed a robust SDLC already in place, which was appreciated for its clarity in deployment processes. The team used the SDLC as a tool for retrospectives, allowing them to address any issues that arose during deployment by referring back to the documented processes ▶ 11:03. This highlights the importance of having a well-documented process that can be reviewed and refined over time.

Change Management

Managing changes in the software is another critical component of the SDLC. This involves not only how changes are made but also how they are validated and approved. Scott emphasized the need for a "trace log" or digital paper trail to track changes, ensuring that each change is authorized and reviewed ▶ 18:25. This is particularly important for maintaining code quality and meeting compliance requirements.

In smaller teams, this might be as simple as having one team member review another's code before it is merged. In larger organizations, there might be more formal processes involving multiple reviewers or automated checks. The key is to have a consistent process that everyone follows.

Compliance Considerations

Compliance is a significant driver for documenting an SDLC, especially in industries like healthcare or finance where data security is paramount. Brad noted that compliance regimes like SOC 2 or HIPAA often require documentation of the software development process to ensure data security ▶ 16:14. This includes having clear policies on who can make changes to the system and how those changes are tracked and approved.

At HealthCo, the SDLC was used not only for compliance but also to ensure high-quality software production. The preamble of their SDLC acknowledged the complexity of software development and aimed to standardize processes to minimize ambiguity and improve quality ▶ 12:35.

Continuous Improvement

An effective SDLC is not static; it evolves as the team learns and grows. Scott shared how HealthCo had a process for quarterly amendments to the SDLC, allowing the team to incorporate lessons learned from retrospectives into their documented processes ▶ 11:50. This continuous improvement approach ensures that the SDLC remains relevant and effective as the team and technology landscape change.

Brad and Scott both agree that starting with documenting what is already being done is a practical first step. This can then be refined and expanded as needed, incorporating new best practices and addressing any gaps identified during retrospectives or audits.

Upstream Processes

While the SDLC often focuses on the technical aspects of software development, it should also consider upstream processes such as requirements gathering and feature definition. Brad emphasized the importance of having clear feature briefs or project charters before diving into technical design ▶ 41:50. This ensures that the team is building the right thing and that there is a shared understanding of what the final product should look like.

Scott added that having a detailed implementation plan or technical design document is crucial for translating these requirements into actionable development tasks ▶ 44:30. This helps prevent miscommunication and ensures that everyone is aligned on the project's goals and how to achieve them.

Conclusion

A well-documented SDLC is essential for any software development team, providing a framework for consistency, quality, and compliance. By clearly defining processes for code storage, deployment, change management, and compliance, teams can ensure that their software is developed efficiently and securely. Continuous improvement and attention to upstream processes further enhance the effectiveness of the SDLC, helping teams deliver high-quality software that meets both business and regulatory requirements.

In their words

Brad put it this way: "What are the typical features we would expect to see in a basic SDLC?" ▶ 0:00. Brad put it this way: "She's incredibly smart and deliberate in her creativity." ▶ 6:07.