System development methodologies are structured frameworks that govern how information systems are planned, built, tested, deployed, and maintained. A methodology defines the sequence of activities, roles, artifacts, decision gates, and control checkpoints that transform business requirements into operational systems. In the CISA context, methodologies are not project management conventions — they are the architectural backbone of a control environment: each methodology embeds specific points where risks are identified, controls are validated, and audit evidence is generated. The three primary families are: (1) Sequential/Waterfall — linear phase-gate progression with heavy upfront documentation; (2) Iterative/Agile — time-boxed sprints delivering incremental functionality with continuous feedback; and (3) Hybrid (Water-Scrum-Fall) — waterfall governance framing with agile execution at the delivery layer. Emerging variants include DevOps/continuous delivery, RAD, and low-code/no-code platform models.
Where it stops · what it isn't
- —IS: The governance and control framework surrounding how systems are developed — including methodology selection criteria, control integration architecture, audit evidence requirements, and regulatory mapping.
- —IS: The discipline of matching methodology type to organizational risk profile, regulatory environment, and project characteristics.
- —IS NOT: How to run Scrum ceremonies or write waterfall phase documents — those are methodology execution topics, not methodology governance.
- —IS NOT: Project management methodology (PMI PMBOK, PRINCE2) — though overlap exists, CISA focus is control design and auditability, not schedule and resource management.
- —IS NOT: Software engineering practices (coding standards, design patterns) — those are subsets of what methodologies govern, not the methodology itself.
- —IS NOT: IT service management (ITIL) — ITIL governs changes post-deployment; SDM governs the development process itself.
- —BOUNDARY: Low-code/no-code platforms and AI/ML model development are emerging edge cases where traditional SDM frameworks are insufficiently mapped to current ISACA guidance.
Connected concepts in the graph
Every cubelet sits in a knowledge graph. Here's what this one connects to.
PART OFInformation Systems Acquisition, Development, and Implementation (CISA Domain 3)
ENABLESControl Identification and DesignBusiness Case and Feasibility AnalysisSystem Testing and Quality AssuranceImplementation, Configuration, and Migration Controls
REQUIRESIT Governance Frameworks (COBIT, Risk IT)Internal Control Concepts (COSO)IT Risk Management Fundamentals
RELATED TOProject Governance and ManagementChange Management Controls
CONSTRAINSRegulatory Compliance Architecture (SOX, HIPAA, PCI-DSS, FedRAMP)