Key Facts
- Regulator
- ISO/IEC JTC 1/SC 7 (Software and systems engineering), published by ISO, IEC and IEEE
- Latest version
- ISO/IEC/IEEE 15288:2023, Edition 2, Systems and software engineering — System life cycle processes (supersedes the withdrawn 2015 edition)
- Effective
- 16 May 2023
- Official text
- www.iso.org ↗
What is ISO/IEC 15288?
ISO/IEC 15288, often searched as ISO 15288 and formally ISO/IEC/IEEE 15288, is the international standard for system life cycle processes. ISO, IEC and IEEE publish it through ISO/IEC JTC 1/SC 7. It applies to organisations that acquire or supply systems made by humans, from conception through to retirement.
The current version is ISO/IEC/IEEE 15288:2023, Systems and software engineering — System life cycle processes (Edition 2, May 2023), as listed on the ISO standard page. It supersedes the 2015 edition, which is withdrawn. Its project record lists it as published (stage 60.60), with no revision under way.
The standard gives a common framework of process descriptions, with shared terminology, for the life cycle of systems created by humans. It describes processes, not a product or a technology.
A shared vocabulary only helps if both sides of a contract use it.
Why it matters
Buyers and suppliers often mean different things by "design complete" or "ready for use". ISO/IEC 15288 gives both sides one set of process descriptions and terms to point at.
Three features explain why it gets named in projects:
- Common language. The framework and its terminology are the same for every system it covers, so a team can describe its work without inventing its own process names.
- Both sides of the deal. The standard applies to organisations in their roles as both acquirers and suppliers. A buyer can use it to describe what it expects, and a supplier to describe what it delivers.
- Internal or external. It covers the acquisition and supply of systems whether internal or external, so a team building for another department is as much in scope as a firm selling to a customer.
Who it applies to
ISO/IEC 15288 applies to organisations that acquire systems and organisations that supply them, at any stage of a system's life. It anchors ISO 15288 systems engineering, where the unit of work is the system rather than a single piece of software.
The obligation is not stated on the ISO page, and we found no law or regulator that requires the standard. Whether it binds you therefore depends on the contract or internal policy that adopts it, so check the wording of whatever named it to you.
The relationship to ISO 27001 is one of different questions. ISO 27001 asks you to run an information security management system; ISO/IEC 15288 describes how systems are engineered through their life. Holding one does not show conformity with the other. For the management-system side, see our ISO 27001 guide.
The UK position
We found no UK law, regulator or government scheme that names ISO/IEC 15288. A UK firm is most likely to meet it commercially, when a customer or contract uses it to describe life cycle processes for a system. Read the clause that cites it, and note which edition it means.
Key requirements
ISO/IEC 15288 is a process framework, not a checklist of controls. Its structure rests on four points:
- Whole life cycle. The processes cover conception, development, production, utilisation, support and retirement of a system, and the acquisition and supply of systems.
- Any level of system. They can be applied to a system of interest, to its system elements and to systems of systems.
- Not a fixed sequence. The life cycle processes can be applied iteratively and concurrently to a system, and recursively to its system elements.
- Processes about processes. The standard specifies processes that support the definition, control and improvement of the life cycle processes an organisation or project uses.
A process list on a slide is not a life cycle you operate.
ISO 15288 and the V-model
People searching for the ISO 15288 V-model are usually looking for a diagram the standard does not contain. ISO/IEC/IEEE 15288 does not prescribe any particular life cycle model, development method or modelling technique. A V-model is one way to arrange the processes; the standard leaves that choice to you.
Frequently asked questions
Yes. ISO 15288 and ISO/IEC 15288 are shorthand for ISO/IEC/IEEE 15288, published by ISO, IEC and IEEE. The current edition is ISO/IEC/IEEE 15288:2023, which supersedes the withdrawn 2015 edition. When a contract or questionnaire cites ISO 15288 without a year, check which edition it means.
The ISO page for ISO/IEC/IEEE 15288 describes no certification scheme, and the standard is a process framework rather than a management system standard like ISO 27001. We have not verified any assessment route for it. If a customer asks for ISO 15288 certification, ask what evidence they will accept.
ISO/IEC/IEEE 12207 is the software counterpart to ISO/IEC/IEEE 15288. IEEE's listing for the current edition, 12207:2026, says its process purposes and outcomes are fully aligned with 15288:2023, so a team can take activities from either standard for systems with a lot of software in them. Use ISO 15288 when the whole system is the unit of work, and 12207 for the software inside it.
ISO/IEC/IEEE 15288 describes the system life cycle processes. Its companion, ISO/IEC/IEEE 15289, addresses the content of the life cycle process information items, meaning the documentation those processes produce. Use 15288 to define what processes you run and 15289 to decide what the resulting documents should contain.
No, but the two meet at one control. ISO 27001 Annex A 8.25, secure development life cycle, asks you to set and apply rules for developing software and systems securely. ISO/IEC 15288 can describe the life cycle those rules sit in. Holding ISO 27001 still does not show that you engineer systems to ISO/IEC/IEEE 15288, and the reverse is also true.