ISO/IEC/IEEE 15288:2023 — Systems and Software Engineering: System Life Cycle Processes — Compliance Brief
Record covered: industrial-systems-std-018 Issuing body: ISO/IEC JTC 1/SC 7 (Software and systems engineering) jointly with IEEE. Jurisdiction: Global — the defining international standard for systems-engineering lifecycle processes. Status: Current edition ISO/IEC/IEEE 15288:2023 — second edition, published May 2023, superseding the 2015 edition (verified via national-body listings and SEBoK references).
1. What it is
15288 defines the processes of a system life cycle — from concept to retirement — as a reference model any organization can tailor to its programs. It does not tell you how to engineer; it defines what processes must exist (stakeholder needs definition, requirements, architecture, verification, validation, configuration management, risk management, and so on) and what each process must accomplish. It is the process backbone behind the INCOSE Systems Engineering Handbook and the reference model that acquirers cite when they demand "systems engineering" in a contract. Its software sibling is ISO/IEC/IEEE 12207.
2. Scope — who and what it applies to
Organizations developing or acquiring complex systems — aerospace, defense, automotive, medical, infrastructure, large software-intensive programs. It applies by tailoring: the standard explicitly expects each organization or project to select, adapt, and document the applicable processes — nobody implements all of it verbatim. In practice it is invoked by contract (defense and government acquirers), by certification schemes (INCOSE CSEP's body of knowledge is aligned to it), and by organizations building their internal SE process architecture.
3. Key requirements and compliance obligations
The standard organizes life-cycle processes into four groups:
- Agreement processes: acquisition and supply — the contractual frame between acquirer and supplier.
- Organizational project-enabling processes: life-cycle model management, infrastructure, portfolio, HR, quality, and knowledge management — the enterprise capabilities projects draw on.
- Technical management processes: project planning, assessment and control, decision management, risk management, configuration management, information management, measurement, and quality assurance.
- Technical processes: business/mission analysis, stakeholder needs and requirements definition, system requirements definition, architecture definition, design definition, system analysis, implementation, integration, verification, transition, validation, operation, maintenance, and disposal.
For each process the standard defines purpose, outcomes, and activities. "Compliance" means: your tailored process set produces the defined outcomes with objective evidence (requirements traceability, verification records, risk registers, configuration baselines, decision records). Audits — internal, customer, or certification-body — test for the existence and effectiveness of the processes, not for a certificate on the wall (15288 itself is not a certifiable standard; organizations don't get "15288 certified" the way they get ISO 9001 certified).
4. Penalties / consequences of non-compliance
No statutory penalties. Consequences are contractual and programmatic: failure to operate the required lifecycle processes shows up as failed design reviews, lost bids (acquirers score SE process maturity), corrective-action findings in customer audits, and — at the extreme — program cancellation. In safety-critical domains, the verification/validation and configuration-management processes are also the evidence base for regulatory approval (aviation, medical, nuclear), so weak lifecycle processes compound into certification risk.
5. Version and edition status — live changes
- 2023 second edition is current (May 2023), superseding 2015. The revision reorganized and clarified process definitions and strengthened alignment with the other JTC 1/SC 7 standards.
- Flag: the process-group summary above reflects the standard's stable architecture; a process-by-process delta of 2015→2023 was not verified against the primary text for this brief — consult the official edition for tailoring decisions.
- Companion watch: ISO/IEC/IEEE 12207 (software life cycle), ISO 15289 (information items/documentation), and the INCOSE SE Handbook edition aligned to 15288:2023.
6. Related certifications
- Industrial/Systems — INCOSE Certified Systems Engineering Professional (CSEP) (industrial-systems-cert-008) and Associate (ASEP) (industrial-systems-cert-007): the credentials that directly test 15288-aligned systems-engineering knowledge — the exam body of knowledge is built on this standard's process model.
- Industrial/Systems — PMP (industrial-systems-cert-001): the technical-management process group overlaps heavily with project-management practice; practitioners commonly hold both.
- Industrial/Systems — CEng (industrial-systems-cert-013): UK chartered engineers in systems roles demonstrate competence against lifecycle-process practice.
3b. Tailoring in practice — what the auditor looks for
Tailoring is documented in a process asset or SE management plan that maps each 15288 process to one of: performed as written, adapted (with the adaptation described), or not applicable (with rationale). Customer and certification auditors test three things: (1) coverage — every required outcome has an owning process; (2) evidence — each process produces its information items (ISO/IEC/IEEE 15289 defines the documentation); (3) closure — verification and validation actually trace requirements to test results, and configuration baselines are controlled. The most common audit finding is not a missing process but a process that exists on paper and not in practice — e.g. a risk-management process with an empty risk register. Organizations pursuing CMMI or sector certifications (aviation ARP4754A, automotive ASPICE) typically cross-map their 15288 tailoring to those frameworks once, then maintain the mapping as the single source of truth.
7. Flags and honest caveats
- 15288 is a reference model, not a method — two organizations can both "follow 15288" with very different processes. Contract language should specify the tailored process set and evidence expectations, not just name the standard.
- Do not confuse with ISO 9001 (a certifiable QMS requirements standard) — 15288 describes engineering processes and carries no certification scheme of its own.
Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.