SDMP (software development and maintenance procedure)

SDMP stands for software development and maintenance procedure. It is an entry in NATO's Glossary of NATO Acronyms and Abbreviations, published as AAP-15, where the abbreviation is paired with that exact expansion. The glossary links the entry to the NATO Army Standardization Group (NASG).

The term names a procedure that covers two stages of a software product's life: building it and keeping it working afterwards. Canadian suppliers are most likely to meet it in NATO-related work or in a solicitation that borrows NATO vocabulary. The glossary establishes the name and expansion, and the detailed contents of any SDMP come from the document that requires it.

What the NATO glossary entry says

The NATO glossary (AAP-15) lists the entry as "SDMP: software development and maintenance procedure". It also gives the French form, procédure de développement et de maintenance du logiciel. NATO publishes in English and French, so bilingual bid teams can use both forms when searching documents.

The abbreviation appears simply as SDMP. The source does not use a numbered variant.

How SDMP fits into NATO terminology

NATO's official terminology database is NATOTerm. It holds non-classified military and NATO-relevant non-military terminology and is maintained by the NATO Terminology Office within the NATO Standardization Office. Bid teams can check NATO vocabulary on the NATOTerm site.

The glossary ties SDMP to the NASG, so it belongs to NATO's standardization work rather than to a Canadian federal policy. The glossary supplies the name and expansion only. It does not lay out what an SDMP must contain, so a supplier should read the requirement in the specific solicitation or standard that calls for one.

Related Canadian software lifecycle expectations

Canadian federal material does not use the term SDMP in the sources reviewed, but it does address how software is built and maintained. The Government of Canada's Guideline on Service and Digital calls for systems and applications to be designed, deployed, maintained and decommissioned in a secure, accountable and auditable manner. It refers to ITSG-33, ISO/IEC 27034 and OWASP.

The cloud security risk management procedures recommend integrating security procedures into a system development life cycle (SDLC) process. They also cover operations and system maintenance, change control and authorization maintenance.

These are related practices, and they are not definitions of SDMP. They show the kind of lifecycle discipline that Canadian buyers already expect.

What an SDMP means for a supplier bidding on Canadian public contracts

A software development or maintenance requirement does not by itself mean an SDMP is required. No general Canadian procurement rule requiring one was found. Public Services and Procurement Canada's solutions-based informatics professional services supply arrangement is a mandatory method of supply for qualifying solution-based informatics services, but that page does not name SDMP as a requirement.

• Search the solicitation, statement of work and deliverables schedule for "SDMP" and its full expansion.
• If an SDMP is a deliverable, follow the approval process and any NATO or departmental standard the document cites.
• Where it is not mentioned, document your own development, change control and maintenance practices against the security and auditability expectations in the Government of Canada guidance above.