As you can see the following tables mainly classify things into System Development Life Cycle and security risks. Basically we can say one is during the system is being developed. The second is after the system is developed, and is operational.