Page 224

mission or business-process planning. Identify, document, and allocate the appropriate amount of resources which are required to protect the system or service as part of the capital planning and investment control process. b. Establish discrete line items for information security and privacy in the budgeting process. c. SA-3 SYSTEM DEVELOPMENT LIFE CYCLE Organizations shall acquire, develop, and manage systems using a System Development Life Cycle (SDLC) that incorporates information security and privacy considerations, including the following: Identify qualified individuals having information security and privacy roles and responsibilities involved in creating the SDLC to ensure the system life cycle activities meet the security and privacy requirements for the State. a. Define and document information security and privacy roles and responsibilities throughout the SDLC. b. Integrate the agency information security and privacy risk management process into SDLC activities. c. A business case justification of custom system development projects shall be required. When proposing the development of custom software, a strong business case shall: Support the rationale for not enhancing current systems i. Demonstrate the inadequacies of packaged solutions ii. Justify the creation of custom software iii. d. A change management program shall be implemented which enables system engineers, architects, and security analysts to expediently perform necessary business functions, yet maintain a controlled, secure, and functioning environment. e. The State/agencies shall plan for End-of-Life (EoL) and End-of-Support dates (EoS) for systems and services to ensure systems and services can receive security patches and updates throughout the system development lifecycle, and that the State is prepared to discontinue the system or service once no longer supported, or when security cannot be ensured. f. Recommended Guidelines: A general SDLC should include the following phases: Initiation i. Acquisition/Development ii. Implementation/Assessment iii. Operations / Maintenance iv. Sunset (disposition) v. a. Each of these five phases should include a minimum set of tasks to incorporate security in the system development process. Including security early in the SDLC will usually result in less expensive and more effective security than retrofitting security into an operational system. b. The following questions should be addressed in determining the security controls required for a system: How mission critical is it? i. c. System and Services Acquisition Policy GV-PO-P5 Effective Date: 01/31/2025 Date Approved: 01/15/2025 Version: 1 Page #: 2 of 12