Page 230

System developers shall assess for software faults that pose a security risk at all post-design stages of the system development life cycle prior to putting an application into production. The following shall be done: Develop and implement a security and privacy assessment plan. Develop and implement a plan that supports ongoing security and privacy assessments. Testing requirements must be defined and documented for both system development and system integration activities. The plan must include requirements for retesting after significant changes occur. i. Perform security testing/evaluation. Sensitive or confidential data shall not be used for testing purposes, including FTI, unless explicitly approved by OIT or the agency owning the data. 1. Organizations may permit the use of production data during the testing of new systems or systems changes only when no other alternative allows for the validation of the functions and when permitted by other regulations and policies. Data anonymization or data masking tools shall be used if available. 2. If production data is used for testing, the same level of security controls required for a production system shall be used. Produce evidence of the execution of the security and privacy assessment plan and the results of the security testing/evaluation a. Implement a verifiable flaw remediation process. b. Correct flaws identified during security testing/evaluation. c. 3. ii. a. Teach and encourage software fault-reporting procedures through security training and awareness programs. b. Designate a quality control team that consistently checks for faults and that is responsible for reporting them to software support. c. Use a formal recording system for the following: Tracking faults from initial reporting through to resolution. i. Monitoring the status of reported faults and confirms that satisfactory resolutions have been achieved. ii. Providing reports and metrics for system development and software support management. iii. Addressing and prioritizing prompt resolution of software faults to minimize the exposure resulting from the security vulnerability. iv. d. While faults are being tracked through to resolution, research shall also be conducted to ensure no security controls have been compromised and resolution activities have been appropriately authorized. e. Perform unit, integration, and system regression testing/evaluation: Require that information system developers/integrators perform a vulnerability assessment to document vulnerabilities, exploitation potential, and risk mitigations. i. Appropriate testing and assessment activities shall be performed after vulnerability mitigation plans have been executed to verify and validate that the vulnerabilities have been successfully addressed. ii. To maintain the integrity of information technology systems, software shall be evaluated and certified for functionality in a test environment before it is used in an iii. f. System and Services Acquisition Policy GV-PO-P5 Effective Date: 01/31/2025 Date Approved: 01/15/2025 Version: 1 Page #: 8 of 12