Page 231

operational/production environment. Test data and accounts shall be removed from an application or system prior to being deployed into a production environment if the application or system does not have a dedicated testing environment. iv. Qualified personnel must certify that the upgrade or change has passed acceptance testing. v. A rollback plan must be established in the event the upgrade or change has unacceptable ramifications. vi. The following issues and controls shall be included when developing acceptance criteria and acceptance test plans: Capacity requirements - both for performance and for the computer hardware needed. i. Error response - recovery and restart procedures and contingency plans. ii. Routine operating procedures - prepared and tested according to defined policies. iii. Security controls - agreed to and put in place. iv. Manual procedures - effective and available where technically configurable and appropriate. v. Business continuity - meets the requirements defined in the business continuity plan. vi. Impact on production environment - able to demonstrate that installation of new system will not adversely affect current production systems (particularly at peak processing times). vii. Training - of operators, administrators, and users of the new or updated system. viii. Logs - logs of results shall be kept for a defined period once testing is completed. ix. g. Implement a verifiable flaw remediation process to correct security weaknesses and deficiencies identified during the security testing and evaluation process. h. Controls that have been determined to be either absent or not operating as intended during security testing/evaluation must be remediated. i. SA-15 DEVELOPMENT PROCESS, STANDARDS, AND TOOLS Developers of a system, system component, or system service shall follow a documented development plan that: Explicitly addresses security requirements; a. Identifies the standards and tools used in the development process; b. Documents the specific tool options and tool configurations used in the development process; and c. Documents, manages, and ensures the integrity of changes to the process and/or tools used in development. d. The development process, standards, tools, tool options, and tool configurations to determine if the process, standards, tools, tool options, and tool configurations selected and employed can satisfy security and privacy requirements. Development tools include, for example, programming languages and computer-aided design systems. Reviews of development processes can include, for example, the use of maturity models to determine the potential effectiveness of such processes. System and Services Acquisition Policy GV-PO-P5 Effective Date: 01/31/2025 Date Approved: 01/15/2025 Version: 1 Page #: 9 of 12