Page 232

Maintaining the integrity of changes to tools and processes assists effective supply chain risk assessment and mitigation. Such integrity requires configuration control throughout the system development life cycle to track authorized changes and to prevent unauthorized changes. SA-15 (3) DEVELOPMENT PROCESS, STANDARDS, AND TOOLS – QUALITY METRICS Developers of a system, system component, or system service shall: Define quality metrics at the beginning of the development process; and a. Provide evidence of meeting the quality metrics periodically, and at program review milestones and upon delivery. b. Quality metrics are used by organizations to establish acceptable levels of system quality. Metrics may include quality gates to provide clear, unambiguous indications of progress. Quality gates are collections of completion criteria or sufficiency standards representing the satisfactory execution of specific phases of the system development project. Other metrics apply to the entire development project. These metrics can include defining the severity thresholds of vulnerabilities. An example of this would be requiring no known vulnerabilities in the delivered system with a Common Vulnerability Scoring System (CVSS) severity of Medium or High. SA-22 UNSUPPORTED SYSTEM COMPONENTS Agencies must replace system components when support for the components is no longer available from the developer, vendor, or manufacturer. Examples of system components can include, but are not limited to servers, workstations, laptops, and applications. POLICY OWNER Secretary of Office of Information Technology (OIT) MATERIAL SUPERSEDED This is the first State of Alabama System and Services Acquisition Policy. All State agencies and vendors of the State are required to comply with the current implemented version of this policy. System and Services Acquisition Policy GV-PO-P5 Effective Date: 01/31/2025 Date Approved: 01/15/2025 Version: 1 Page #: 10 of 12