Control Objectives: Systems design, build, and implementation

Approve and authorize the newly implemented system.

Assign the review of custom code changes to individuals other than the code author.

Assign the role of information security management as a part of developing systems.

Audit all modifications to the application being developed.

Conduct a design review at each milestone or quality gate.

Conduct a management level post implementation review.

Conduct a post implementation review when the system design project ends.

Conduct a preliminary investigation before new system development projects begin.

Configure the test environment similar to the production environment.

Correct code anomalies and code deficiencies in custom code and retest before release.

Define and assign the system development project team roles and responsibilities.

Define and document the nature and scope of all new system development projects.

Design the security architecture.

Develop new products based on Best Practices.

Develop new products based on secure coding techniques.

Develop systems and software using industry best practices.

Develop systems in accordance with the system design specifications and system design standards.

Establish and maintain a data conversion plan.

Establish and maintain a database management standard.

Establish and maintain a file requirements definition document.

Establish and maintain a full set of system procedures.

Establish and maintain a physical, electrical, and logical interface specification.

Establish and maintain a processing requirements definition document.

Establish and maintain a program specification guideline document.

Establish and maintain a project control program.

Establish and maintain a project program documentation standard.

Establish and maintain a project team plan.

Establish and maintain a project test plan.

Establish and maintain a security controls definition document.

Establish and maintain a source data collection design specification.

Establish and maintain a system design project management framework.

Establish and maintain a system design specification.

Establish and maintain a system implementation standard.

Establish and maintain a system requirements specification.

Establish and maintain a system use training plan.

Establish and maintain a user-machine interaction specification.

Establish and maintain access rights to source code based upon least privilege.

Establish and maintain an input requirements definition document.

Establish and maintain an output requirements definition document.

Establish and maintain end user support communications.

Establish and maintain identification card or badge architectural designs.

Establish and maintain integrated project plans.

Establish and maintain outsourced development procedures.

Establish and maintain project management standards.

Establish and maintain promoting the system to a production environment procedures.

Establish and maintain session security coding standards.

Establish and maintain system acceptance criteria.

Establish and maintain system conversion procedures.

Establish and maintain system security documentation.

Establish and maintain system testing policies.

Establish and maintain system testing procedures.

Establish and maintain systems design principles, systems design guidelines, and System Development Life Cycle documentation.

Establish and maintain the overall system development project management roles and responsibilities.

Evaluate and determine whether or not the newly developed system meets security requirements.

Evaluate and determine whether or not the newly developed system meets users' system design requirements.

Follow security design requirements when developing systems.

Follow the system development process when upgrading a system.

Formally approve the initiation of each project phase.

Identify accreditation tasks.

Implement security controls into the system during the development process.

Implement security controls when developing systems.

Include a bug tracking system in the Quality Management program.

Include a description of each module and asset in the system design specification.

Include archives and record management standards in the system requirements specification.

Include identified risks and legal requirements in the security controls definition document.

Include participation by each affected user department in the project implementation phase.

Include pertinent legal requirements in the system requirements specification.

Include program documentation standards in the Quality Management program.

Include security requirements in the system design specification.

Include the threats and risks associated with the system development project in the project feasibility study.

Initiate the System Development Life Cycle development phase or System Development Life Cycle build phase.

Initiate the System Development Life Cycle implementation phase.

Initiate the System Development Life Cycle planning phase.

Manage the system implementation process.

Perform Quality Management on all newly developed or modified software.

Perform Quality Management on all newly developed or modified systems.

Perform a final acceptance test prior to implementing a new system.

Perform a risk assessment for each system development project.

Plan and document the Certification and Accreditation process.

Reassess the system design after the product has been tested.

Redesign business activities to support the system implementation.

Remove test information before releasing the system into a production environment.

Restrict production data from being used in the test environment.

Restrict system architects from being assigned as Administrators.

Restrict the development team from having access to the production environment.

Review and approve all custom code test results before code is released.

Review and test custom code to identify potential coding vulnerabilities.

Review and test source code.

Separate the design and development environment from the production environment.

SolMan compliance

Specify appropriate tools for the system development project.

Supervise and monitor outsourced development projects.

Systems design, build, and implementation

Test all software changes before implementation in the production environment.

Train the affected users during development projects, implementation projects, or modification projects.