Purpose
Maintain the governance structure, ownership and review rhythm for the COTS acceptance framework.
Scope
This procedure applies to board oversight, management review, owner assignment and governance reporting for COTS acceptance.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Confirm COTS governance baseline | Confirm the current COTS manual, CBCS source mapping, risk appetite and accountable owners. | Governance record |
| 2 | Confirm Board oversight | Confirm the Board reviews COTS-related risk exposure at least annually and that management provides adequate people, tools and test environments. | Board review note |
| 3 | Obtain independent CORF challenge | Obtain independent CORF challenge of material product, ICT, legal and compliance risks and acceptance results. | CORF challenge record |
| 4 | Confirm Internal Audit review | Confirm Internal Audit periodically assesses compliance with the manual and the minimum TMMi Level 2, training and security-testing expectations. | Internal Audit report |
| 5 | Record decisions and exceptions | Record decisions, exceptions and remediation actions in the approved evidence repository and BCMS. | Evidence repository entry |
| 6 | Escalate governance gaps | Raise unresolved governance or independence gaps as issues and track them to closure. | Issue or remediation record |
Evidence
- governance record
- board or management review note
- issue or remediation record where applicable
Relationships
- Requirements: REQ-IT-001 Maintain IT Governance and Oversight, REQ-IT-007 Maintain Software Testing and Release Assurance
- Policy: POL-COTS-001 Commercial Off-The Shelf Software Acceptance and Testing Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Control: CTRL-COTS-001 Ensure COTS Governance and Oversight Is Maintained
Implementation
- Implementation state: current under the approved COTS Acceptance and Testing Manual version 1.0
- Execution evidence: retained for each governance cycle
History
- 2026-07-26: Added the evidence-system relationship required for Hermes assessment mapping.
- 2026-07-26: Created from the approved COTS manual and mapped to CBCS-derived IT requirements.