Purpose
Record the formal acceptance and release decision for a tested COTS product or update.
Scope
This procedure applies to release readiness, approval by management or delegated authority, and documentation of any outstanding risk.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Confirm test completion | Confirm all planned tests are complete and performance, integration, compliance and security acceptance criteria are met. | Test completion record |
| 2 | Confirm defects and vulnerabilities closed | Confirm critical defects are closed and residual vulnerabilities are within approved risk appetite. | Defect and vulnerability closure record |
| 3 | Obtain CORF and dual sign-off | Obtain CORF confirmation before production release and the required dual or delegated release sign-off. | CORF and release sign-off |
| 4 | Record acceptance decision | Record the accepted product version, release scope, decision, approvers, date and any conditions or accepted residual risks. | Approval record |
| 5 | Retain decision in repository | Retain the signed decision with the complete test package in the COTS Acceptance Repository. | Repository entry |
| 6 | Block incomplete releases | Block and escalate release when evidence, approval or acceptance criteria are incomplete. | Escalation or block record |
Evidence
- approval record
- release register entry
- accepted version record
Relationships
- Requirements: REQ-IT-007 Maintain Software Testing and Release Assurance, REQ-IT-008 Manage Technology Change Acquisition and Outsourced IT Services
- Policy: POL-COTS-001 Commercial Off-The Shelf Software Acceptance and Testing Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Control: CTRL-COTS-005 Ensure COTS Release and Acceptance Decision Is Approved
Implementation
- Implementation state: current under the approved COTS Acceptance and Testing Manual version 1.0
- Execution evidence: retained for each release decision
History
- 2026-07-26: Added the evidence-system relationship required for Hermes assessment mapping.
- 2026-07-26: Created from the approved COTS manual and mapped to CBCS-derived IT requirements.