Purpose
Maintain training, monitoring and continuous improvement for the COTS framework.
Scope
This procedure applies to training programs, KPI and KRI monitoring, reporting and lessons learned.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Maintain role-based training program | Maintain a role-based training program covering test design and execution, COTS acceptance, security and risk-based testing, and AML/CFT compliance impacts. | Training record |
| 2 | Deliver and evaluate training | Deliver training through workshops, mentoring, vendor-led sessions or relevant certification and evaluate its effectiveness annually. | Training evaluation record |
| 3 | Monitor KPIs and KRIs | Monitor approved KPIs and KRIs for test progress, product quality, defects, deviations and overdue remediation. | Monitoring report |
| 4 | Report deviations to Board | Report material deviations, incidents and quality gaps to the Managing Board and Supervisory Board. | Board reporting record |
| 5 | Record lessons learned | Record lessons learned and post-implementation findings and assign framework-improvement actions. | Lessons learned record |
| 6 | Escalate competence gaps | Escalate material gaps in competence, monitoring or reporting. | Escalation record |
Evidence
- training record
- monitoring report
- lessons learned or improvement record
Relationships
- Requirements: REQ-IT-001 Maintain IT Governance and Oversight, REQ-IT-007 Maintain Software Testing and Release Assurance
- Policy: POL-COTS-001 Commercial Off-The Shelf Software Acceptance and Testing Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Control: CTRL-COTS-007 Ensure COTS Training, Monitoring and Continuous Improvement Occur
Implementation
- Implementation state: current under the approved COTS Acceptance and Testing Manual version 1.0
- Execution evidence: retained for each training and monitoring cycle
History
- 2026-07-26: Added the evidence-system relationship required for Hermes assessment mapping.
- 2026-07-26: Created from the approved COTS manual and mapped to CBCS-derived IT requirements.