Purpose
Maintain continuity, outsourcing and proportionality safeguards for COTS software.
Scope
This procedure applies to business continuity support, vendor SLA expectations, third-party testing and proportional controls.
Steps
| # | Action | Details | Evidence |
|---|---|---|---|
| 1 | Confirm continuity requirements | Confirm the software and supporting services meet applicable business-continuity and recovery requirements. | Continuity record |
| 2 | Review vendor contracts | Review vendor contracts for patch-management, support and incident-reporting service levels. | Vendor or SLA record |
| 3 | Validate outsourced testing | Independently validate vendor-provided test results and apply the CBCS outsourcing controls when testing or support is outsourced. | Outsourcing validation record |
| 4 | Classify software and apply proportionality | Classify the software as critical, moderate or low risk and apply the manual’s proportionate testing depth and environment requirements. | Proportionality classification record |
| 5 | Document proportionality rationale | Document the proportionality rationale, role combinations, independence safeguards and compensating controls in the COTS Acceptance Repository. | Proportionality rationale |
| 6 | Reassess proportionality annually | Reassess proportionality annually and after material business, technology or regulatory change. | Reassessment record |
| 7 | Escalate continuity gaps | Escalate continuity, outsourcing or independence gaps before release or renewal. | Escalation or validation record |
Evidence
- continuity record
- vendor or SLA record
- proportionality rationale
- escalation or validation record where relevant
Relationships
- Requirements: REQ-IT-006 Maintain Business Continuity Management, REQ-IT-008 Manage Technology Change Acquisition and Outsourced IT Services
- Policy: POL-COTS-001 Commercial Off-The Shelf Software Acceptance and Testing Manual
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Control: CTRL-COTS-008 Ensure COTS Continuity, Outsourcing and Proportionality Are Addressed
Implementation
- Implementation state: current under the approved COTS Acceptance and Testing Manual version 1.0
- Execution evidence: retained for each applicable release, renewal and annual review
History
- 2026-07-26: Added the evidence-system relationship required for Hermes assessment mapping.
- 2026-07-26: Created from the approved COTS manual and mapped to CBCS-derived IT requirements.