Objective
Ensure acceptance evidence is retained and ongoing testing is performed for COTS updates and patches.
Control Activity
Compliance reviews the COTS Acceptance Repository for complete risk, test, defect, approval and proportionality records; confirms regression testing for applicable patches and updates; tracks periodic TMMi assessments; and ensures an external audit or TMMi quick scan occurs at least every three years.
Evidence
- Expected evidence: repository record
- Expected evidence: regression test record
- Expected evidence: periodic review or external assessment record
- Evidence location: source evidence in SYS-ECM-002 Compliance Reporting and Evidence Repository; target Hermes assessment record in Odoo under ISS-HERMES-001.
- Retention: according to the applicable approved policy and Bitkaya record-retention requirements.
- Testing method: sample repository entries for completeness and inspect the assessment schedule and remediation tracking
- Testing frequency: quarterly repository review, after each material update, and three-year external assessment cycle
Relationships
- Requirements: REQ-IT-003 Maintain IT Service Management, REQ-IT-007 Maintain Software Testing and Release Assurance
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Procedure: PROC-COTS-006 Maintain COTS Acceptance Repository and Ongoing Testing
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: implemented design; runtime effectiveness pending system-derived assessment
History
- 2026-07-26: Normalized evidence metadata and separated design status from runtime effectiveness.
- 2026-07-26: Added the evidence-system relationship required for Hermes assessment mapping.
- 2026-07-26: Created from the approved COTS manual and mapped to CBCS-derived IT requirements.