Objective
Ensure continuity, vendor and proportionality safeguards are addressed before and after COTS release.
Control Activity
Before release or renewal, Compliance verifies continuity requirements, vendor SLA clauses for patching, support and incident reporting, independent validation of vendor testing, application of CBCS outsourcing safeguards and a documented proportionality rationale with compensating controls. The rationale is reassessed annually and after material change.
Evidence
- Expected evidence: continuity record
- Expected evidence: vendor or SLA record
- Expected evidence: proportionality rationale
- Expected evidence: escalation or validation record where relevant
- Evidence location: source evidence in SYS-ECM-002 Compliance Reporting and Evidence Repository; target Hermes assessment record in Odoo under ISS-HERMES-001.
- Retention: according to the applicable approved policy and Bitkaya record-retention requirements.
- Testing method: sample critical and non-critical COTS products and compare safeguards with their documented risk classification
- Testing frequency: before release or renewal, annually, and after material change
Relationships
- Requirements: REQ-IT-006 Maintain Business Continuity Management, REQ-IT-008 Manage Technology Change Acquisition and Outsourced IT Services
- Process: PRC-RSA-001 Resilience Systems and Assurance
- Procedure: PROC-COTS-008 Manage COTS Continuity, Outsourcing and Proportionality
Assurance
Runtime effectiveness results are maintained in Odoo and assessed through the Hermes workflow tracked in ISS-HERMES-001. This note defines design, ownership, evidence expectations and testing method; it does not contain a manually maintained operation, evidence or overall effectiveness rating.
- Design status: implemented design; runtime effectiveness pending system-derived assessment
History
- 2026-07-26: Normalized evidence metadata and separated design status from runtime effectiveness.
- 2026-07-26: Added the evidence-system relationship required for Hermes assessment mapping.
- 2026-07-26: Created from the approved COTS manual and mapped to CBCS-derived IT requirements.