DEV-06 Testing changes
Test each change during development and deployment to a depth matching its risk rating, using suitably qualified staff or state-of-the-art automated testing, involve customers where contracts require it, and rate and rem
4
artefacts
1
held by a system
0
at each review
moderate
to go live
Ticketing / ITSM
where the evidence lives
teal = a system already holds it · olive = produced at each review
system holds itEvidence a system already holds
- Remediation tickets for defects that blocked a deployment decision · Ticketing / ITSM
periodic reviewEvidence produced at each review
none for this control
governing documentDocuments that govern the control
- Test plans and outcomes for a sample of changes drawn across risk categories · Policy repository / GRC workspace
- Qualification evidence for testers or the specification of the automated test tooling · Policy repository / GRC workspace
- Defect severity criteria and the ratings applied to findings · Policy repository / GRC workspace
First move
Start with the 1 of 4 artefacts that already live in a system (Ticketing / ITSM); keep the periodic reviews but log each one as a dated record with a named reviewer.
Common gaps auditors find
- Identical test depth applied to trivial and to high risk changes
- Findings logged without a severity rating, so no criterion exists for the deployment decision
- Known defects deferred indefinitely with no remediation deadline attached
Do this for your whole sheet
Paste the rows you run your controls from and get this mapping for every control at once, with the periodic-review ones flagged and a first move per row. No account for the first run.
Build my evidence sheetDEV-05 Risk assessment, categorisation and prioritisation of changes · DEV-07 Logging of changes