Acquire and Implement

To realize the IT strategy, IT solutions need to be identified, developed or acquired, as well as implemented and integrated into the business process. In addition, changes in and maintenance of existing systems are covered by this domain to make sure the solutions continue to meet business objectives. This domain typically addresses the following management questions:
• Are new projects likely to deliver solutions that meet business needs?
• Are new projects likely to be delivered on time and within budget?
• Will the new systems work properly when implemented?
• Will changes be made without upsetting current business operations?

Identify Automated Solutions

The need for a new application or function requires analysis before acquisition or creation to ensure that business requirements are satisfied in an effective and efficient approach. This process covers the definition of the needs, consideration of alternative sources, review of technological and economic feasibility, execution of a risk analysis and cost-benefit analysis, and conclusion of a final decision to ‘make’ or ‘buy’. All these steps enable organizations to minimize the cost to acquire and implement solutions while ensuring that they enable the business to achieve its objectives.

Definition and Maintenance of Business Functional and Technical Requirements

Identify, prioritize, specify and agree on business functional and technical requirements covering the full scope of all initiatives required to achieve the expected outcomes of the IT-enabled investment program.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Risk Analysis Report

Identify, document and analyze risks associated with the business requirements and solution design as part of the organization’s process for the development of requirements.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Feasibility Study and Formulation of Alternative Courses of Action

Develop a feasibility study that examines the possibility of implementing the requirements. Business management, supported by the IT function, should assess the feasibility and alternative courses of action and make a recommendation to the business sponsor.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Requirements and Feasibility Decision and Approval

Verify that the process requires the business sponsor to approve and sign off on business functional and technical requirements and feasibility study reports at predetermined key stages. The business sponsor should make the final decision with respect to the choice of solution and acquisition approach.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Acquire and Maintain Application Software

Applications are made available in line with business requirements. This process covers the design of the applications, the proper inclusion of application controls and security requirements, and the development and configuration in line with standards. This allows organizations to properly support business operations with the correct automated applications.

High-level Design

Translate business requirements into a high-level design specification for software acquisition, taking into account the organization’s technological direction and information architecture. Have the design specifications approved by management to ensure that the high-level design responds to the requirements. Reassess when significant technical or logical discrepancies occur during development or maintenance.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Detailed Design

Prepare detailed design and technical software application requirements. Define the criteria for acceptance of the requirements. Have the requirements approved to ensure that they correspond to the high-level design. Perform reassessment when significant technical or logical discrepancies occur during development or maintenance.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Application Control and Auditability

Implement business controls, where appropriate, into automated application controls such that processing is accurate, complete, timely, authorized and auditable.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Application Security and Availability

Address application security and availability requirements in response to identified risks and in line with the organization’s data classification, information architecture, information security architecture and risk tolerance.

Configuration and Implementation of Acquired Application Software

Configure and implement acquired application software to meet business objectives.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Major Upgrades to Existing Systems

In the event of major changes to existing systems that result in significant change in current designs and/or functionality, follow a similar development process as that used for the development of new systems.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Development of Application Software

Ensure that automated functionality is developed in accordance with design specifications, development and documentation standards, QA requirements, and approval standards. Ensure that all legal and contractual aspects are identified and addressed for application software developed by third parties.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Software Quality Assurance

Develop, resource and execute a software QA plan to obtain the quality specified in the requirements definition and the organization’s quality policies and procedures.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Applications Requirements Management

Track the status of individual requirements (including all rejected requirements) during the design, development and implementation, and approve changes to requirements through an established change management process.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Application Software Maintenance

Develop a strategy and plan for the maintenance of software applications.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Acquire and Maintain Technology Infrastructure

Organizations have processes for the acquisition, implementation and upgrade of the technology infrastructure. This requires a planned approach to acquisition, maintenance and protection of infrastructure in line with agreed-upon technology strategies and the provision of development and test environments. This ensures that there is ongoing technological support for business applications.

Technological Infrastructure Acquisition Plan

Produce a plan for the acquisition, implementation and maintenance of the technological infrastructure that meets established business functional and technical requirements and is in accord with the organization’s technology direction.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Infrastructure Resource Protection and Availability

Implement internal control, security and auditability measures during configuration, integration and maintenance of hardware and infrastructural software to protect resources and ensure availability and integrity. Responsibilities for using sensitive infrastructure components should be clearly defined and understood by those who develop and integrate infrastructure components. Their use should be monitored and evaluated.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Infrastructure Maintenance

Develop a strategy and plan for infrastructure maintenance, and ensure that changes are controlled in line with the organization’s change management procedure. Include periodic reviews against business needs, patch management, upgrade strategies, risks, vulnerabilities assessment and security requirements.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Feasibility Test Environment

Establish development and test environments to support effective and efficient feasibility and integration testing of infrastructure components.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Enable Operation and Use

Knowledge about new systems is made available. This process requires the production of documentation and manuals for users and IT, and provides training to ensure the proper use and operation of applications and infrastructure.

Planning for Operational Solutions

Develop a plan to identify and document all technical, operational and usage aspects such that all those who will operate, use and maintain the automated solutions can exercise their responsibility.

Knowledge Transfer to Business Management

Transfer knowledge to business management to allow those individuals to take ownership of the system and data, and exercise responsibility for service delivery and quality, internal control, and application administration.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Knowledge Transfer to End Users

Transfer knowledge and skills to allow end users to effectively and efficiently use the system in support of business processes.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Knowledge Transfer to Operations and Support Staff

Transfer knowledge and skills to enable operations and technical support staff to effectively and efficiently deliver, support and maintain the system and associated infrastructure.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Procure IT Resources

IT resources, including people, hardware, software and services, need to be procured. This requires the definition and enforcement of procurement procedures, the selection of vendors, the setup of contractual arrangements, and the acquisition itself. Doing so ensures that the organization has all required IT resources in a timely and cost-effective manner.

Procurement Control

Develop and follow a set of procedures and standards that is consistent with the business organization’s overall procurement process and acquisition strategy to acquire IT-related infrastructure, facilities, hardware, software and services needed by the business.

Supplier Contract Management

Set up a procedure for establishing, modifying and terminating contracts for all suppliers. The procedure should cover, at a minimum, legal, financial, organizational, documentary, performance, security, intellectual property, and termination responsibilities and liabilities (including penalty clauses). All contracts and contract changes should be reviewed by legal advisers.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Supplier Selection

Select suppliers according to a fair and formal practice to ensure a viable best fit based on specified requirements. Requirements should be optimized with input from potential suppliers.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

IT Resources Acquisition

Protect and enforce the organization’s interests in all acquisition contractual agreements, including the rights and obligations of all parties in the contractual terms for the acquisition of software, development resources, infrastructure and services.

Manage Changes

All changes, including emergency maintenance and patches, relating to infrastructure and applications within the production environment are formally managed in a controlled manner. Changes (including those to procedures, processes, system and service parameters) are logged, assessed and authorized prior to implementation and reviewed against planned outcomes following implementation. This assures mitigation of the risks of negatively impacting the stability or integrity of the production environment.

Change Standards and Procedures

Set up formal change management procedures to handle in a standardized manner all requests (including maintenance and patches) for changes to applications, procedures, processes, system and service parameters, and the underlying platforms.

Impact Assessment, Prioritization and Authorization

Assess all requests for change in a structured way to determine the impact on the operational system and its functionality. Ensure that changes are categorized, prioritized and authorized.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Emergency Changes

Establish a process for defining, raising, testing, documenting, assessing and authorizing emergency changes that do not follow the established change process.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Change Status Tracking and Reporting

Establish a tracking and reporting system to document rejected changes, communicate the status of approved and in-process changes, and complete changes. Make certain that approved changes are implemented as planned.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Change Closure and Documentation

Whenever changes are implemented, update the associated system and user documentation and procedures accordingly.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Install and Accredit Solutions and Changes

New systems need to be made operational once development is complete. This requires proper testing in a dedicated environment with relevant test data, definition of rollout and migration instructions, release planning and actual promotion to production, and a post-implementation review. This assures that operational systems are in line with the agreed-upon expectations and outcomes.

Training

Train the staff members of the affected user departments and the operations group of the IT function in accordance with the defined training and implementation plan and associated materials, as part of every information systems development, implementation or modification project.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Test Plan

Establish a test plan based on organization-wide standards that defines roles, responsibilities, and entry and exit criteria. Ensure that the plan is approved by relevant parties.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Implementation Plan

Establish an implementation and fallback/backout plan. Obtain approval from relevant parties.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Test Environment

Define and establish a secure test environment representative of the planned operations environment relative to security, internal controls, operational practices, data quality and privacy requirements, and workloads.

System and Data Conversion

Plan data conversion and infrastructure migration as part of the organization’s development methods, including audit trails, rollbacks and fallbacks.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Testing of Changes

Test changes independently in accordance with the defined test plan prior to migration to the operational environment. Ensure that the plan considers security and performance.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Final Acceptance Test

Ensure that business process owners and IT stakeholders evaluate the outcome of the testing process as determined by the test plan. Remediate significant errors identified in the testing process, having completed the suite of tests identified in the test plan and any necessary regression tests. Following evaluation, approve promotion to production.

There are no PSGs published for this topic; however, the topic is under review for future PSGs

Promotion to Production

Following testing, control the handover of the changed system to operations, keeping it in line with the implementation plan. Obtain approval of the key stakeholders, such as users, system owner and operational management. Where appropriate, run the system in parallel with the old system for a while, and compare behavior and results.

Post-Implementation Review

Establish procedures in line with the organizational change management standards to require a post-implementation review as set out in the implementation plan.