System Development, Change and Project Management
Domain 7 covers how systems get built and changed, and how projects are governed: the controls that stop unauthorised or untested code reaching production, and the controls that stop projects consuming budget without delivering.
SDLC controls
- Stage gates with defined deliverables, and requirements traceability from design through build to test.
- Environment segregation: development, test, staging and production; developers should not hold production access; non-production data should be masked.
- Testing layers: unit, system integration, user acceptance by the business, performance and security. Entry and exit criteria plus defect severity thresholds make sign-off meaningful.
- Data migration needs record-count and balance reconciliation, cut-off checks and business sign-off.
Change management
- A request for change with risk classification, impact analysis, approval by someone other than the developer, testing evidence, backout plan and scheduled window.
- Segregation between whoever writes code and whoever deploys it. In DevOps this is enforced by pipeline controls rather than by people.
- Emergency changes are legitimate but must be retrospectively reviewed within a defined window; that review is the control.
- Major changes should have a post-implementation review against expected benefits.
Project governance
- Business case with measurable benefits, steering committee, stage-gate funding release, risk log, and independent quality assurance on large programmes.
- Earned value: cost performance index and schedule performance index flag drift early.
- Agile does not remove controls. Approvals move into the backlog, definition of done, sprint review and automated pipeline checks.
Worked example
Ten emergency firewall changes were made in the period. Approvals exist for all ten, but in three cases the approval is timestamped after implementation and no retrospective review was performed. The control is not the emergency route, it is the retrospective review. Failure in three of ten exceeds what can credibly be called isolated, so the finding covers the emergency change process and the review evidence, with the population stated.
Traps
- Accepting UAT performed by IT rather than business users.
- Missing that the change approver is also the developer.
- Assuming agile means no documentation or approvals.
- Auditing the project plan instead of testing stage-gate decisions and benefit tracking.