Standard
Software Evaluation, Acceptance and Lifecycle Management Standard
This standard defines the governance, evaluation, and control requirements for acquiring, testing, approving, deploying, maintaining, and retiring software across the organization. It ensures that all software introduced into the environment is secure, licensed, compliant, and operationally validated before enterprise use, in accordance with the organization's risk, compliance, and change management framework.
- Type
- Standard
- Version
- 1.0.13
- Date
- 2026-09-24
- Owner
- Chief Information Officer
- Approving authority
- Chief Information Officer
- Classification
- Public
- Confidentiality
- Public
- Category
- Developer Security
- Review frequency
- Annual and upon material platform or regulatory change
- Licence
- CC BY-SA 4.0
Read the full text on GitHub (opens in a new tab)
Outline
- 1. Purpose
- 2. Scope
- 3. Governance and accountability
- 4. Evaluation and testing
- 5. Security and compliance review
- 6. Acceptance and approval for use
- 7. Deployment and configuration control
- 8. Patch and update management
- 9. Software inventory and version control
- 10. Ongoing review and retirement
- 11. Framework alignment
Frameworks it maps to
- ISO/IEC/IEEE 12207:2026
- ISO/IEC 27001:2022
- ISO/IEC 27002:2022
- ISO/IEC 25010
- COBIT 2019
- NIST SP 800-53 Rev. 5
- CSA CCM v4.1
Related documents
- Acceptance Into Service Policysecurity
- Secure Development and Engineering Policydev-security
- AI and Agentic Development Security Standardai
- Patch Management Procedureoperations
- Enterprise Governance and Risk Management Policyrisk
Next
All Documents