Transition to the Operational Environment
Certification criterion
When newly introduced/developed or modified systems are transitioned to the operational environment, a controlled procedure must be followed, and executable code must be run in accordance with testing and user acceptance procedures.
Key checkpoints
- Are controlled procedures established and implemented to safely transition newly introduced/developed and modified systems to the operational environment?
- Are response measures prepared for problems that may arise during the transition to the operational environment?
- In the operational environment, are only the files necessary for running the service installed?
Detailed explanation
Controlled procedures must be established and implemented to safely transition newly introduced/developed and modified systems to the operational environment.
- Designating a transition manager other than the developer
- Verifying that testing has been completed
- Transition strategy (phased transition, batch transition, etc.)
- Response measures for problems during transition (rollback measures, measures for retaining the previous version of the system, etc.)
- Approval by the responsible person for the transition
- Preservation and review of records of the transition, etc.
※ When applying a DevOps approach in a cloud environment, apply control measures from a DevSecOps perspective so that safe deployment to the operational environment can be performed according to controlled procedures on the CI/CD pipeline.
Response measures must be prepared for problems that may arise during the transition to the operational environment.
- Rollback measures for cases where the transition of the information system to the operational environment does not proceed smoothly
- Measures for retaining the previous version of the system (software, add-on programs, configuration files, parameters, etc.), etc.
Only the files necessary for running the service must be installed in the operational environment.
- Manage the operational environment so that files unnecessary for running the service, such as unauthorized development tools (editors, etc.), source programs and backups, and business documents, do not exist
Related laws
No individual legal provision directly corresponding to this item is specified.
Evidence (examples)
- Transition procedures
- Transition records (application/approval, testing, transition, etc.)
Nonconformity examples
- When there is no procedure to review/approve the transition of a completed developed/modified source program to the operational environment
- When files unnecessary for running the service (source code or deployment modules, backups, development-related documents, manuals, etc.) exist on the operational server
- When internal guidelines require preparation of a change work request and a change work result report to ensure safe transition/recovery during the transition to the operational environment, but the related documents cannot be verified
- When internal guidelines require internal review and approval when distributing a mobile app to an app market, but a developer distributes it to the app market at will without going through the relevant procedure