Canada ITSG-33 - IT Security Risk Management A2-3.7.3: 3.7.3 Specify, develop and test security solutions

The project specifies, builds or acquires the security solutions for the designed mechanisms, applying secure practices to all development and specifying every security configuration parameter in the implementation representation (code, products, network diagrams, build books). It performs and records development security testing, including functional testing of each mechanism traced to the design, and produces operational security procedures (policies, change and patch, configuration and release management, incident management, contingency, periodic assessments, key updates, threat and risk review, compliance audits, risk reporting, disposal) and security installation procedures, including hardening and disaster recovery.