Definitions
Business Owner
A designated organizational official who "owns" the purpose of the information system and is ultimately accountable for the business function performed by that system and for accepting the risks associated with its operation.
System Development Life Cycle
The System Development Life Cycle (SDLC) is a structured, multi-phase process that guides the development of an information system from initial planning and requirements gathering through to its deployment and ongoing maintenance.
Directive
GNB shall establish, implement, and maintain a formal System and Services Acquisition directive to ensure that security requirements are incorporated into the planning, procurement, development, and lifecycle management of all information systems, products, and services.
Purpose
This directive establishes the foundational governance required to ensure that newly acquired or developed systems and services meet organizational security needs, comply with applicable policies and regulations, and support secure, reliable, and resilient operations.
The objective of the System and Services Acquisition Directive is to ensure that:
- a standardized approach is used during acquisition and development of systems, system components, or system services that incorporates information security considerations via a system development life cycle process
- third-party providers comply with GNB security requirements to protect information
