Solutions Life Cycle Management

Contact the Information Security Office and ITS prior to investigating, evaluating, selecting, or developing a new solution.

ITS will determine applicable security requirements and provide a preliminary risk assessment.

Any proposed contract will be reviewed and revised in accordance with procurement services procedures under the direction of RIT Procurement Services.

• The solution owner will inform ITS of any changes to the security requirements during development.
• Solutions development, testing, and production should be performed in separate environments.
• Test data should not include Private or Confidential information unless the security controls in test and development are the same as those in production.
• The solution owner should identify solution administrators.

• ITS will conduct a Security Review.
• ITS will perform an appropriate vulnerability assessment and penetration test before solution implementation.

The solution owner is responsible for ensuring that the security impact of any change is evaluated and notify ITS and the Information Security Office accordingly if there is a potential increase in risk.

• The solution owner will ensure that the solution is evaluated at an appropriate interval and retired if appropriate.
• The solution administrator should ensure that Information is retained in accordance with the Records Management Policy, and to accommodate future technology changes that may render the retrieval method obsolete.
• The solution administrator should ensure that Information is disposed of as required by the Information Access and Protection Standard.