Policy 7230A - Department of Administration

12.1.1.3 Required Test and Validation Procedures
To allow for independent testing and validation of vendor claims
regarding the security capabilities of the solution, all acquisition
documents must specify that the vendor must provide the testing and
validation methodology and process used during solution
development:
• Include request for indication of the test and validation
process used for the solution.
• Review all documents prior to issuance to ensure test and
validation requirements have been included.
12.1.1.4 Required Documentation
To allow for thorough independent review of all aspects of the
requested solution, all acquisition documents must specify that
complete system documentation is provided:
• Include request for solution documentation:
o Solution implementation and configuration
documentation.
o Solution operation documentation.
• Review all documents prior to issuance to ensure solution
documentation requirements have been included.
12.1.2. Ensure Responses Include Required Information
All responses to RFP, RFI and RFQ documents should include the requested
security information as well as sufficient system documentation to allow for
independent verification of the security claims made:
12.1.2.1 Security Capabilities
To ensure that solutions that are acquired rather than developed
meet the Agency’s security requirements, all acquisition document
responses must specify the security capabilities of the proposed
system:
• Review responses to ensure that specified security capabilities
are detailed.
• Weight those responses that include the requested
information positively and those that do not include
requested information negatively.
12.1.2.2 Design and Development Process
To ensure that solutions have been constructed using a methodology
that provides definable, consistent and measurable security
capabilities, all acquisition document responses must specify the
solution design and development processes used during the creation
of the proposed system:
43