Ask the application representative to provide tests plans, procedures, and results to ensure they are updated for each application release or updates to system patches.
If the application is a COTS/GOTS product or is composed of only COTS/GOTS products with no custom code, this check does not apply unless the application is being reviewed by or in conjunction with the COTS/GOTS vendor in which case this check is applicable.
1) If test plans, procedures, and results do not exist or are not updated for each application release or updates to system patches, this is a finding. |