{"description":"Runs on the existing system item. Take a new system from control requirements through testing and acceptance to an evidenced go-live readiness decision. Deliver the reviewed result and open actions to the responsible register owner and the named companion procedure.","edges":[{"id":"e-sdlc-requirements-sdlc-closure","source":"sdlc-requirements","target":"sdlc-closure"}],"isPublic":true,"itemTypeSlug":"system","metadata":{"capabilities":["new-system-implementation"],"controlVerbs":{"UC-SDLC-03":"operates","UC-SDLC-07":"operates"},"controls":["UC-SDLC-03","UC-SDLC-07"],"department":"it","domains":["controls"],"kind":"new-system-implementation","library":{"aliases":[{"source":"studio-seed","sourceTemplateId":"coworkcanvas:template:new-system-implementation"}],"canonicalUrl":"https://workflow-library.com/all/?w=controls-system-implementation-readiness","contentDigest":"sha256:a7d51eb909a2f68f80eba7d33675cadeb83b680914bed3337c87482c46f9ea0c","prerequisites":{"anchorItemType":{"slug":"system"},"evidenceDestinations":[{"description":"Restricted native step results, attached documents, durable item fields and native approvals.","id":"review-evidence"}],"handoffs":[{"direction":"output","name":"Reviewed register result and open actions","sourceTemplateId":"workflow-library:controls-secure-sdlc-phase-gate-program"}],"roles":[{"contribution":"expertise","description":"Business and control sponsor. Confirm requirements and control design.","id":"reviewer-1","nodeIds":["sdlc-requirements"]},{"contribution":"approval","description":"Go-live authority. Approve implementation record.","id":"reviewer-2","nodeIds":["sdlc-closure"]}],"status":"declared"},"provenance":[{"source":"brain/scripts/studio-seed","sourceTemplateId":"coworkcanvas:template:new-system-implementation"}],"releaseId":"sha256:a7d51eb909a2f68f80eba7d33675cadeb83b680914bed3337c87482c46f9ea0c","schemaVersion":1,"sourceTemplateId":"workflow-library:controls-system-implementation-readiness"},"lineOfDefense":"operate","mappingStatus":"mapped","risks":[],"slug":"controls-system-implementation-readiness","source":"coworkcanvas-gallery","standards":[],"teams":["it"]},"name":"New System Implementation (SDLC)","nodes":[{"data":{"instructions":"**Objective**\nConfirm requirements and control design. The reviewer decides from the complete package described below.\n\n**Inputs**\n1. Review the System item, business and functional requirements, the process and data flows the system will serve, applicable framework requirements, the existing control set it replaces, and architecture review output.\n\n**Procedure**\n1. Derive control requirements from the processes and obligations the system will carry rather than from vendor capability, identify controls the system cannot support, and record where a compensating manual control will be required.\n\n**Record in AssureSwarm**\n1. Capture the implementation scope, control requirements traced to processes and obligations, controls the platform cannot support, planned compensating controls, architecture review outcome, and unresolved requirement gaps.\n\n**Exit criteria**\nBusiness and control sponsor provides expertise: Control requirements are derived from obligations rather than from product capability, unsupported controls are named before build, and compensating controls are planned rather than discovered at go-live.","kind":"task","label":"Confirm requirements and control design","requiredApprovals":1},"id":"sdlc-requirements"},{"data":{"controls":["UC-SDLC-03","UC-SDLC-07"],"instructions":"**Objective**\nApprove implementation record. The reviewer decides from the complete package described below.\n\n**Inputs**\n1. Use test strategy and phase plans, executed unit, integration, and user acceptance results, defect logs with severity and status, the UAT tester identities, and the acceptance criteria agreed at requirements.\n2. Use acceptance results and open defects, control requirement coverage, cutover and rollback plans, data conversion readiness, support and monitoring arrangements, and the agreed go-live criteria.\n3. Review all stage records, requirement traceability, executed test evidence, UAT independence, defect dispositions, readiness criteria assessment, and open conditions with owners.\n\n**Procedure**\n1. Inspect executed results per phase, confirm UAT testers are business users by identity rather than by role label, trace open defects to a severity-based acceptance decision, and test the control requirements specifically rather than only functionality.\n2. Test the decision against the criteria agreed at requirements rather than against schedule pressure, confirm rollback is demonstrated rather than documented, verify compensating controls are operating, and record conditions with owners and deadlines.\n3. Trace every control requirement to a test result or a named compensating control, verify conditions carry deadlines, confirm the go decision cites criteria rather than schedule, and return untested control requirements with precise comments.\n\n**Record in AssureSwarm**\n1. Document test phases with executed results and dates, control requirements tested and their outcomes, defects by severity with status, UAT tester identities and independence, acceptance status, and untested requirements.\n2. Record the readiness decision against each criterion, residual risks and their owners, cutover and rollback evidence, compensating controls confirmed operating, conditions with deadlines, and criteria not met.\n3. Capture the authorized reviewer, the summary, accepted readiness decision, go-live date, residual risks and conditions with owners and dates, compensating controls in force, and linked issues raised. Also record implementation summary.\n\n**Exit criteria**\nGo-live authority provides approval: Each phase is evidenced by executed results, UAT independence is demonstrated by identity, control requirements are tested distinctly from functionality, and open defects carry a severity-based decision. An approver accepts that readiness is measured against the pre-agreed criteria, rollback capability is demonstrated, and unmet criteria are carried as conditions with owners rather than waived silently. The authorized reviewer accepts the record as evidence the implementation control operated, and closure implies no assurance over control requirements deferred to post-go-live.","kind":"task","label":"Approve implementation record","requiredApprovals":1},"id":"sdlc-closure"}],"sourceTemplateId":"workflow-library:controls-system-implementation-readiness"}