Apply Conditional Practices Based on Criticality and Regulatory Classification

This chapter explains how certain practices apply only to some Applications, based on their business criticality and regulatory classification, and how to determine and document which apply.

What Conditional Practices Are

Most practices in this document apply to every Application. Some, however, are needed only when an Application’s business criticality, regulatory classification, data sensitivity, or exposure requires them. Applying every such practice to every Application would waste effort on low-risk Applications; failing to apply them where needed would leave high-risk Applications exposed. Conditional practices resolve this by making their applicability explicit.

Common Conditional Practices

Common conditional practices include:

• Penetration testing.

• GxP and other regulatory validation.

• Performance and load testing.

• Business continuity and Disaster Recovery testing.

• Special handling of regulated data.

• Accessibility testing, where the Application must meet accessibility obligations or serves users who depend on accessible design.

• Privacy impact assessments, where the Application processes personal information in ways that require them.

• Formal approval workflows for controlled documents, where regulations require them.

These are common examples that IF4IT recommends; enterprises can customize the list and their triggering criteria. The first five have their own chapters in this subsection. The next two are addressed briefly below, and formal approval workflows for controlled documents are addressed in the chapter “Practice ‘All Eyes On The Documentation’ — Open Reading and Writing for All Stakeholders.”

Accessibility Testing

Accessibility testing confirms that people with disabilities can use the Application, for example with screen readers, keyboard-only navigation, or adjusted contrast and text sizes. It is typically triggered when the Application must meet legal or contractual accessibility obligations, or when it serves the public or a workforce that includes users who depend on accessible design. Where it applies, record the accessibility requirements the Application must meet, how and when it was tested, the issues found, and how each was resolved or accepted, and repeat the testing for Releases that change what users see or do.

Privacy Impact Assessments

A privacy impact assessment examines how an Application collects, uses, stores, shares, and disposes of personal information, and identifies privacy risks and the controls that reduce them. It is typically triggered when an Application begins processing personal information, processes it in a new way or at a new scale, or when regulations require it. Where it applies, record the assessment, its findings, the controls adopted, any residual risks and who accepted them, and the date of the next review, and link the assessment to the Application’s regulated data handling.

Establish Conditional Practice Criteria

Define, for each conditional practice, the criteria that make it required, such as a business criticality or service tier, a regulatory classification, the presence of regulated data, or external exposure. Then, for each Application, compare its documented criticality, regulatory classification, data, and exposure against those criteria to determine which conditional practices apply.

Document and Share Applicability

Record, in each Application’s documentation, which conditional practices apply and why, and which do not apply. Review applicability whenever the Application’s criticality, regulatory classification, data, or exposure changes.

Best Practice: Apply Conditional Practices Based on Criticality and Regulatory Classification

It is a best practice to both establish and document the solution for proportionate assurance: define the criteria that trigger each conditional practice, determine for each Application which practices apply based on its criticality and regulatory classification, and record the result and the reasons.

Benefits: Explicit conditional practices concentrate the most demanding assurance effort on the Applications that need it, while sparing low-risk Applications unnecessary work. Recording applicability also proves to auditors that required practices were not overlooked.

Connections to Related IF4IT Practices and Inventories

The GxP Compliance Framework addresses GxP-specific obligations. The Non-Functional Requirements (NFRs) Framework for Software Systems addresses requirements, such as accessibility and performance, that may trigger conditional practices.