There are well established change control procedures in place, which include change reviews, Change Advisory Board meetings, pre- and post-implementation testing Information security is a part of all stages of the system development life cycle, including requirements gathering, planning and implementation, quality assurance and testing stages of new systems.