MP229 Notification of material change to User Systems to include decommissioning

The SEC requires Users to notify the SSC of any new components or functionality to be included in their User System. However, the SEC does not explicitly state that Users must notify the SSC prior to discontinuing a component or functionality from their User System or decommissioning the whole User System. The implicit requirement is being included in the Security Controls Framework (SCF) and that document is being updated to make the requirement explicit.

To align the SEC to the SCF and improve clarity the SEC will be updated under Section G3.9 to reflect the requirement on Users to notify the SSC when a component of their system is being discontinued or decommissioned.

None

Section G ‘Security’