Acquisition, Development and Implementation · Topic 3 of 4
Implementation Testing and Release Management
Unit, integration, system, acceptance and regression testing, test data, go-live readiness, and configuration and release management controls.
- 3 min
- Unit, integration, system, UAT: the order of testing.
- Regression testing follows every change.
- Users sign off UAT; management makes the go/no-go decision.
What it is
Testing shows that a system meets its requirements and controls work before it goes live. Readiness checks confirm that people, processes, data and infrastructure are prepared. Configuration and release management make sure the exact, approved and tested version is what reaches production, and that it can be identified and rolled back.
How it works
Levels of testing
| Test | Purpose | Usually done by |
|---|---|---|
| Unit testing | Each program or module works on its own | Developers |
| Integration testing | Modules and interfaces work together | Developers or test team |
| System testing | The whole system meets functional and non-functional requirements (performance, security, recovery) | Test team |
| User acceptance testing (UAT) | The system meets business needs; users formally accept it | Users |
| Regression testing | Changes have not broken existing functions | Test team, often automated |
| Sociability testing | The new system does not harm other systems in the target environment | Test team |
Other terms: black-box testing checks behaviour against requirements without looking at code; white-box testing examines internal logic; alpha and beta testing are early internal and limited external user tests.
Test environment and data
- Testing happens in a separate environment, not production.
- Production data used for testing must be protected; sensitive data should be masked or synthetic data used.
- Test results, defects and their resolution are documented.
- Users sign off UAT; IT alone should not accept a system on the business's behalf.
Go-live readiness
Before release, the project confirms that critical defects are closed, users are trained, support and operations procedures exist, data conversion is ready and verified, and a rollback plan exists. A formal go/no-go decision is taken by management based on this evidence.
Configuration management
Configuration management identifies and records the components of a system (code, settings, infrastructure) and their versions in a baseline, often in a configuration management database (CMDB). It lets the organization know exactly what is running.
Release management
| Control | Purpose |
|---|---|
| Version control | Every change to code is tracked to an author and a request |
| Segregation | Developers do not move their own code to production |
| Approval | Releases are authorized through change management |
| Build integrity | The released package is the one that was tested |
| Rollback | A tested way back if the release fails |
If a question says the code in production differs from the tested version, the weakness is in release and configuration management, not testing.
How the exam asks about this
- "Who should approve user acceptance testing?" The business users or owner.
- "Which test confirms a change did not break existing functions?" Regression testing.
- "Production customer data is copied to the test system." Mask or anonymize it, and control access.
What to remember for the exam
- Unit, integration, system, UAT: the order of testing.
- Regression testing follows every change.
- Users sign off UAT; management makes the go/no-go decision.
- Mask sensitive data used in testing.
- Release management keeps tested, approved code as the only code in production.
Fixing a defect in production directly, outside release management, breaks the link between what was tested and what runs.
Common mistakes
Letting IT sign off acceptance on behalf of users.
Testing with unmasked production data.
Going live without a rollback plan.
Check yourself
What is the purpose of sociability testing?
To confirm the new system does not adversely affect other systems in the target environment.
Who should formally accept a new system?
The business users or system owner, through user acceptance testing.
What does configuration management record?
The components of a system and their versions in a controlled baseline.
Topic 3 of 4 in Acquisition, Development and Implementation
Test yourself on Acquisition, Development and Implementation
The full ISACA CISA question bank has 1,050 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by ISACA. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.