The purpose of this control is to establish risk and security management practices for the procurement, configuration, and development of Information Management Technology solutions in the Government of Alberta (GoA). The control objectives established in this policy apply whether the solution is developed in house, purchased as Commercial off the Shelf (COTS), open source, or a cloud-based solution (e.g., Software as a Solution (SaaS) or Platform as a Service (PaaS)). All solution delivery, including acquisition and development, regardless of type, must include risk and security management practices in all phases.