To determine:
Sensitivity (of data) and Criticality (importance to running of business) of the application.
Determine security requirements that must be implemented.
Upon implementation of the security requirement, the Security Officer will then issue a security certification.
After the security certification, management will them accredit the system.
And then the new/updated system can be deployed.