Design and development in service provision industry

I have no experience in the security provider industry. I’m sure the industry has to follow guidelines from regulatory bodies. If they exist, they set a kind of general process to be followed. For example, I found on the internet the OCC Bulletin 2004-20, "Risk Management of New, Expanded, or Modified Bank Products and Services: Risk Management Process,". 

I suppose that the process was updated in 2017 with this - https://www.occ.treas.gov/news-issuances/bulletins/2017/bulletin-2017-43.html So, a possible process can be:

• After validation of the conceptual idea for the product
• List all inputs for design and development (part of due diligence – Step A)
• Follow the process activities (Steps A, B and C)
• Apply controls (reviews, verifications and validations)
• Define product specifications, advance with product registration, 
• Market and distribute new product
• Launch new product
   

The following material will provide you more information:

• The ISO 9001 Design Process Explained - https://advisera.com/9001academy/blog/2013/11/05/iso-9001-design-process-explained/
• About conducting design and development reviews consider - ISO9001 Design Verification vs Design Validation - https://advisera.com/9001academy/knowledgebase/iso9001-design-verification-vs-design-validation/
• ISO 9001:2015 Foundations Course - https://advisera.com/training/iso-9001-foundations-course/