Standards and Certificates
Software Quality Standards and Certifications
Section titled “Software Quality Standards and Certifications”Numerous international and national standards bodies, professional organizations, and industry groups contribute to the development and promotion of standards related to Software Quality Assurance (SQA) and software engineering.
Key organizations involved include:
- ISO (International Organization for Standardization): Develops a wide range of standards, including the ISO 9000 family (Quality Management Systems) and the ISO/IEC 25000 series (SQuaRE - Systems and software Quality Requirements and Evaluation).
- IEC (International Electrotechnical Commission): Often collaborates with ISO (e.g., ISO/IEC standards) on topics related to electrical and electronic technologies, including software.
- IEEE (Institute of Electrical and Electronics Engineers) Computer Society: Develops numerous standards related to software engineering processes, documentation, and quality.
- National Standards Bodies: Such as ANSI (American National Standards Institute), BSI (British Standards Institution), DIN (German Institute for Standardization), etc.
- Industry-Specific Bodies: Organizations focusing on specific domains (e.g., automotive - AUTOSAR, aerospace - DO-178C) often have their own quality and safety standards.
These standards provide frameworks, guidelines, and requirements for establishing and assessing quality management systems and software development processes. They aim to promote consistency, improve quality, and facilitate communication and trust between suppliers and customers.
Types of SQA Standards
Section titled “Types of SQA Standards”SQA-related standards generally fall into two broad categories:
- Quality Management System (QMS) Standards: Focus on the overall organizational framework for ensuring quality. They define requirements for processes, documentation, resource management, continuous improvement, and customer focus. They specify what needs to be in place for a quality system.
- Process/Practice Standards: Focus on specific activities or processes within the software lifecycle. They provide detailed guidance on how to perform activities like requirements engineering, design, testing, configuration management, etc.
Quality Management System Standards & Models
Section titled “Quality Management System Standards & Models”These standards help organizations establish and demonstrate their capability to consistently deliver products or services that meet customer and regulatory requirements.
- ISO 9001: The internationally recognized standard for generic Quality Management Systems. Applicable to any organization, it requires establishing processes for areas like leadership commitment, planning, resource management, product realization, measurement, analysis, and improvement. Certification to ISO 9001 (currently ISO 9001:2015) demonstrates adherence to these principles.
- Capability Maturity Model Integration (CMMI): Developed by the Software Engineering Institute (SEI) at Carnegie Mellon University (now managed by the CMMI Institute/ISACA). CMMI provides models (e.g., CMMI for Development, CMMI for Services) that describe best practices grouped into process areas. Organizations are appraised against maturity levels (1-5) indicating their process capability and sophistication. While influential, its adoption varies, with Agile methodologies offering alternative improvement paths.
- ISO/IEC 27001: Focuses specifically on Information Security Management Systems (ISMS), crucial for software handling sensitive data.
- SOC 2 (Service Organization Control 2): An auditing procedure ensuring service providers securely manage data to protect the interests of their organization and the privacy of its clients. Relevant for SaaS and cloud providers.
Process/Practice Standards
Section titled “Process/Practice Standards”These provide detailed guidance on specific software engineering activities.
- ISO/IEC/IEEE 12207: Defines processes for the software life cycle, covering acquisition, supply, development, operation, and maintenance.
- ISO/IEC 25000 Series (SQuaRE): Focuses specifically on systems and software quality, defining quality models (like ISO 25010), quality measurement, and quality evaluation processes.
- ISO/IEC/IEEE 29119: A series of standards covering software testing concepts, processes, documentation, and techniques.
- IEEE Standards: A vast collection covering areas like Software Requirements Specifications (IEEE 830 - though now often superseded by Agile practices), Software Test Documentation (IEEE 829), Software Configuration Management Plans (IEEE 828), etc. Many classic IEEE standards provide valuable checklists and structure, even if implemented differently in modern workflows.
The relationship between these standard types is often complementary. An organization might implement an ISO 9001 certified QMS and use specific IEEE or ISO/IEC process standards to guide its development and testing activities within that framework.
| Characteristic | Quality Management Standards/Models | Process/Practice Standards |
|---|---|---|
| Target Unit | The organization’s overall system for managing quality | Specific projects, teams, or activities within the lifecycle |
| Main Focus | Organizational structure, policies, procedures, resources, continuous improvement | Methodologies, steps, inputs, outputs, techniques for specific tasks (e.g., testing, design) |
| Objective | Define ‘What’ constitutes a capable quality system | Define ‘How’ to perform specific software activities |
| Goal | Assure overall organizational capability and consistency; often enables certification/appraisal | Guide effective execution of specific tasks; ensure completeness and rigor of activities |
| Examples | ISO 9001, CMMI, ISO 27001, SOC 2 | ISO/IEC 12207, ISO/IEC 25000 series, ISO/IEC 29119, Various IEEE standards |
Certification and Assessment
Section titled “Certification and Assessment”Organizations often seek certification (e.g., ISO 9001, ISO 27001) or undergo assessments/appraisals (e.g., CMMI, SOC 2 audits) for several reasons:
- Market Requirements: Customers may require suppliers to hold specific certifications.
- Competitive Advantage: Demonstrates commitment to quality and security.
- Internal Improvement: Provides a framework for improving processes and consistency.
- Risk Management: Helps identify and mitigate risks related to quality or security.
Certification typically involves audits by accredited third-party bodies who assess whether the organization’s implemented system meets the requirements of the chosen standard. These certifications require periodic renewal audits to ensure ongoing compliance.
The TickIT initiative, mentioned in the original text, was a specific scheme for applying ISO 9001 to the IT sector, primarily in the UK. While influential, its prominence has waned, and organizations now typically seek standard ISO 9001 certification, potentially supplemented by sector-specific standards or assessments like CMMI, ISO 27001, or SOC 2 depending on their business context.