C. Standards and Models
Define and describe the ISO 9000 and IEEE software standards, and the SEI Capability Maturity Model Integration (CMMI) for Development, Services, and Acquisition assessment models. (Understand)
BODY OF KNOWLEDGE I.C
T he Software Engineering Institute (SEI) defines a standard as “the formal requirements developed and used to prescribe consistent approaches to acquisition, development, or service,” (SEI 2010). A standard defines a disciplined, consistent approach to software development and other activities through the specification of rules, requirements, guidelines, or characteristics. Standards aim at promoting optimum community or organizational benefit and should be based on the combined results of science, technology, and practical experience.
A standard is used as a basis for comparison when specifying, developing, reviewing, auditing, assessing, or testing a system, process, or product. An organization and/or its personnel comply with standards when a comparison between what the standard says should be done matches with what the organization and/or its personnel are actually doing. Products conform to standards when a comparison between what the standard requires matches with the actual characteristics, content, or status of the product. A standard is usually specified by standard practice, or it is defined by a designated standards body (ISO, IEC, IEEE, OMG, and so on). A standard can specify requirements for an item or activity, including:
At the organizational level, standards make it easier for professionals to move between project and product teams within the organization, reducing the effort required for training. Through the use of standards, the software developed by different groups within the organization is more consistent and uniform, and is therefore easier to integrate and reuse. The fact that everyone involved knows and understands the standard way of acquiring, developing, and/or maintaining the software products, permits a uniform method for reviewing the status of the product and the project.
At the industry level, standards can increase the professionalism of a discipline by providing access to good practices, as defined by experienced practitioners in the software industry. Many companies benchmark the ISO and IEEE standards as a basis for improving their own processes and practices. Standards can also help introduce new technologies and methods into the software industry. For example, the Systems Modeling Language (SysML) Standards from the Object Management Group (OMG 2015) helped introduce a consistent methodology that can be used to specify, analyze, design, verify, and validate object-oriented requirements and designs for systems and systems-of-systems.
It should be noted that guidelines (guides) are different from standards. Both standards and guides are typically issued by some body of authority. However, standards define requirements while guidelines define suggested practices, advice, methods, or procedures that are considered good practice, but are not mandatory requirements.
A model is an abstract representation of an item or process from a particular point of view. A model expresses the essentials of some aspect of an item or process without giving unnecessary detail. The purpose of a model is to enable the people involved to think about, discuss, and understand these essential elements without getting sidetracked by excessive or complex details. Unlike standards, models are communication vehicles and not mandatory requirements. The Capability Maturity Model Integration (CMMI) for Development (SEI 2010) and life cycle models (waterfall, V, or spiral) are examples of models.
ISO 9000 Standards
The “International Organization for Standardization (ISO) is a worldwide federation of national standards bodies (ISO member bodies)” (ISO 2015). ISO developed the 9000 family of standards to define good practice in the area of quality management and quality assurance. These standards define the basic, first level of a quality management system. Their implementation does not guarantee high quality.
Within the ISO 9000 family, the core standards include:
Figure 3.1 Major elements and interactions of an ISO 9001:2015 Quality Management System (ISO 2015).
ISO also provides a set of supporting standards/guidelines to help organizations establish and improve their quality management systems, their processes, or their activities. A list of these supporting standards/guidelines is included in Annex B of the ISO 9001:2015 standard (ISO 2015).
The ISO 9000 family of standards is based on seven quality management principles applicable to any organization including software, manufacturing, and/or service, including: (ISO 2015; ISO 2015a)
The ISO 9001:2015 standard defines the specific set of quality management system requirements that are used by registrars to audit and certify organizations. ISO 9001:2015 takes a process approach, which incorporates the Plan-Do-Check-Act (PDCA) cycle and risk-based thinking. Figure 3.1 illustrates a model of the major clauses of ISO 9001:2015.
Some industries have created industry-specific interpretations, or add-ons, to the ISO 9000 family of standards. This has been done to standardize the interpretation of ISO 9001:2015 for their industry and/or to add industry-specific additional requirements. These industry-specific interpretations also help make certain that auditors are trained in and understand the specific needs of those industries. Examples of industry-specific standards include:
IEEE Software Engineering Standards
The Software and Systems Engineering Standards Committee of the IEEE Computer Society develops and maintains a set of software and system engineering standards. This IEEE standards set is not always used verbatim, but they are used extensively as benchmarks, templates, and examples of industry good practices that organizations tailor to their own specific requirements. For organizations defining their software processes, these standards can provide guidance that minimizes time and effort. These standards can also serve as checklists that help verify that important items are not overlooked.
While ISO 9001:2015 and the CMMI models provide roadmaps for what should occur in a good software quality engineering practice set, the IEEE software and systems engineering standards provide more detailed “how-to” information and guidance. As of the date of this publication, the current list of IEEE software and systems engineering standards includes the following standards that are closely related to the topics of the Certified Software Quality Engineer (CSQE) Body of Knowledge. See the IEEE software and systems engineering standards Web site for the latest versions of these and other IEEE software and systems engineering standards:
It should be noted that in addition to the ISO 9000 family of standards, there are many ISO/IEC Information Technology, Software Engineering, and Systems and Software Engineering standards written/being written through ISO/IEC JTC 1/CS 7. Some of these standards have been adopted by IEEE and others may potentially replace the current IEEE standards listed above in the future. (A list of current ISO/IEC standards can be found at http://www.iso.org/iso/home/store/catalogue_tc/catalogue_tc_browse.htm?commid=45086 .)
Capability Maturity Model Integration (CMMI)
The Software Engineering Institute (SEI) promotes the evolution of software engineering from an ad hoc, labor-intensive activity to a discipline that is well-managed and supported by technology. According to the SEI Web site, principal areas of work for the SEI include:
As part of this work, the SEI established the CMMI models (now supported by the CMMI Institute), which are intended to communicate sets of good practices for use by organizations pursuing enterprise-wide process improvement. The resulting CMMI framework allows for the generation of multiple CMMI models, depending on the representation (staged or continuous), and the disciplines:
In the staged representation, each of the three CMMI models is subdivided into five levels (or stages) that are used to gauge organizational maturity. Each model includes a four-level structure (levels 2 to 5) of good practices designed to improve product and service quality, and project performance. Each level from 2 to 5 in the staged representation of these three CMMI models is made up of process areas, as illustrated in Table 3.1 .
Table 3.1 CMMI staged representation levels and process areas.
Figure 3.2 CMMI definition components.
As illustrated in Figure 3.2 , each CMMI process area is defined using detailed required, expected, and informational components, including:
As an example, the specific goals (SG) and specific practices (SP) for the CMMI for Development measurement and analysis process area are: (SEI 2010)
All three of the CMMI models share the same level-2 and level-3 generic goals (GG) and their associated generic practices (GP): (SEI 2010; SEI 2010a; SEI 2010b)
When assessing an organization’s maturity level, the process areas in the staged representation are cumulative. For example, as illustrated in Figure 3.3 , for an organization to achieve level-2 maturity, it would have to:
Figure 3.3 CMMI for Development level-2 maturity for staged representation.
As illustrated in Figure 3.4 , to move forward and achieve level-3 maturity, which organization would have to:
Since there are no generic level-4 or level-5 goals in the staged representation, to move forward and achieve level-4 maturity, an organization would have to achieve all of the specific goals for all the level-4 process areas by implementing all of the associated specific practices, or acceptable alternative practices, for each of those specific goals. To move forward and achieve level-5 maturity, an organization would have to achieve all of the specific goals for all the level-5 process areas by implementing all of the associated specific practices, or acceptable alternative practices, for each of those specific goals.
Figure 3.4 CMMI for Development level-3 maturity for staged representation.
So far, only the CMMI staged representation has been discussed. In the continuous representation, the same process areas are used. However, instead of the organization being assessed at a maturity level, in the continuous representation each process area is assessed independently at a capability level, designated as level-0 to level-3, and described as follows:
Achieving high maturity is done through the equivalent staging concept. Once all of the level-2 and level-3 process areas from the staged representation have reached level-3 capability, level-4 high maturity is reached by achieving level-3 capability for the organizational process performance and quantitative project management process areas. Once level-4 high maturity is reached, level-5 high maturity is reached by achieving level-3 capability for the causal analysis and resolution and organizational performance management.
People Capability Maturity Model
In addition to the three CMMI models, there is also a People Capability Maturity Model (P-CMM) (SEI 2009). This model provides a roadmap of good practices to help organizations address their critical people issues and improve the processes of managing and developing the organization’s workforce. The People CMMI process areas and process threads are illustrated in Table 3.2.
Table 3.2 People Capability Maturity Model (P-CMM) process areas and process threads. (SEI 2009).