Relevant Norms and Standards
Total Page:16
File Type:pdf, Size:1020Kb
Appendix A Relevant norms and standards A.1 A Short Overview of the Most Relevant Process Standards There is a huge number of different process standards, and Fig. A.1 contains an overview of the most relevant such standards as covered in this book, showing the topics covered. A more extensive list of the relevant standards will be provided in the following section below. ISO/IEC 15504, ISO 19011 ISO/IEC 330xx Auditing man- agement systems Process Process assessment ISO/IEC 20000-1 ISO 9001 ISO/IEC 15504-6 ISO/IEC 15504-5 Service management QM system re- System life cycle PAM Software life cycle PAM Assessments, audits Criteria system requirements quirements ISO/IEC/IEEE 15288 ISO/IEC/IEEE 12207 ITIL System life cy- Software life cy- IT Infrastruc- cle processes cle processes ture Library COBIT Life cycle processes SWEBoK Software engineering Funda- Body of Knowledge mentals ISO/IEC/IEEE 24765 ISO 9000 Systems and SW Engineering Vocabulary QM fundamentals (SEVOCAB) and vocabulary Vocabulary Systems Software Organzational IT Quality Management Engineering Engineering Fig. A.1 Overview of the most important standards for software processes © Springer Nature Switzerland AG 2018 327 R. Kneuper, Software Processes and Life Cycle Models, https://doi.org/10.1007/978-3-319-98845-0 328 A Relevant norms and standards A.2 ISO and IEC Standards The International Organization for Standardization (ISO) is the main international standard-setting organisation, working with representatives from many national standard-setting organisations. Standards referring to electrical, electronic and re- lated technologies, including software, are often published jointly with its sister organisation, the International Electrotechnical Commission (IEC), but IEC also publishes a number of standards on their own. Recently, ISO and IEC started to publish relevant standards jointly with the US- American Institute of Electrical and Electronics Engineers (IEEE). IEEE also pub- lished a number of relevant standards on their own, see Sect. A.3. The following table lists the main standards that are relevant in the context of software processes. The editions are the latest editions of these standards at the time of writing. The list is ordered by the numbers of the standards, independent of the exact organisation(s) that published it. Many of the norms and standards in this list were also re-published by other national and international organisations, sometimes after translation into another language. For example, the norm ISO 9001 listed below was also published as a European norm EN ISO 9001, and as a German national norm DIN EN ISO 9001 (and similarly in many other countries as well). “TR” in the identification of a standard shows that this document is published by ISO as a technical report as opposed to an international standard. Similarly, “TS” identifies a technical standard issued by ISO. The year at the end of the ID of any of these standards, after the colon, defines the year when this standard was released. In general, ISO and IEC standards must be bought and tend to be fairly expensive. However, some of the following standards are available for free download from the ISO web page at [5]. These standards are marked (*) in the list below. ISO 9000:2015 Quality management systems—Fundamentals and vocabu- lary ISO 9001:2015 Quality management systems—Requirements ISO 9004:2009 Managing for the sustained success of an organization—A quality management approach ISO/IEC 9126:2001 Software engineering—Product quality—Part 1: Quality model (replaced by ISO/IEC 25010, see below) ISO/IEC/IEEE 12207:2017 Systems and software engineering—Software life cy- cle processes ISO/IEC 13719-1:1998 Information technology—Portable Common Tool Envi- ronment (PCTE)—Part 1: Abstract specification ISO 13849-1:2015 Safety of machinery—Safety-related parts of control sys- tems—Part 1: General principles for design ISO 13849-2:2012 Safety of machinery—Safety-related parts of control sys- tems—Part 2: Validation ISO/IEC/IEEE 15288:2015 Systems and software engineering—System life cy- cle processes A.2 ISO and IEC Standards 329 ISO/IEC 15408-1:2009 Information technology—Security techniques—Evalua- tion criteria for IT security—Part 1: Introduction and gen- eral model (*) ISO/IEC 15408-3:2008 Information technology—Security techniques—Evalua- tion criteria for IT security—Part 3: Security assurance components (*) ISO/IEC 15504-1:2011 Information technology—Process assessment—Part 1: Concepts and vocabulary (replaced by ISO/IEC 33001, see below) ISO/IEC 15504-2:2011 Information technology—Process assessment—Part 2: Performing an assessment (replaced by ISO/IEC 33002, see below) ISO/IEC 15504-5:2012 Information technology—Process assessment—Part 5: An exemplar software life cycle process assessment model ISO/IEC 15504-6:2013 Information technology—Process assessment—Part 6: An exemplar system life cycle process assessment model ISO/IEC TS 15504-8:2012 Information technology—Process assessment—Part 8: An exemplar process assessment model for IT service man- agement ISO/IEC 15939:2017 Systems and software engineering—Measurement process ISO/TS 16949:2009 Quality management systems—Particular requirements for the application of ISO 9001:2008 for automotive produc- tion and relevant service part organizations. (Withdrawn and replaced by IATF 16949:20161) ISO 19011:2011 Guidelines for auditing management systems ISO/IEC 19508:2014 Information technology—Object Management Group Meta Object Facility (MOF) Core (*) ISO/IEC TR 19759:2015 Software Engineering—Guide to the software engineer- ing body of knowledge (SWEBOK R ) (*) ISO/IEC 20000-1:2011 Information technology—Service management—Part 1: Service management system requirements ISO/IEC 20000-2:2012 Information technology—Service management—Part 2: Guidance on the application of service management sys- tems ISO/IEC TR 20000-4:2010 Information technology—Service management— Part 4: Process reference model ISO/IEC TR 20000-10:2015 Information technology—Service management— Part 10: Concepts and terminology (*) ISO 21505:2017 Project, programme and portfolio management—Guidance on governance ISO/TS 22163:2017 Railway applications—Quality management systems—Par- ticular requirements for the application of ISO 9001:2015 in the rail sector 1 IATF=International Automotive Task Force is a group of major automotive manufacturers. 330 A Relevant norms and standards ISO/IEC 24744:2014 Software Engineering—Metamodel for Development Meth- odologies ISO/IEC TR 24748:2016 Systems and software engineering—Life cycle manage- ment—Part 1: Guidelines for life cycle management ISO/IEC/IEEE 24765:2017 Systems and software engineering—Vocabulary (*)2 ISO/IEC TR 24774:2010 Systems and software engineering—Life cycle manage- ment—Guidelines for process description (*) ISO/IEC 25000:2014 Systems and software engineering—Systems and software Quality Requirements and Evaluation (SQuaRE)—Guide to SQuaRE ISO/IEC 25010:2011 Systems and software engineering—Systems and software Quality Requirements and Evaluation (SQuaRE)—System and software quality models ISO 26262-6:2011 Road vehicles—Functional safety—Part 6: Product devel- opment at the software level ISO/IEC 27000:2014 Information technology—Security techniques—Information security management systems—Overview and vocabulary (*) ISO/IEC 27001:2015 Information technology—Security techniques—Information security management systems—Requirements ISO/IEC 27002:2013 Information technology—Security techniques—Code of prac- tice for information security controls ISO/IEC 27005:2011 Information technology—Security techniques—Information security risk management ISO/IEC 29100:2011 Information technology—Security techniques—Privacy frame- work (*) ISO/IEC TR 29110-1:2016 Systems and software engineering—Lifecycle pro- files for Very Small Entities (VSEs)—Part 1: Overview (*) ISO/IEC TR 29110-3:2015 Systems and software engineering—Lifecycle pro- files for Very Small Entities (VSEs)—Part 3–1: Assessment guide (*) ISO/IEC/IEEE 29119-1:2013 Software Testing—Concepts & definitions ISO/IEC/IEEE 29119-2:2013 Software Testing—Test processes ISO/IEC/IEEE 29119-3:2013 Software Testing—Test documentation ISO 31000:2009 Risk management—Principles and guidelines ISO/IEC 33001:2015 Information technology—Process assessment—Concepts and terminology ISO/IEC 33002:2015 Information technology—Process assessment—Requirements for performing process assessment ISO/IEC 33003:2015 Information technology—Process assessment—Requirements for process measurement frameworks 2 The definitions from ISO/IEC/IEEE 24765, also known as the Software and Systems Engi- neering Vocabulary SEVOCAB, are available online at https://pascal.computer.org/ sev_display/index.action (last access 2017-12-09) where they are continuously updated. A.3 Other Relevant Standard Documents 331 ISO/IEC 33004:2015 Information technology—Process assessment—Require- ments for process reference, process assessment and ma- turity models ISO/IEC TR 33014:2013 Information technology—Process assessment—Guide for process improvement ISO/IEC 33020:2015 Information technology—Process assessment—Process mea- surement framework for assessment of process capability ISO/IEC 38500:2015 Information technology—Governance of IT for the organi- zation IEC 61508-2:2010 Functional safety of electrical/electronic/programmable elec- tronic safety-related systems—Part 2: Requirements for electrical/electronic/programmable electronic safety-related systems IEC 61508-3:2010 Functional safety of electrical/electronic/programmable