Doc 04 Process Standards

8/14/2019 Doc 04 Process Standards

1/4

Syntel CQA Forum Process StandardsCQA Doc No 4

Process Standards

CMM

The CMM (Capability Maturity Model) developed by SEI (Software Engineering Institute) aims at continuouslyimproving the quality of software processes in an organization. This model is divided into five levels, from level1-- ad hoc and chaotic to level 5 -- mature and disciplined. From level 2 to level 5, each level contains severalKey Process Areas that an organization should focus on to improve its software processes. Each Key Process

Areas contains some Key Practices which are organized into Common Features for convenience.

This appendix is an abridged version of the CMM model. It only includes a brief description of each KeyPractice Areas and the Key Practices from the Activities Performed Common Feature.

The level 2 focuses on the quality issues of a projects defined process. The activities include: gaining a clearagreement on the requirements (Requirements Management), establishing reasonable software developmentand management plans (Software Project Planning), tracking the actual performing progress against the plan toensure they do not deviate significantly (Software Project Tracking and Oversight), selecting qualified softwaresubcontractors and managing them effectively (Software Subcontract Management), reviewing and auditing thesoftware products and activities to verify their compliance with the applicable procedures and standards(Software Quality Assurance), and systematically controlling changes to software configuration items (e.g.products, data, documents) to maintain their integrity throughout the software life cycle (Software ConfigurationManagement).

The level 3 focuses on improving an organizations overall software process capability. The activities include:establishing the organizational responsibility for improving the organizations and projects softwareprocesses(Organization Process Focus), developing and maintaining the organizations standard softwareprocess and related process assets(Organization Process Definition), providing necessary training to individualsto improve their efficiencies(training Program), tailoring the projects defined software process from theorganizations standard software process according to the project-specific characteristics( Integrated SoftwareManagement), defining, integrating and performing all the software engineering tasks to produce correct andconsistent software products effectively(Software Product Engineering), coordinating actively among softwareengineering groups(Intergroup Coordination), and reviewing the software products methodically by theproducers peers to identify defects and give change suggestions (Peer Reviews).

The level 4 focuses on adding more control to the processes and managing their quality quantitatively. Theactivities include: measuring the performance of the process and using these measures to adjust the process

performance within acceptable limits(Quantitative Process Management), establishing the quantitative processcapability for the organizations standard software process(Quantitative Process Management), and usingtheses quantitative knowledge to manage the quality of the projects software products(Software QualityManagement).

The level 5 focuses on the continuous improvement of the software processes. The activities include:identifying the cause of the defects and preventing them from recurring (Defect Prevention), continuouslyintegrating new technologies (tools, methods, and processes) into the organization in an orderly manner(Technology Change Management), and encouraging everyone in the organization to participation in theactivities of improving the software processes (Process Change Management).

How ISO 9001 Compares with the CMM

ISO 9001 and CMM are two standards concerning the quality of software process management. The papercompares these two standards by mapping 20 clauses in the ISO 9001 to the practices in the CMM. Theobjective of the comparison is to help the organizations gain better understanding of these standards, therebyhaving more freedom when implementing them.

The author finds out that the ISO 9001 and the CMM overlap a lot. Most of the ISO 9001s 20 clauses can beexplicitly mapped to the CMM practices in a one-to-one or many-to-many fashion.

However, the ISO 9001 focuses on the minimum criteria for an acceptable quality system, while the CMMunderlines continuous process improvement. Moreover, the CMM focuses strictly on software, while the ISO9001 encompasses hardware, software, processed materials, and services. Therefore, some issues in the ISO9001 are not covered or well addressed in the CMM, such as, the evaluation and integration of customer-

10718223.doc Page 1of 4


2/4

Syntel CQA Forum Process StandardsCQA Doc No 4supplied products, the replication, delivery, and installation of the products, and the maintenance of theproducts. Also, the interpretations of the corrective and preventive actions, and the statistical techniques aresubject to significant debate. On the other hand, the continuous process improvement concerns in the ISO9001 are implicit.

Therefore, the author suggests that a level 1 organization may be ISO 9001-compliant. The Level 2 and level 3organizations would be considered ISO 9001-compliant as long as they address the delivery and installation ofthe processes, and the use of included software products. Moreover, because of the more detailed guidance

and software specificity provided by the CMM, it is a better choice for an organization to base its quality systemon.

SPICE

SPICE (Software Process Improvement and Capability dEtermination) is an internationally cooperative projectto develop an International Standard for Software Process Assessment. It has finished developing a suite ofdocuments as a draft standard. Now, the industry trials of this standard have been conducted.

The SPICE suite of documents provides a framework for software processes assessment. This framework isgeneric enough to be appropriate across all application domains and sizes of organization. The results of theassessment can be used by an acquirer or a supplier itself to determine the suppliers capability for a particular(class of) requirement, or by an organization to improve its own processes.

The documents suite is composed of nine parts. Part 1, concepts and introductory guide, describes how the

different parts of the suite fit together, and provides guidance for their selection and use. It also explains therequirements contained in the Standard and their applicability to the conduct of an assessment, to thedevelopment of processes which extend those listed in the defined model, and to the construction ofassessment instruments.

Part 2,3,4,5,and 6 contains definitions and guidance related to the process assessment. The processassessment activity is always conducted for process improvement or process capability determination. It isbased on the capability of specific process instances. The inputs to the assessment procedure include theassessment purpose, scope, constraints, responsibilities, and the extended process definit ions. Rather than justa pass/fail result, the output of the assessment is a process profile which contains a set of practice adequacyratings and process capability level ratings.

The assessment is carried out by assessing the process instances against the process model defined in part 2,a model for process management. This model consists of a set of process-specific base practices and generic

practices which are fundamental activities essential to software engineering. The base practices are groupedinto processes and process categories by the type of activity they address. There are five process categories,customer-supplier, engineering, project, support,and organization. The generic practices, which represent theactivities necessary to manage a process and improve its capability to perform, are applicable to any process.They are grouped into common features and capability levels. These baseline practices may also be extendedto meet specif ic industry, sector, or other requirements.

Part 3, rating processes, defines the requirements for conducting an assessment, sets out the basis for rating,scoring and profiling process capabilities, and defines the circumstances under which assessment results maybe compared. Part 4, guide to conducting assessment, provides guidance on conducting a team-basedassessment and interpreting the requirements in Part 3.

The assessors need assessment instrument to assist them in performing the assessment. The Part 5 of theStandard, construction, selection and use of assessment instruments and tools,defines the common elements

to construct an assessment instrument. The instrument contains a set of assessment indicators which help theassessor to analyze the process under review, and to make consistent judgements about the implementedpractices. The part 5 also provides guidance on the selection and usability aspects of various types ofassessment instruments.

The Part 6, qualification and training of assessors, describes the competence, education, training andexperience of assessors who perform the assessment.

The results of process assessment can be used for continuous process improvement. This is provided in thepart 7, Guide for use in process improvement. The guidance covers analyzing the results of the assessmentagainst the organizations business needs, identifying the strengths, weakness and risks inherent in theprocesses, identifying the improvement actions, using the capability model in part 2 as a route map for

10718223.doc Page 2of 4


3/4

Syntel CQA Forum Process StandardsCQA Doc No 4improvement, the cultural issues in the context of software process improvement, and dealing withmanagement issues for software process improvement.

The results of process assessment can also be used for process capability determination. It is defined in thepart 8, guide for use in determining supplier process capability. The determination is either performed by anacquirer to determine the capability of its supplier or by an organization to determine its own capability to meetthe contract. The input of the process capability determination is the specified requirements which aretranslated into the target capability. The supplier also puts forward a proposed process capability of the selected

processes and analyzes it against the target capability to identify the risks involved in undertaking a projectusing the selected processes. The results are reported in the process capability report.

The Part 9, Vocabulary, is a consolidated vocabulary of all terms specifically defined for the purposes of theSPICE document set.

Personal Opinion

Producing high-quality software products is the goal of software development organizations. However, howdoes an organization guarantee that the software products generated by the development processes areeffective, stable and reliable? How could a customer believe that his supplier has the capability to satisfyhis/her strict requirements? The process standards try to lead the organizations a way to produce high-qualitysoftware products.

In this paper, three standards, ISO 9001, CMM, and SPICEare summarized. The ISO 9001 and the CMM are

proposed by different institutions. They are preferred and adopted by different organizations in their softwaredevelopment experiences. While the SPICE attempts to create an intentional standard which is accepted by allthe countries and is used as a common measure to determine an organizations software developmentcapability.

The focuses of these three standards are different. The ISO 9001 and the CMM both focus on creating a qualitysystem. However, the ISO 9001 defines the minimum requirements of a quality system while the CMMunderlines continuous process improvement. On the other hand, the SPICE concerns with creating a processassessment framework, and using the results of the assessment to promote the organizations continuousprocess improvement or to determine its process capability. The process assessment in SPICE is to select aprocess instance and compare it with a pre-defined process model. This model contains two parts. The first partdefines base practices which are the minimum requirements of a quality system. The concern of this part issimilar to that of the ISO 9001. The second part defines generic practices which are essential activities tocontinuous capability improvement. These generic practices are grouped into common features and capabilitylevels which employs the similar idea as used in the CMM.

The SPICE also includes an architecture for rating practices and processes(Part 3), the guidance on theconduct of the assessment (Part 4), the selection of an assessment instrument to assist the assessment (Part5), the definition of the required skills and experience for assessors (Part 6), and the guide for using theassessment results in the context of process improvement (Part 7) and process capability determination (Part8). Therefore, the SPICE covers a much wider scope than the ISO 9001 and the CMM.

Another unique feature of the SPICE is that the result of the process assessment is not just fail/pass, but aprocess profile which contains a set of practice adequacy ratings and process capability level ratings. Thepractice adequacy rating indicates the extent to which a practice meets its purpose as defined in part 2 of theSPICE. The process capability level rating is an aggregation of the practice adequacy ratings that belong to thatlevel. Using these ratings (the process profile), the organization may gain a clear understanding of thestrengths, weakness and risks inherent in its processes. Against its business goals, it can identify level-by-level

improvement actions according to the capability level model defined in part 2. This feature embodies theoriginal intent behind any process quality standard that certified by one standard (pass/fail) should not be theultimate goal of an organization. The standard should be used as a goad, a bridge and a measure to improvethe quality of its management and software development capacity, thereby gaining more advantages in thecompetitive market.

However, whichever the standard an organization employs, the most important factor is the people. This isbecause the standard is understood by the people, the corresponding policies are created by the people, andthe activities are planned and performed by the people. Therefore, the quality and the initiative of the peopledirectly determine the quality of the development process. In order to develop a quality system, perhaps thefirst step is to develop qualified people.

10718223.doc Page 3of 4


4/4

Syntel CQA Forum Process StandardsCQA Doc No 4

10718223.doc Page 4of 4

Documents

Doc 04 Process Standards