The ISO 9000 FAMILY is a generic set of quality management standards, applicable to any organisation producing anything — software, cars, or cement. Its principle is that a documented, followed and improved process produces consistent output. THE KEY MEMBERS: ISO 9000 fundamentals and vocabulary — the concepts and the definitions ISO 9001 the REQUIREMENTS standard, and the only one you can be CERTIFIED against. Specifies what a quality management system (QMS) must contain. ISO 9004 guidance for performance improvement — advice, not requirements ISO 90003 guidelines for applying ISO 9001 TO COMPUTER SOFTWARE. This is the software-specific interpretation, and it exists because ISO 9001 speaks in manufacturing terms that need translating. ISO 9001 REQUIREMENTS — the areas an auditor examines: management responsibility · quality system · contract review · design control · document and data control · product identification and traceability · process control · inspection and testing · corrective and preventive action · control of quality records · internal quality audits · training · servicing · statistical techniques THE SEVEN QUALITY MANAGEMENT PRINCIPLES underlying the modern (2015) revision: 1. customer focus 2. leadership 3. engagement of people 4. process approach 5. improvement 6. evidence-based decision making 7. relationship management THE CENTRAL MECHANISM is the PLAN–DO–CHECK–ACT cycle (Deming/Shewhart), applied to every process: PLAN establish objectives and the processes to deliver them DO implement them CHECK monitor and measure against the objectives, and report results ACT take action to improve performance ISO 9001 is essentially a requirement that PDCA be documented and demonstrably operating. WHAT ISO 9001 CERTIFICATION ACTUALLY MEANS — and this is the most examinable judgement in the topic: IT MEANS: the organisation has a documented process, it follows the process it documented, it keeps records, and it has a mechanism for corrective action and improvement. IT DOES NOT MEAN: the process is a GOOD process, or that the product is of high quality. → An organisation can be fully certified while following a thoroughly documented bad process consistently. ISO 9001 certifies CONSISTENCY, not EXCELLENCE. This is the standard criticism, and it is a fair one. THE DOCUMENTATION HIERARCHY: QUALITY MANUAL the top-level statement of the QMS PROCEDURES how each process is carried out WORK INSTRUCTIONS detailed task-level guidance RECORDS evidence that the procedures were followed The records are what an audit actually inspects. "If it is not written down, it did not happen" is the auditor's operating principle. QUALITY MANAGEMENT AND SOFTWARE DEVELOPMENT, per Sommerville: Quality management provides an independent check on the software development process. The quality management process checks the project deliverables to ensure they are consistent with organisational standards and goals. The quality team should be INDEPENDENT of the development team so they can take an objective view — and can report on quality without being subject to the project's schedule pressure.

ISO/IEC 25010 — SYSTEM AND SOFTWARE QUALITY MODELS (the successor to ISO 9126). Defines the quality characteristics that the quality-attributes topic listed. EIGHT product quality characteristics: FUNCTIONAL SUITABILITY completeness, correctness, appropriateness PERFORMANCE EFFICIENCY time behaviour, resource utilisation, capacity COMPATIBILITY co-existence, interoperability USABILITY learnability, operability, user error protection, accessibility RELIABILITY maturity, availability, fault tolerance, recoverability SECURITY confidentiality, integrity, non-repudiation, accountability, authenticity MAINTAINABILITY modularity, reusability, analysability, modifiability, testability PORTABILITY adaptability, installability, replaceability Its value is as a CHECKLIST and a shared vocabulary: a non-functional requirements review that walks these eight characteristics will find the categories nobody thought about. ISO 25010 also defines QUALITY IN USE — effectiveness, efficiency, satisfaction, freedom from risk, context coverage — which is quality as experienced rather than as built. ISO/IEC 12207 — SOFTWARE LIFE CYCLE PROCESSES. Defines a comprehensive set of processes across the software life cycle, grouped as: agreement processes (acquisition, supply) organisational project-enabling processes technical management processes technical processes (requirements, architecture, design, implementation, integration, verification, validation, transition, operation, maintenance, disposal) It is a REFERENCE MODEL for processes, not a prescription of one lifecycle — you select and tailor. ISO/IEC 15504 / SPICE — SOFTWARE PROCESS IMPROVEMENT AND CAPABILITY DETERMINATION. Provides a framework for assessing process capability, now largely superseded by ISO/IEC 33000. Rates each process on a capability scale 0–5: 0 incomplete · 1 performed · 2 managed · 3 established · 4 predictable · 5 optimising Note the parallel with CMMI's levels in the next topic — the key structural difference is that SPICE rates EACH PROCESS SEPARATELY (a continuous representation), whereas CMMI's staged representation gives the organisation ONE level. OTHER STANDARDS WORTH NAMING: ISO/IEC 27001 information security management systems — increasingly a procurement requirement alongside 9001 ISO/IEC 29119 software testing standards IEEE 830 software requirements specifications (the SRS structure from ACtE0801) IEEE 1012 verification and validation IEEE 828 configuration management plans (see the CM topics ahead) DO-178C airborne systems software; the source of the MC/DC coverage requirement IEC 62304 medical device software life cycle ISO 26262 road-vehicle functional safety

A REALISTIC PICTURE, because "should we certify?" is a genuine decision. THE COSTS of ISO 9001 certification for a 60-person software organisation: gap analysis and consultancy ~ 30 person-days documenting processes ~ 80 person-days training all staff 60 × 0.5 = 30 person-days internal audit programme 4/yr × 5 = 20 person-days/yr external certification audit ~ 8 person-days + audit fees annual surveillance audits ~ 4 person-days/yr ──────────────────────────────────────────────────────── first-year effort ≈ 168 person-days ≈ 8 person-months ongoing ≈ 24 person-days/year At the semi-detached productivity from the cost modelling topic (~209 LOC/person-month at 50 KLOC), 8 person-months is roughly 1.7 KLOC of foregone development — a real but not enormous cost for an organisation of that size. THE RETURNS, honestly split: GENUINE · processes get written down, which helps onboarding and continuity — the "standards assist continuity" argument from the SQA topic · the corrective-action requirement forces root-cause analysis, which is the statistical SQA method · internal audits find process drift before customers do · access to tenders that require certification, which is often the actual reason OVERSTATED · "certified means high quality" — it does not, as established above · defect rates do not fall from certification alone; they fall from the practices (reviews, testing, measurement) that a good QMS happens to require THE FAILURE MODE, named: CERTIFICATION THEATRE. The organisation writes procedures nobody follows, and before each audit produces the records the auditor wants to see. The cost is paid and none of the benefit is obtained — and worse, engineers learn that quality processes are performative, which poisons genuine improvement efforts afterwards. THE DIAGNOSTIC: ask whether the process documentation is consulted between audits. If the only time anyone opens the quality manual is when an auditor is due, it is theatre. HOW TO CERTIFY WELL — the practical answer: DOCUMENT WHAT YOU ACTUALLY DO, then improve it. Teams that write aspirational procedures end up with a document that contradicts reality, and then must either change reality or falsify records. Teams that document current practice get a truthful baseline that PDCA can then improve — which is what the standard was designed for. ISO vs CMMI, the comparison examiners like: ISO 9001 generic, applies to any industry; PASS/FAIL certification; audited by an external registrar; asks "do you follow your documented process?" CMMI software/systems specific; a MATURITY LEVEL 1–5, so it measures degree rather than compliance; appraised against defined practice areas; asks "how capable is your process?" They are complementary rather than competing: ISO 9001 asks whether you are consistent, CMMI asks how good you are, and an organisation can hold both.