ISO 9000-3 Software Standard in Plain English

This page is based on the ISO 9000-3:1997 Quality Standard
published by the International Organization for Standardization.
It presents page 2 of a detailed and comprehensive interpretation
of this standard using language that is clear and easy to understand.

ISO prepared the 9000-3:1997 guidelines to help organizations
apply the ISO 9001:1994 requirements to computer software. Use
ISO 9000-3 if you develop, supply, install, and maintain software.

PAGE TWO OF TWO
	4.8 Product identification and tracing
Track your products	Develop and document procedures to identify and track products from start to finish. When appropriate, these procedures should make sure that you: Identify and document products every step of the way from the purchase of supplies and materials through all stages of handling, storage, production, delivery, installation, and servicing. Trace products or product batches by means of unique identifiers and suitable record keeping.
Identify and track your software products	Develop procedures to assign unique identifiers to software products and components. You should assign identifiers during the product definition phase and be able to maintain these identities throughout the product life cycle. Develop procedures to track your software products and components. You should be able to track your software throughout its life cycle.
Use configuration management to identify and track software items	Use configuration management methods to identify and track your software products and components. Configuration management methods may be used to: Identify software versions, changes, and status. Identify software versions. Identify versions of software components. Identify versions of complete software products. Identify software changes. Identify change requests. Identify actions taken. Identify build-status. Identify build-status of products being developed. Identify build-status of installed products. Track software changes and updates. Track all software changes and updates. Track all actions taken to make changes and updates. Define your software configuration by identifying: Product structures. Files and documents. Naming conventions. Configuration baselines.
Use configuration management to control items	Use configuration management methods to: Control documents and data. Contract documents and data. Process documents and data. Product documents and data. Planning documents and data. Control computer code. Source code. Object code. Executable code. Control software items. Recycled software. Purchased software. Customer's software. Development software. Develop procedures to ensure that every software item can be matched up with every related: Hardcopy document. Hardware component. Hardware interface. Hardware environment. Software component. Software interface. Software environment. Software development tool.
Configuration management accounting procedures	Develop configuration management accounting procedures to monitor and manage software status and changes. These procedures should allow you to: Record software changes and status. Manage software changes and status. Report software changes and status.
Configuration management plan	Develop a configuration management plan. Your plan should: Identify the organizations that will be involved in the configuration management process. Identify the responsibilities that will be assigned to each participating organization. Identify the configuration management activities that will be carried out by each participant. Identify the configuration management tools, techniques, and methods that will be used. Identify the point at which items should be formally controlled by your configuration management process.


	4.9 Process control requirements
Control production, installation, and servicing	Develop procedures to plan, monitor, and control your production, installation, and servicing processes. Your procedures must be documented, and should ensure that each process is: Approved and performed by qualified personnel. Monitored and controlled by qualified personnel. Performed using approved tools and equipment. Documented using proper record keeping systems. Carried out within a supportive work environment. Your procedures should ensure that each process: Maintains a high standard of workmanship. Follows your quality plans, policies, and procedures. Complies with the appropriate standards and codes. Is monitored by tracking process and product qualities. Is carried out with well-maintained tools and equipment. Design a record keeping system that monitors and controls process personnel and equipment. Make sure that all important process qualities are monitored and recorded.
Control software replication process	Develop procedures to control the software replication process. Use these procedures to: Control the identity of software masters and copies. Control the number of copies that will be made. Control software formats and versions. Control disaster recovery planning. Clarify who will control software masters. Clarify who will control software backup copies. Control how long you must support copies and masters. Clarify how long you will need to supply copies. Clarify how long you must be able to read masters. Control the selection and use of software media. Control the software virus detection process. Control the software replication environment. Control how copies will be labeled and packaged. Control the provision of user manuals and other guides. Control how copyright and licensing needs will be met.
Control software release process	Develop procedures to control the software release (delivery) process. Use these procedures to: Control how tests and analyses will be performed. Clarify how deficiencies will be resolved. Clarify what baseline data will be collected. Clarify how testing results will be recorded. Clarify how quantitative analyses will be done. Clarify how system reliability will be evaluated. Control how the types of releases will be described. Control how customers will be notified of new releases. Clarify how they will be told about current changes. Clarify how they will be told about planned changes. Control how you will confirm that your new release will not create new problems for the customer. Control how you will decide whether a temporary fix is acceptable or whether a product update is required. Control how records of software releases will be kept. Clarify how multiple releases to multiple sites will be recorded and tracked.
Control software installation process	Develop procedures to control the software installation process. Use these procedures to: Control how installation duties and responsibilities will be divided up between you and your customer. Control how the installation process will be scheduled. Control how the installation process will be performed. Control how each installation will be validated. Control how each installation will be approved. Control how you will ensure that your customer will supply the necessary resources during installation. Ensure that your customer will provide the necessary: Personnel. Equipment. Information. Control how you will ensure that your customers will give you access during installation. Ensure that your customers will allow access to the necessary: Facilities. Systems. Personnel. Equipment. Information.


	4.10 Product inspection and testing
4.10.1 General	Develop procedures to inspect, test, and verify that your products meet all specified requirements. Develop procedures to inspect, test, and verify that incoming products meet all requirements. Develop procedures to inspect, test, and verify that in-process products meet all requirements. Develop procedures to inspect, test, and verify that final products meet all requirements. Ensure that appropriate product inspection and testing records are developed and that these records are properly maintained.
Develop software test plans	Develop and document software test plans. Develop unit test plans. Develop system test plans. Develop integration test plans. Develop acceptance test plans. Your software test plans should: List your test objectives. Define the scope of your testing. Describe the tests you intend to perform. Explain how the tests will achieve your objectives. Clarify when regression tests should be used. Make sure your tests are repeatable. Describe the procedures you plan to follow. Describe testing procedures. Define the testing sequence. Describe procedures to analyze results. Describe procedures to approve results. Describe procedures to handle testing problems. Define when tests should be suspended. Define when tests can be resumed. Identify the configurations you intend to test. List the test cases you plan to use. Specify the test data you plan to collect. Define the test results you expect to get. Address special safety and security issues. Describe the testing environment that should exist. Identify the test software and tools that will be used. Explain how you intend to test user documentation. Identify the people that will be needed during testing. Make sure these people are properly trained. Make sure your test people are independent. Make sure testing responsibilities are well defined. List the criteria used to decide when testing is complete. Describe how you plan to record test results.
4.10.2 Receiving inspection	Develop procedures that ensure that incoming products are not used until you have verified that they meet all specified requirements. 4.10.2.1 Inspection of incoming products Your procedures should ensure that incoming products are inspected and approved before they are used or processed. All incoming products must conform to specified requirements. 4.10.2.2 Inspections done by subcontractors If your subcontractors (your suppliers) carry out some of the required inspections and if they provide you with recorded evidence which demonstrates that their products are, in fact, acceptable, then your procedures should not ask you to repeat these inspections. 4.10.2.3 Use of products prior to inspection If products must be used prior to inspection, your procedures should tell you to identify and record them so that they can be quickly recalled and replaced if they subsequently do not meet all requirements.
Verify third party software products	Develop and document procedures to verify software products and data that are provided by third parties and will be built into your software product. Third parties may include your customers and suppliers.
4.10.3 In-process inspection and testing	Develop procedures that ensure that work in process meets all requirements before work is allowed to continue. Your procedures should ensure that work in process is held up until the required inspections and tests have been completed and until the required inspection reports have been received and approved (see exception explained below). Work in process need not be held up if the product must be used right away and if it has been identified and recorded as a product that can be recalled and replaced by a subcontractor if it doesn't meet your requirements.
4.10.4 Final inspection and testing	Develop procedures to ensure that final products meet all requirements before they are made available for sale. Your procedures should ensure that: Final products are inspected and approved before they are made available for sale. Incoming and in process inspections and tests are completed, and that all requirements are met, before the product is made available for sale. Final products are not released until all relevant quality procedures have been carried out, all documents have been completed, and all approvals have been granted. Perform two kinds of tests on your final software products. Perform software validation tests. Perform software acceptance tests.
Perform software validation tests	Perform software validation tests before you ask the customer to accept the final product. These tests should: Prove that your software product meets the customer's contractual requirements. Prove that your software will work properly within the customer's operating environment. Specify the software features you intend to test, and explain why these features are important. Document any differences between your test environment and the actual operating environment, and justify the risk you are taking, if any. Explain what kind of limits your testing environment will place on your tests. Identify the controls you intend to place on the process of software validation. Control your test environment. Control your test tools. Define validation-testing responsibilities and distribute these responsibilities between your staff and your customer's staff. Distribute the responsibility for performing tests. Distribute the responsibility for evaluating tests.
Perform software acceptance tests	Perform software acceptance tests after you've validated your finished product and when you believe it is ready to be delivered to the customer. Your tests should: Prove that the validated product meets the customer's contractual requirements. Prove that the validated product works properly within the customer's operating environment. Acceptance tests should be performed by the customer, with your cooperation and assistance. Acceptance tests may be performed for the customer by your organization or by a third party. Help your customer to prepare for the testing process. Help your customer to: Define the testing procedure. Define the testing time schedule. Define the acceptance criteria. Define the testing environment. Define the software environment. Define the hardware environment. Define the testing controls. Define the testing resources. Define personnel requirements. Define training requirements. Define the problem solving process. Define how you and your customer will handle problems identified during the testing process.
4.10.5 Inspection and test records	Develop a record keeping system that your staff can use to document product testing and inspection activities. Your record keeping system should: Prove that your products have been formally inspected and tested using authorized procedures. Show whether your products passed or failed your inspections and tests. Demonstrate that authorized acceptance criteria were used to decide whether products passed or failed. Indicate what was done with products that failed your inspections and tests. Specify who inspected or tested your products, and who authorized their release.


	4.11 Control of inspection equipment
4.11.1 General	Develop procedures to control, calibrate, and maintain inspection, measuring, and test equipment used to demonstrate that products conform to requirements. The amount of measurement uncertainty should be known and should be reasonable given the degree of precision required to establish that the product meets requirements. In order to prove that your equipment is capable of verifying the acceptability of your products, it should be checked and rechecked on a regular basis. Every time equipment is checked to ensure that it is capable of verifying that products are acceptable, the results should be properly recorded. Whenever your customers must confirm that your inspection, measuring, and test equipment is reliable and appropriate, make sure you allow them to do so.
Control software testing tools	Use tools, techniques, and equipment to test whether your software products meet specified requirements. Use configuration management methods to control your test tools, techniques, and equipment. Evaluate your test tools, techniques, and equipment, and approve them for use only if they are able to verify the quality of your software products. Review your test tools and techniques on a regular basis to see if they should be improved or updated. Document your testing process. Specify how test tools, techniques, and equipment should be used. Clarify the scope of your test tools, techniques, and equipment.
4.11.2 Control procedures	Develop procedures to ensure that your measurement equipment is appropriate, effective, and secure. Your procedures should specify: What kinds of measurements must be made. What kinds of measurement methods must be used. How accurate these measurements should be. Which quality measurement equipment should be used. What kinds of environmental conditions are suitable. How and where your equipment should be stored. How equipment will be protected from harm. Develop procedures to calibrate all of your quality oriented inspection, measuring, and test equipment. Your procedures should ensure that: Calibration methods are clearly defined. Equipment is calibrated on a regular basis. Equipment calibration status is clearly shown. Calibration acceptance criteria are clearly specified. Equipment is calibrated against official standards. Calibrations are carried out in a suitable environment. Calibration documents and records are maintained. Calibration records are accurate and up-to-date. Appropriate remedial actions are taken whenever calibration results are found to be unacceptable. Valid calibration settings are protected from unauthorized adjustment. Previous calibration results are rechecked whenever equipment is found to be out-of-calibration. Develop procedures to calibrate hardware and tools used to test and validate your software products.


	4.13 Control of nonconforming products
4.13.1 General	Develop procedures to prevent the inappropriate use of nonconforming products. Make sure these products are: Identified, evaluated, and documented. Segregated from products that conform. Also make sure that everyone is notified when your products do not conform to specified requirements.
Control your nonconforming software products	Segregate nonconforming software by placing it into a separate environment. Segregate nonconforming embedded software by placing the supporting hardware into a separate environment. Clarify when nonconforming software must be recorded and controlled. Control and record how software defects and nonconformities are investigated and resolved: During the software development process. During the software maintenance process. Consider using configuration management methods to segregate, record, and control nonconforming software.
4.13.2 Review and disposition of nonconforming products	Develop procedures to control how your nonconforming products are reviewed, reworked, regraded, retested, recorded, and discussed with your customers. Specify who is responsible for and has the authority to review and dispose of nonconforming products. Specify how review of nonconforming products must be carried out. Specify the conditions under which nonconforming products may be reworked, accepted without modification, used for other purposes, or scrapped. Ensure that your customers are notified when nonconforming products are going to be used with or without modification (when required by contract). Be sure you record the actual condition of any nonconforming product that is, nevertheless, accepted and used. Be sure you record a description of the repairs that were made to nonconforming products. Ensure that repaired or reworked products are re-tested and re-inspected prior to use.
Control the disposition of nonconforming software products	Control the disposition of nonconforming software products and components. Document software nonconformities (problems) and their impact on your software products. Prioritize your software nonconformities. Monitor how software nonconformities are evaluated and resolved. Notify the people who are responsible for ensuring that software nonconformities are resolved. Re-test software components that have been modified. Develop and document a procedure to define the scope of your re-testing activities. Nonconforming software may be: Rejected, or Repaired, or Accepted: Accepted with repairs. Accepted without repairs (if customer agrees).


	4.14 Corrective and preventive action
4.14.1 General	Develop procedures to correct or prevent nonconformities. Corrective or preventive actions should eliminate the causes of nonconformity. Corrective or preventive actions should consider how big the problem is and how much risk is involved. When corrective or preventive actions indicate that systemic or procedural changes should be made, make sure that these changes are implemented. Make sure that corrective and preventive actions and changes are properly documented. Corrective actions may affect: Software items and products. Software life cycle processes. Use configuration management procedures to control corrective actions that affect software items and products. Use document and data control procedures to control corrective actions that affect software life cycle processes.
4.14.2 Corrective action	Develop procedures to ensure that nonconformities are identified and corrected without delay. Ensure that: Nonconformity reports are handled properly. Customer complaints are handled effectively. Causes of nonconformity are investigated and recorded. Corrective actions are promptly implemented. Corrective actions eliminate causes. Corrective actions are effective.
4.14.3 Preventive action	Develop procedures to ensure that potential nonconformities are routinely detected and prevented. Your procedures must: Use every appropriate source of information to detect potential nonconformities. Use sources such as: Work activities and processes. Audit results and quality records. Service reports and customer complaints. List the steps that make up your preventive measures. Ensure that effective preventive measures are taken. Ensure that preventive measures are reported to senior managers. Ensure that appropriate information about preventive measures is fed back into the management review process (please see section 4.1.3). Develop preventive actions by identifying and analyzing the root causes of your nonconformities. Develop preventive actions by identifying and analyzing unfavorable metric levels and trends.


	4.15 Handling, storage, and delivery
4.15.1 General	Develop and document procedures to handle, store, package, preserve, and deliver your products.
4.15.2 Handling	Develop product handling methods and procedures that prevent product damage or deterioration. Your product handling procedures should help prevent damage or deterioration to your software products. Protect your software from unauthorized changes. Prevent accidental software alterations. Prevent software virus infections. Protect your software from the damage that can be caused by media deterioration.
4.15.3 Storage	Designate secure areas to store and protect products. Develop procedures which specify how products will be: Placed into storage. Removed from storage. Protected from damage, deterioration, or destruction during storage. Monitored and evaluated to detect damage or deterioration while in storage. Develop procedures to control how software products and items will be stored and protected. Develop procedures to control how software versions will be stored and protected. Store your software masters and copies in a secure environment. Prevent product loss. Prevent unauthorized access. Prevent unauthorized changes. Prevent unauthorized retrieval. Prevent product damage. Prevent software corruption. Prevent hardware deterioration.
4.15.4 Packaging	Develop packing, packaging, and marking methods and procedures to protect and control the quality of products and packaging materials.
4.15.5 Preservation	Develop methods and procedures to protect and preserve product quality prior to delivery while the product is still under your organization's supervision and control. Ensure that products are segregated from one another. Develop methods to protect and preserve software product quality prior to delivery while the product is still under your control. Consider the following methods: Perform regular software back-ups. Prepare timely software copies. Store software in the proper environment. Store software in a protected environment. Store software in a redundant environment.
4.15.6 Delivery	Develop procedures to protect your products after final testing and inspection, and during product delivery (when the latter is contractually required). Protect your software during delivery. Protect your software during physical delivery. Protect your software during electronic delivery. Develop and document procedures to verify that products are correct and complete before delivery. Develop and document procedures to protect and preserve software products during delivery. Develop and document procedures to preserve product integrity and protect against viruses.


	4.16 Control of quality records
Develop a quality record keeping system	Develop a quality record keeping system, and develop procedures to control it. Identify the information that should be collected. Develop procedures to: Collect and record this information (create records). File, index, store, and maintain quality records. Remove, archive, and destroy old quality records. Protect quality records from unauthorized access. Prevent records from being altered without approval. Safeguard records from damage or deterioration. Your quality record keeping system should: Show that your quality system is implemented. Prove that your quality system works properly. Specify how long old records should be retained. Allow information to be retrieved without difficulty. Produce documents that are dated and easy to read. Permit customers to access records (when required). Include quality records provided by subcontractors.
Software quality records	Software quality records are documents and files that prove that quality activities were performed and quality results were achieved. Quality records document the actual performance of your quality system. They document the past. Quality records can include reports, minutes, requisitions, approvals, annotations, reviews etc. Specify how long you plan to retain electronic records. Make sure that retention times consider how fast your electronic media is likely to degrade. Make sure that retention times consider how long the required hardware and software is likely to be available.


	4.19 Servicing requirements
Develop service procedures	Develop and document quality service procedures. Your procedures should specify how: Products should be serviced. Product service activities are reported. The quality of product service is verified.
Develop software maintenance procedures	Develop procedures to control your software maintenance process. Your software maintenance procedures should: Control the maintenance of your software programs. Control the detection of software problems. Control the analysis of problems and causes. Control the correction of software problems. Control the decision to use temporary fixes. Control the decision to develop permanent fixes. Control how you verify the maintenance process. Control the maintenance of software documentation. Control the maintenance of data and data structures. Control the maintenance of software test plans. Control the maintenance of software specifications. Control the maintenance of customer documents. Control the maintenance of user documents. Control the maintenance of development environment. Control the maintenance of development tools.
Develop software maintenance plans	Develop plans to control your software maintenance projects. Your software maintenance plans should: Define the scope of your maintenance activities. Control how the product's initial status is described. Identify who will support the maintenance process. Specify the maintenance activities that will be done. Describe the records and reports that will be kept.
Keep software maintenance records	Keep a record of your software maintenance activities. For each software product: Record the problems that have been reported. Record the current status of each problem. Record who is responsible for solving each problem. Record the corrective actions that should be taken. Record the priority assigned to each corrective action. Record the results achieved by each corrective action. Record statistical maintenance data. Use your software maintenance records to: Evaluate and improve your software products. Evaluate and improve the performance of your quality system.


	4.20 Statistical techniques
4.20.1 Identification of need	Select the statistical techniques that you will need in order to establish, control, and verify your: Process capabilities. Product characteristics.
4.20.2 Procedures	Develop procedures to: Explain how your techniques should be applied. Monitor and control how these techniques are used. Make sure that: All statistical procedures are documented. Statistical records are kept.
Analyze process and product qualities	Use statistical techniques to: Analyze software development process characteristics. Analyze software product characteristics. Use statistical data to evaluate process and product quality. Evaluate software process characteristics (qualities). Evaluate process maturity. Evaluate process outputs. Evaluate output defects. Evaluate defect resolutions. Evaluate milestone slippage. Evaluate other process characteristics. Evaluate software product characteristics (qualities). Evaluate product testability. Evaluate product usability. Evaluate product reliability. Evaluate product suitability. Evaluate product availability. Evaluate product upgradeabilty. Evaluate product maintainability. Evaluate other product characteristics.
Select useful metrics	Use effective metrics (measurable characteristics). Use metrics that are clearly defined. Use metrics that apply to software. Use metrics that apply to software development. Use metrics that apply to software products. Use metrics that are appropriate to your situation. Use metrics that apply to your development process. Use metrics that apply to your software products. Use metrics that measure quality improvement. Use metrics to measure process quality improvement. Use metrics to measure product quality improvement. Use metrics that add value to process and products. Use metrics that add value to software development. Use metrics that add value to software products.
ISO 9000-3 is OBSOLETE. It has been replaced by ISO 90003.

Legal Restrictions on the Use of this Page
Thank you for visiting this page. You are, of course, welcome to view our
material as often as you wish, free of charge. And as long as you keep intact
all copyright notices, you are also welcome to print or make one copy of this
page for your own personal, noncommercial, home use. But, you are not
legally authorized to print or produce additional copies or to copy and paste
any of our material onto another web site or to republish it in any way.


	4.12 Inspection and test status of products
Control the inspection status of your products	Develop procedures to control the inspection status of your products. These procedures should ensure that: Each and every product is identified as having passed or failed the required tests and inspections. The test status of each product is documented and respected throughout the production, installation, and servicing process. Only products that have passed all tests and inspections are subsequently used or sold to customers (unless an exception is made under section 4.13.2 below).
Control the inspection status of your software products	Develop methods to identify and control the test status of your software products and components. Distinguish between: Untested software. Tested software. Tested with error detected. Tested without error detected. Record the test and inspection status of your software products and components.


	4.17 Internal quality audit requirements
Develop internal audit procedures	Develop internal quality audit procedures which: Determine whether quality activities and results comply with written quality plans, procedures, and programs. Evaluate the performance of your quality system. Verify the effectiveness of your corrective actions. These procedures should also ensure that: Audit activities are properly planned. Auditors are independent of the people whose activities are being audited. Audit results, corrective actions, and corrective action results and consequences are properly recorded. Audit conclusions are discussed with the people whose activities and results are being audited, and deficiencies are corrected by the managers of the audited areas. Audit reports are fed back into the quality system review process (see section 4.1.3).
Develop an internal audit plan for your software projects	Develop an internal audit plan. Your plan should: Identify the software projects you plan to audit. Select the stages that will be audited for each project. Define your audit schedule. Your internal audits should ensure that the quality plans, that control your software projects, do not contradict your organization's quality system requirements.


	4.18 Training requirements
Develop training procedures	Develop quality-training procedures. These procedures should be properly documented, and must ensure that: Quality system training needs are identified. Quality training is provided to those who need it. People are able to perform quality system jobs. People have the qualifications they need to do the work. Accurate and appropriate training records are kept. Everyone understands how your quality system works.
Address software development & management training needs	Identify the training that will be needed: To develop software products. To manage software development projects. Identify your training needs by studying how software will be developed and managed. Study the tools, techniques, methods, and resources that will be used during software development. Study the field or area that will be the focus of your software product (e.g., accounting, petrochemicals, health care, manufacturing, insurance, etc.). Document the training needs that must be met. Document the qualifications that must be met. Deliver the training that will be needed: To develop your software products. To manage your software development projects.

4.8 Product identification and tracing

4.9 Process control requirements

4.10 Product inspection and testing

4.11 Control of inspection equipment

4.12 Inspection and test status of products

4.13 Control of nonconforming products

4.14 Corrective and preventive action

4.15 Handling, storage, and delivery

4.16 Control of quality records

4.17 Internal quality audit requirements

4.18 Training requirements

4.19 Servicing requirements

4.20 Statistical techniques