ISO IEC 90003 2014 is a quality management standard for
software products and related services.
This webpage presents an overview of ISO IEC 90003 and provides a PDF sample of our approach.
Also see ISO IEC 27001 on
information security and ISO IEC 20000-1
on service management.
|
4.1 Organizational
requirements and guidelines |
|
• Establish your quality management system (QMS). • Identify the processes that your organization’s QMS needs. • Identify the internal processes that your organization’s QMS needs. • Identify the outsourced processes that your organization’s QMS needs. • Figure out how you’re going to make sure that each process is effective. • Figure out how to make sure that internal processes achieve planned results. • Figure out how to make sure that outsourced processes achieve planned results. • Document your organization’s QMS. • Document the sequence and interaction between your QMS processes. • Determine how to control the interaction between these processes. • Document how QMS processes will be managed and controlled. • Implement your organization’s QMS. • Implement your internal processes. • Implement your outsourced processes.
• Maintain your organization’s QMS. • Support process performance. • Control process performance. • Monitor process performance. • Measure process performance. • Analyze process performance. • Improve your organization’s QMS. |
|
4.2
Documentation requirements
and guidelines |
|
4.2.1 Prepare quality documents |
|
• Plan your QMS documentation. • Make sure that it respects and reflects what you do. • Consider the size and scope of your organization. • Consider the nature of your organization’s activities. • Consider the competence of your organization’s personnel. • Consider the nature and purpose of your organization’s processes. • Make sure that it supports process management. • Include documents and records used for process planning. • Include documents and records used for process development. • Include documents and records used for process operation. • Include documents and records used for process control. • Establish your QMS documentation. • Document your QMS parts and components. • Document your organization's quality policy. • Document your organization's quality objectives. • Document your organization's quality procedures. • Document your organization's quality methods. • Document your organization's quality models. • Document your organization's quality tools. • Document your organization's quality techniques. • Document your organization's quality technologies. • Prepare a quality manual for your organization. • Document your quality management system. • Implement your QMS documentation. • Use your documentation to establish your QMS. • Use your documentation to implement your QMS. • Use your documentation to maintain your QMS. • Use your documentation to improve your QMS. • Maintain your QMS documentation. • Maintain quality records for your organization. • Maintain a quality manual for your organization. |
|
4.2.2 Develop a quality manual |
|
• Establish a quality manual for your organization. • Define the scope (boundary) of your QMS. • Justify all exclusions (reductions in scope). • Document your QMS procedures or refer to them. • Describe how your QMS processes interact. • Maintain your organization’s quality manual. |
|
4.2.3
Control quality documents |
|
• Establish a procedure to control QMS documents. • Document your document control procedure. • Implement your document control procedure. • Approve documents before you distribute them. • Specify current revision status of documents. • Preserve the usability of your documents. • Manage documents from external sources. • Provide the correct version at points of use. • Prevent the accidental use of obsolete documents. • Maintain your QMS document control procedure. |
|
4.2.4 Maintain quality records |
|
• Establish your organization’s QMS records. • Make sure that your records are useable. • Make sure that they can be used as evidence. • Establish a procedure to control QMS records. • Document your record control procedure. • Implement your record control procedure. • Control how records are identified. • Control how records are stored. • Control how records are retrieved. • Control how records are protected. • Control how records are removed. • Control how records are retained. • Maintain your record control procedure. |
|
4.2.4.1 Show that requirements are being met |
|
• Use QMS records to prove that requirements are being met. • Use reviews to prove that requirements are being met. • Use reports to prove that requirements are being met. • Use inspections to prove that requirements are being met. • Use change requests to prove that requirements are being met. |
|
4.2.4.2 Demonstrate that your QMS is effective |
|
• Use records to prove that your QMS is effective. • Use estimates to demonstrate that your QMS is effective. • Use supplier evaluations to demonstrate that your QMS is effective. • Use resource changes to demonstrate that your QMS is effective. • Use software license agreements to demonstrate that your QMS is effective. • Use tool assessments to
demonstrate that your QMS is effective. • Use software release records to demonstrate that your QMS is effective. • Use minutes of meetings to demonstrate that your QMS is effective. |
|
4.2.4.3 Control record retention and disposition |
|
• Clarify QMS record management requirements. • Establish record accessibility requirements. • Consider record protection requirements. • Clarify record retention requirements. • Establish QMS record retention
time periods. • Consider record accessibility requirements. • Consider record protection requirements. |
|
5.1 Commitment
requirements and guidelines |
|
• Support the development of your organization’s QMS. • Support the implementation of your organization’s QMS. • Support implementation by communicating the importance of meeting requirements. • Support implementation by ensuring that resources are available when needed. • Support the improvement of your organization’s QMS. |
|
5.2 Customer requirements and guidelines |
|
• Expect your personnel to enhance customer satisfaction. • Expect personnel to determine customer requirements. • Expect personnel to meet customer requirements. |
|
5.3 Policy
requirements and guidelines |
|
• Establish a quality policy for your organization. • Make sure that your policy is appropriate. • Make sure that your policy is effective. • Make sure that your policy is implemented. • Make sure that your policy is suitable. |
|
5.4 Planning requirements and guidelines |
|
5.4.1 Establish quality objectives |
|
• Expect personnel to establish quality objectives. • Establish quality objectives for your organization. • Establish quality objectives in relevant functional areas. • Establish quality objectives at relevant organizational levels. |
|
5.4.2 Carry out quality planning |
|
• Plan the establishment of your QMS. • Plan how you're going to document your QMS. • Plan how you're going to implement your QMS. • Plan how you're going to maintain your QMS. • Plan how you're going to improve your QMS. • Carry out software QMS planning activities. • Establish your software life cycle models. • Prepare your software management plans. • Select your software management tools. • Define your software development outputs. • Clarify your software management environment. • Specify software programming conventions. • Identify all software reuse requirements. |
|
5.5 Managerial requirements and guidelines |
|
5.5.1 Clarify responsibility and authority |
|
• Define responsibilities and authorities. • Assign responsibilities and authorities. • Communicate assignments within your organization. |
|
5.5.2 Appoint management representative |
|
• Appoint a member of your organization’s management to oversee your QMS. • Give management representative authority over and responsibility for your QMS. • Give your representative the authority and responsibility to establish the QMS. • Give your representative the authority and responsibility to implement the QMS. • Give your representative the authority and responsibility to support the QMS. • Give your representative the authority and responsibility to report on the QMS. |
|
5.5.3 Establish internal communications |
|
• Establish appropriate communication processes within your organization. • Discuss quality management effectiveness throughout your organization. |
|
5.6 Review requirements and guidelines |
|
• Review your organization's QMS at planned intervals. • Review the ongoing suitability, adequacy, and effectiveness of your QMS. • Identify and assess opportunities to improve your organization's QMS. • Maintain a record of your management review activities. |
|
5.6.2 Examine management review inputs |
|
• Examine information about your QMS (inputs). • Examine previous management reviews. • Examine the status of remedial actions. • Examine changes that could affect QMS. • Examine the results of previous audits. • Examine feedback from customers. • Examine product conformity data. • Examine process performance information. • Examine recommendations for improvement. |
|
5.6.3 Generate management review outputs |
|
• Generate management review decisions and actions (outputs). • Generate decisions and actions to make improvements. • Generate decisions and actions to address resource needs. |
|
6.1 Allocation requirements and guidelines |
|
• Determine the resources that your QMS needs • Allocate the resources that your QMS needs. • Provide resources needed to support your QMS. • Provide resources needed to enhance customer satisfaction. |
|
6.2 Personnel requirements and guidelines |
|
6.2.1 Provide competent personnel |
|
• Use competent people to carry out work that affects product quality. • Make sure that your QMS personnel have the right experience. • Make sure that your QMS personnel have the right education. • Make sure that your QMS personnel have the right training. • Make sure that your QMS personnel have the right skills. |
|
6.2.2 Meet competence requirements |
|
• Identify personnel who affect product quality. • Identify their competence needs and requirements. • Determine their software training needs. • Take steps to meet competence requirements. • Provide training or take other suitable steps. • Make personnel aware of their importance. • Evaluate the effectiveness of training activities. • Monitor the competence of software personnel. • Monitor your software development technologies. • Monitor your software maintenance technologies. • Maintain an appropriate record of competence. |
|
6.3
Infrastructure requirements and guidelines |
|
• Determine your organization’s infrastructure needs. • Figure out what you need in order to meet product requirements. • Evaluate the infrastructure that you need to meet product requirements. • Evaluate tools needed to support design and development process. • Approve the infrastructure that you need to meet product requirements. • Approve tools needed to support design and development process. • Control the infrastructure that you need to meet product requirements. • Control tools needed to support design and development process. • Provide the infrastructure that you need to meet product requirements. • Maintain the infrastructure that you need to meet product requirements. |
|
6.4 Environmental requirements and
guidelines |
|
• Determine the work environment that you need to meet product requirements. • Manage the environment that you need in order to meet product requirements. |
|
7.1 Planning requirements and guidelines |
|
• Establish a product realization planning process. • Plan the realization of your organization’s products. • Use your planning process to set your product quality objectives. • Use your planning process to specify product quality requirements. • Use your planning process to identify your product realization needs. • Produce product realization planning outputs. • Prepare outputs that are consistent with your methods. • Develop your product realization processes. |
|
7.1.1 Use life
cycle models to plan work |
|
• Select suitable life cycle models to manage software design and development. • Consider the nature of your project when you select models and methods. • Consider the nature of your product when you select models and methods. • Use suitable life cycle models to plan and perform software design and development. • Use suitable life cycle models to plan your processes, activities, and tasks. • Use suitable life cycle models to perform processes, activities, and tasks. |
|
7.1.2 Carry out
software quality
planning |
|
• Plan software projects, products, and contracts. • Clarify quality needs and requirements. • Clarify product oriented quality needs and requirements. • Clarify process oriented quality needs and requirements. • Figure out how QMS should be tailored. • Establish software quality objectives. • Define each software development stage. • Include all related plans and procedures. • Review plans for projects, products, and contracts. • Ask participating organizations to review your software quality plans. • Approve plans for projects, products, and contracts. • Ask participating organizations to agree before work is carried out. |
|
7.2 Customer requirements and guidelines |
|
7.2.1 Determine requirements related to products |
|
• Determine your customers' requirements. • Determine your intended use requirements. • Determine your legal product requirements. • Determine your organization's requirements. |
|
7.2.1.1 Determine customer-related requirements |
|
• Establish methods for managing software requirements. • Establish methods for developing software requirements. • Establish methods for approving software requirements. • Establish methods for controlling software requirements. • Establish methods for tracing software requirements. • Manage your organization's software requirements. • Clarify requirements for your software. • Specify requirements for your software. • Approve requirements for your software. • Control requirements for your software. |
|
7.2.1.2 Determine additional product requirements |
|
• Establish a system requirements analysis process. • Establish a system architectural design process. • Establish a software requirements analysis process. •
Establish a formal requirements engineering process. • Establish system and software quality models. • Establish integrity levels for systems and software. •
Establish quality requirements for COTS
software. |
|
7.2.2 Consider your product-oriented requirements |
|
• Review your customers’ product requirements. • Consider product requirements before you agree to supply products. • Verify that product requirements are defined before you agree to supply products. • Confirm that your organization is able to meet customers’ product requirements. • Control changes in customers’ requirements. • Maintain a record of your requirement reviews. |
|
7.2.2.1 Review contractual issues and concerns |
|
• Review software tenders, contracts, and orders. • Review the feasibility of meeting required product characteristics. • Review related management responsibilities and requirements. • Review property to be provided by the customer organization. • Review the operating system or hardware platform to be used. • Review the software life cycle processes imposed by customers. • Review the need to control external interfaces with software product. • Review software replication and distribution requirements. • Review legal obligations and regulatory issues and concerns. |
|
7.2.2.2 Evaluate risk before agreeing to supply software |
|
• Evaluate risks when reviewing requirements related to products. • Evaluate safety risks when reviewing product requirements. • Evaluate security risks when reviewing product requirements. • Evaluate supplier risks when reviewing product requirements. • Evaluate performance risks when reviewing product requirements. • Evaluate resource risks when reviewing product requirements. • Evaluate scheduling risks when reviewing product requirements. • Evaluate customer risks when reviewing product requirements. • Evaluate user risks when reviewing product requirements. • Re-evaluate risks whenever software development contracts change. • Consider the impact changes in software contracts could have. |
|
7.2.2.3 Appoint someone to represent the customer |
|
• Ask customer to appoint someone to represent the customer's interests. • Ask this representative to ensure that customer personnel cooperate. • Ask representative to ensure that information is provided in a timely manner. • Ask representative to ensure that action items are resolved in a timely manner. • Ask this representative to monitor software product life cycle activities. |
|
7.2.3 Establish effective customer communications |
|
• Determine effective arrangements for communicating with customers. • Figure out how communications with customers should be handled. • Figure out how important topics should be discussed with customers. • Implement effective arrangements for communicating with customers. • Control how communications with customers are handled. • Control how important topics are discussed with customers. |
|
7.2.3.1 Consider the type and extent of your contractual obligations |
|
• Establish suitable methods for communicating with software customers. • Consider the type and scope of your organization's contractual agreements. |
|
7.2.3.2 Schedule joint reviews during software development projects |
|
• Schedule joint reviews between your organization and your customer. • Carry out joint reviews on a regular basis and for project events. • Review product oriented information with your customers. • Review contract oriented information with your customers. |
|
7.2.3.3 Communicate with customers during operations and maintenance |
|
• Communicate during operations and maintenance. • Share product information with customers. • Discuss enquiries and feedback with customers. |
|
7.3 Development requirements and guidelines |
|
7.3.1 Plan product design and development activities |
|
• Plan the design and development of your products. • Plan design and development job assignments. • Plan product design and development stages. • Plan interaction between participating groups. • Update planning outputs whenever it is appropriate. |
|
7.3.1.1 Plan the design and development of software products |
|
• Develop a disciplined approach to design and development. • Establish a software design and development planning process. • Plan the design and development of your software products. • Address or refer to the activities that should be carried out. • Consider how work should be managed and controlled. • Identify project expectations and related arrangements. • Identify the rules and conventions that must be used. • Identify the methods and models that must be used. • Identify the tools and techniques that must be used. • Identify the hardware and software that must be used. • Identify the controls and procedures that must be used. • Identify how you plan to protect software and information. • Analyze the risks and problems that could affect your project. • Establish your design and development project schedule. • Periodically review and amend design and development plans. |
|
7.3.1.2 Plan your review, verification, and validation activities |
|
• Plan your design and development review activities (see 7.3.4). • Plan your design and development verification activities (see 7.3.5). • Plan your design and development validation activities (see 7.3.6). |
|
7.3.1.3 Plan your design and development work assignments |
|
• Plan design and development responsibilities and authorities. • Clarify design and development responsibilities and authorities. • Allocate design and development responsibilities and authorities. • Document design and development responsibilities and authorities. |
|
7.3.1.4 Plan design and development boundaries and interfaces |
|
• Expect suppliers of design and development services to plan their work. • Expect suppliers to clearly define responsibility interfaces and boundaries. • Gather input from parties who have an interest in design and development. • Consider getting input from parties who have an interest in software installation. • Consider getting input from parties who have an interest in software operation. • Consider getting input from parties who have an interest in software maintenance. • Consider getting input from parties who have an interest in software training. • Define your software design and development interfaces and boundaries. • Review software supplier's design and development planning activities. |
|
7.3.2 Define product design and development inputs |
|
• Clarify design and development requirements. • Study similar product designs and identify requirements. • Examine requirements arising from acceptance criteria. • Consider using prototypes to determine requirements. • Identify issues and problems that should be solved.
• Define product design and development inputs. • Define product design and development requirements. • Define your product’s performance requirements. • Define your product’s functional requirements. • Define your product’s regulatory requirements. • Define your product’s statutory requirements. • Define your product's quality requirements. • Define your product's safety requirements. • Define your product's security requirements. • Define system design and development constraints. • Review product design and development inputs. • Review design and development input documents. • Review the adequacy of input definitions. • Review the accuracy of user characteristics. • Review the quality of project management. • Keep records of design and development inputs. |
|
7.3.3 Generate product design and development outputs |
|
• Plan your design and development outputs. • Develop outputs that are both accurate and complete. • Develop outputs that can be compared against design inputs. • Develop outputs that specify essential product characteristics. • Develop outputs that support other processes and activities. • Generate design and development outputs. • Use prescribed or chosen methods to document outputs. • Use computer design and development tools to create outputs. • Verify design and development outputs. • Approve design and development outputs. |
|
7.3.4 Perform product design and development reviews |
|
• Establish a product design and development review process. • Establish a software product review process that is appropriate. • Establish methods and techniques for monitoring compliance. • Establish procedures for dealing with identified shortcomings. • Plan software product design and development reviews. • Specify what type of design and development review will be done. • Organize your software product design and development reviews. • Perform reviews in accordance with planned arrangements. • Make arrangements to carry out software reviews at suitable stages. • Evaluate how well design and development results meet requirements. • Identify problems and propose actions to address issues and concerns. • Follow up on outstanding problems and actions taken to resolve them. • Maintain records of your design
and development reviews. • Record the results of design and development reviews. • Record the actions taken to follow-up on these reviews. |
|
7.3.5 Conduct product design and development verifications |
|
• Plan product design and development verification activities. • Make arrangements to do design and development verifications. • Perform verifications in accordance with your planned arrangements. • Verify that design and development outputs meet input requirements. • Decide whether verified outputs should be accepted for subsequent use. • Maintain records of your design and development verifications. • Record the results of design and development verifications. • Record actions taken to follow up on your verifications. |
|
7.3.6 Carry out product design and development validations |
|
• Plan product design and development validation activities. • Make arrangements to do design and development validations. • Perform validations in accordance with your planned arrangements. • Confirm that product is capable of meeting intended use requirements. • Keep records of design and development validations. • Record results of design and development validations. • Record necessary actions taken to follow up on validations. |
|
7.3.6.1 Carry out planned software validation activities |
|
• Plan your software product design and development validation activities. • Consider whether it is feasible or possible to fully validate your software. • Validate your software product before you ask your customer to accept it. • Establish conditions similar to the customer's application environment. • Confirm that software product will meet its operational requirements. • Use other methods when software validation is unfeasible or impossible. • Use configuration audits to confirm that software product meets requirements. • Use analyses, simulations, and emulations to see if requirements are being met. • Establish software product design and development validation records. • Record the results of design and development validation activities. • Record the actions to be taken to meet specified requirements. |
|
7.3.6.2 Carry out planned software testing activities |
|
• Consider using tests to validate software. • Establish software testing procedures. • Clarify how testing should be managed. • Plan your software testing activities. • Establish your software testing plans. • Document your software testing plans. • Use testing methods to validate software. • Implement your software testing plans. • Control your software testing environment. • Test the validity of your software products. • Record the results of your testing activities. • Record any limitations to testing activities. • Review software testing plans and activities. |
|
7.3.7 Control product design and development changes |
|
• Use configuration management to control changes. • Identify changes in software design and development. • Record changes in software design and development. • Review changes in software design and development. • Verify changes in software design and development. • Validate changes in software design and development. • Approve changes in software design and development. |
|
7.4 Purchasing requirements and guidelines |
|
7.4.1 Manage purchasing process |
|
• Establish criteria to control your suppliers. • Establish criteria to select your suppliers. • Establish criteria to evaluate your suppliers. • Evaluate suppliers’ ability to supply products. • Evaluate their ability to meet purchase requirements. • Select suppliers that can meet requirements. • Control your organization's product purchasing process. • Ensure that purchases meet specified purchase requirements. • Exert greater control over purchases that influence product realization. • Exert greater control over purchases that influence your final product. |
|
7.4.1.1 Control purchased products and services |
|
• Establish control over purchasing process. • Control purchased products and services. • Control the purchase of products. • Control the purchase of software. • Control the purchase of hardware. • Control the purchase of documents. • Control the purchase of services. • Manage purchased product and service risk. • Manage the risks associated with purchased products. • Manage the risks associated with purchased services. |
|
7.4.1.2 Control the use of external resources |
|
• Control the use of external documents. • Control the use of user documentation. • Control the use of product documentation. • Control the use of training courses and materials. • Control the use of external personnel. • Control the use of external suppliers. |
|
7.4.2 Clarify purchasing information |
|
• Specify your purchasing requirements. • Specify your product requirements. • Specify your process requirements. • Specify your procedure requirements. • Specify your equipment requirements. • Specify your personnel requirements. • Specify your service requirements. • Specify your QMS requirements. • Approve your purchasing requirements. |
|
7.4.3 Verify purchased products |
|
• Establish your purchase verification and inspection methods. • Figure out how to verify that products meet requirements. • Figure out how to verify purchased software and services. • Figure out how to verify purchased or obtained data. • Implement your purchase verification and inspection methods. • Verify that purchased products meet your purchase requirements. • Verify that purchased software and services meet requirements. • Verify that purchased or obtained data meets requirements. |
|
7.5 Production requirements and guidelines |
|
7.5.1 Control production and service provision |
|
• Plan production, post-production, and service delivery activities. • Determine how you're going to control production and service provision. • Figure out how to use information to control production and service provision. • Figure out how to use measurement to control production and service provision. • Figure out how to use monitoring to control production and service provision. • Figure out how to use equipment to control production and service provision. • Determine how you're going to control your post-production activities. • Control production, post-production, and service provision. |
|
7.5.1.1 Control software production and service activities |
|
• Control software production and service provision. • Control software build, release, and replication activities. • Control software delivery and installation activities. • Control software post-delivery service activities. |
|
7.5.1.2 Control software build and release activities |
|
• Set up a process to control software build and release activities. • Define how constituent software items should be controlled. • Define how software releases should be classified or categorized. • Define how software product update decisions should be made. • Control your organization's software build and release activities. |
|
7.5.1.3 Control software replication activities |
|
• Set up a process to control software replication activities. • Control your organization's software replication activities. • Control your software replication environment. • Control identities of software masters and copies. • Control the media that will be used for each item. • Control your software product documentation. • Verify the correctness and completeness of your copies. |
|
7.5.1.4 Control software product delivery activities |
|
• Set up a process to control software delivery. • Control the physical delivery of software. • Preserve software items during physical delivery. • Control the electronic delivery of software. • Preserve software items during electronic delivery. |
|
7.5.1.5 Control software product installation activities |
|
• Control how customers and third parties install software. • Describe the steps that customers and third parties should take. • Plan the rollout and installation of new products and new releases. • Control how your organization's people install software. • Plan how staff install new products and new releases. • Describe how your personnel should install software. • Clarify software installation roles and responsibilities. • Determine software installation tasks and obligations. • Assign software installation roles and responsibilities. • Use agreements to formalize roles and responsibilities. |
|
7.5.1.6 Control software operation and support activities |
|
• Control your software operation and support activities. • Determine whether or not you need to communicate with customers. • Determine whether or not you need to provide ongoing support. • Control your software operation and support activities. • Control electronic communications with your software customers. • Control arrangements made to provide ongoing support services. |
|
7.5.1.7 Control software product maintenance activities |
|
• Establish a process to control software maintenance activities. • Control your organization's software maintenance activities. • Control software maintenance services provided to customers. • Control maintenance of your software development environment. • Maintain a record of your software maintenance activities. |
|
7.5.2 Validate processes if outputs cannot be verified |
|
• Identify processes whose outputs cannot be fully verified until it's too late. • Identify production processes whose outputs can't be verified until it's too late. • Identify output deficiencies that are noticed only after the product is in use. • Identify service provision processes that generate outputs that can't be verified. • Identify output deficiencies that are noticed only after service is delivered. • Develop arrangements to validate processes when outputs can't be fully verified. • Develop arrangements to validate these special production processes. • Develop arrangements to validate these special service provision processes. • Validate processes whenever outputs can't be fully verified until it's too late. • Validate production processes whenever outputs can't be properly verified. • Demonstrate that these production processes can achieve planned results. • Validate service provision processes whenever outputs can't be properly verified. • Demonstrate that these service provision processes can achieve planned results. • Establish methods to compensate for your inability to fully verify products. • Select methods that are commensurate with the risks you are taking. • Consider what could happen if design and development fails. |
|
7.5.3 Identify
your products and establish traceability |
|
• Consider using configuration management to identify and track your products. • Establish the unique identity of your organization’s products (when appropriate). • Identify the monitoring and measurement status of your organization’s products. • Preserve the identity of your products throughout product realization process. |
|
7.5.3.1 Use configuration management to identify and track software |
|
• Consider using configuration management to identify and track software items. • Select configuration management methods that respect the risk you are taking. • Select methods that are commensurate with project size and complexity. • Use configuration management to provide technical and administrative direction. • Use it to manage your software design, development, and support activities. • Use it to ensure that product's present configuration and status is fully visible. |
|
7.5.3.2 Clarify scope of software configuration management process |
|
• Define the scope of software configuration management process. • Use configuration management to control software planning. • Use configuration management to control software identities. • Use configuration management to control software updates. • Use configuration management to control software evaluations. • Use configuration management to control software releases. • Use configuration management to control software delivery. |
|
7.5.3.3 Establish a process to trace your software components |
|
• Establish a process to trace components of software items and products. • Establish a process that meets both contractual and marketplace requirements. • Use your process to trace software components throughout their life cycle. • Use your process to trace the destination of each version of your product. • Use your process to trace changes back to specific change requests. |
|
7.5.4 Protect customer property supplied for products |
|
• Identify property provided by customers for use or incorporation into products. • Identify information that will be used by or included in your product. • Identify data that will be used by or included in your product. • Identify environments that will be used by or included in your product. • Identify specifications that will be used by or included in your product. • Identify software that will be used by or included in your product. • Identify hardware that will be used by or included in your product. • Verify property provided by customers for use or incorporation into your products. • Define how updates to customer-supplied items are accepted and integrated. • Consider how to protect customer property that is used by or included in your products. • Protect property provided by customers for use or incorporation into your products. • Maintain a record of customer property that is lost, damaged, or unsuitable. |
|
7.5.5 Preserve software products and components |
|
• Preserve products and components during internal processing and delivery. • Maintain conformity to requirements during internal processing and delivery. • Protect software products from the point of production through to delivery. • Plan how you're going to protect and preserve your software products. • Preserve software products during replication, handling, storage, and delivery. |
|
7.6 Measurement requirements and guidelines |
|
• Identify your organization’s monitoring and measuring needs and requirements. • Develop processes to ensure that monitoring and measuring can actually be done. • Confirm that software used to monitor and measure requirements can do the job. • Select equipment that meets your monitoring and measuring needs and requirements. • Use configuration management systems to control monitoring and measuring devices. • Establish an identification system to ensure that calibration status is always clear. • Calibrate or verify measuring equipment in order to ensure that results are valid. • Adjust or re-adjust your measuring equipment to make sure that results are valid. • Maintain a record of equipment calibration and verification activities and results. • Safeguard measuring equipment from adjustments that invalidate measurement results. • Protect your organization's measuring equipment from damage and deterioration. • Evaluate the validity of previous measurements if equipment fails to meet requirements. |
|
8.1 Planning
requirements and guidelines |
|
• Plan your monitoring, measurement, analysis, and improvement processes. • Plan how these processes will be used to show conformity and make improvements. • Implement monitoring, measurement, analytical, and improvement processes. • Use these processes to demonstrate conformity and make improvements. • Use monitoring to demonstrate conformity and make improvements. • Use measurement to demonstrate conformity and make improvements. • Use analytics to demonstrate conformity and make improvements. |
|
8.2 Research
requirements and guidelines |
|
8.2.1 Monitor and measure customer satisfaction |
|
• Determine methods for monitoring and measuring customer satisfaction (perceptions). • Establish methods that can find out how well customer requirements are being met. • Figure out how you’re going to get customer satisfaction (perception) information. • Figure out how you’re going to use customer satisfaction (perception) information. • Use your methods to monitor and measure customer satisfaction (their perceptions). • Use customer satisfaction information as a measure of QMS performance. |
|
8.2.2 Perform internal audits at planned intervals |
|
• Establish your organization's internal audit procedure. • Document your organization's internal audit procedure. • Specify how internal audits should be planned. • Specify how internal audits should be performed. • Specify how internal audit records should be kept. • Specify how internal audit results should be reported. • Implement your organization's internal audit procedure. • Maintain your organization's internal audit procedure. • Plan your organization's internal audit program. • Use your audit procedure to plan your audits. • Clarify the scope of your internal audit. • Establish your internal audit criteria. • Examine the results of previous audits. • Define and record your audit methods. • Consider the status and importance of audit areas. • Select impartial and objective internal auditors. • Specify how often audits should be performed. • Carry out your internal audits at planned intervals. • Determine if your organization's QMS meets specified requirements. • Determine if your organization's QMS conforms to planned arrangements. • Determine if your organization's QMS has been effectively implemented. • Eliminate all detected nonconformities and causes. • Follow-up on steps taken to resolve nonconformities. • Maintain a record of your audit activities and results. |
|
8.2.3 Find out if processes achieve planned results |
|
• Determine suitable methods to monitor and measure QMS processes. • Select methods that can find out if planned results are being achieved. • Select methods that are appropriate for each type of QMS process. • Apply suitable methods to monitor and measure each QMS process. • Determine whether or not each QMS process is achieving planned results. • Take remedial action whenever processes fail to achieve planned results. • Make corrections whenever a process fails to achieve planned results. • Apply corrective action whenever a process fails to achieve planned results. |
|
8.2.4 Verify that quality requirements are being met |
|
• Monitor and measure product and service characteristics. • Determine how well quality requirements are being met. • Use reviews to determine how well quality requirements are being met. • Use validations to determine how well quality requirements are being met. • Use verifications to determine how well quality requirements are being met. • Verify that product and service requirements are being met. • Verify products in accordance with planned arrangements. • Verify products at applicable stages during product realization. • Verify services in accordance with planned arrangements. • Verify services at applicable stages during service realization. • Decide if products should be released and services delivered. • Record product and service monitoring and measurement activities. • Retain evidence which shows that product acceptance criteria are being met. • Retain evidence which shows that service acceptance criteria are being met. |
|
8.3 Control
requirements and guidelines |
|
• Establish a nonconforming products procedure. • Document your nonconforming products procedure. • Document nonconforming product responsibilities. • Document how nonconforming products are identified. • Document when nonconforming products are controlled. • Document how nonconforming products are controlled. • Document how nonconforming products are recorded. • Document how nonconforming products are reported. • Implement nonconforming products procedure. • Identify your nonconforming products. • Investigate nonconforming products. • Prioritize software nonconformities. • Specify when controls are applied. • Control nonconforming products. • Prevent unintended use or delivery. • Eliminate detected nonconformities. • Address the effects of nonconforming products. • Authorize nonconforming product concessions. • Report discovered software problems and impacts. • Maintain a record of all product nonconformities. • Track the investigation and resolution of nonconformities. • Maintain nonconforming products procedure. |
|
8.4 Analytical
requirements and guidelines |
|
• Determine QMS data needs and requirements. • Identify the data needed to demonstrate that your QMS is suitable. • Identify the data needed to demonstrate that your QMS is effective. • Identify the data needed to improve QMS effectiveness. • Collect data about your organization’s QMS. • Monitor your organization’s QMS. • Measure your organization’s QMS. • Provide information by analyzing QMS data. • Provide information about your customers. • Provide information about your suppliers. • Provide information about your products. • Provide information about your processes. |
|
8.5 Implementation
requirements and guidelines |
|
8.5.1 Improve quality management system |
|
• Establish an improvement process. • Apply it to software life cycle processes. • Improve the effectiveness of your QMS. • Use audit results to continually improve the effectiveness of your QMS. • Use data analysis to continually improve the effectiveness of your QMS. • Use quality policy to continually improve the effectiveness of your QMS. • Use quality objectives to continually improve the effectiveness of your QMS. • Use corrective actions to continually improve the effectiveness of your QMS. • Use preventive actions to continually improve the effectiveness of your QMS. • Use management reviews to continually improve the effectiveness of your QMS. |
|
8.5.2 Correct actual nonconformities |
|
• Establish a corrective action procedure. • Figure out how you're going to prevent the recurrence of actual nonconformities. • Figure out how you're going to manage and control your corrective actions. • Document a corrective action procedure. • Describe how actual nonconformities will be analyzed. • Describe how actual causes will be determined. • Describe how corrective actions will be managed. • Implement a corrective action procedure. • Analyze actual nonconformities. • Identify causes and study effects. • Evaluate the need for action. • Formulate corrective action. • Authorize corrective action. • Take timely corrective action. • Record corrective action results. • Review past corrective actions. • Maintain a corrective action procedure. |
|
8.5.3 Prevent potential nonconformities |
|
• Establish a preventive action procedure. • Figure out how you're going to prevent the occurrence of potential nonconformities. • Figure out how you're going to identify and anticipate potential process problems. • Document a preventive action procedure. • Describe how potential nonconformities will be identified and selected. • Describe how preventive actions will be managed and controlled. • Implement a preventive action procedure. • Identify potential nonconformities. • Determine causes of potential nonconformities. • Evaluate the need for action. • Formulate preventive actions. • Authorize preventive actions. • Take timely preventive actions. • Record preventive action results. • Review prior preventive actions.
• Maintain a preventive action procedure. |
|
Also see ISO 20000 on IT service management and ISO IEC 27001 on information security. |
 |
|
This web page summarizes ISO IEC 90003. It
highlights the Title 75 is detailed, accurate, and
complete. It uses language Title 75 is 146 pages long and comes in both pdf and MS doc file formats. |
|||
|
Praxiom Research Group Limited help@praxiom.com 780-461-4514 |
|||
|
Updated on February 4, 2017. First published on December 27, 2016. |
|||
|
Legal Restrictions on the Use of this Page Copyright © 2016 - 2017 by Praxiom Research Group Limited. All Rights Reserved. |
|||
