I N T E R N AT I O N AL I SO

S T AN D AR D 9000-3

S e co n d e d i ti o n

1 9 9 7- 1 2 - 1 5

Qu al i ty m an ag em en t an d q u al i ty assu ran ce
stan d ard s —

Part 3:
G u i d el i n es fo r th e ap p l i cati o n of

I SO 9001 : 1 994 to th e d e ve l o p m e n t, s u p p l y,

i n s tal l ati o n an d m ai n te n an ce of co m p u te r

s o ftware

N o rm e s po u r l e m an ag e m e n t de la q u al i té et l ' as s u ran ce de la q u al i té —

P arti e 3: Li g n e s d i re ctri ce s p o u r l ' ap p l i cati o n de l 'I SO 9001 : 1 994 au

d é ve l o p p e m e n t, à la m i se à d i s p o s i ti o n , à l ' i n s tal l ati o n et à la m ai n te n an ce

de l o g i ci e l

A I SO
R e fe re n ce n u m be r

9000-3: 1 997(E)
I SO 9000-3: 1 997(E)

Con ten ts P ag e

1 Scope . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

2 N orm ati ve referen ces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

3 Defi n i ti on s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1

4 Qu al i ty system req u i rem en ts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

4. 1 Man ag em en t respon si bi l i ty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2

4. 2 Qu al i ty system . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

4. 3 Con tract revi ew .......................................................................... 5

4. 4 Desi g n con trol ............................................................................ 7

4. 5 Docu m en t an d d ata con trol . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14

4. 6 Pu rch asi n g . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15

4. 7 Con trol of cu stom er-su ppl i ed prod u ct .................................... 16

4. 8 Prod u ct i d en ti fi cati on an d traceabi l i ty . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

4. 9 Process con trol .......................................................................... 18

4. 1 0 I n specti on an d testi n g ........................................................... 19

4. 1 1 Con trol of i n specti on , m easu ri n g an d test eq u i pm en t . . . . . . . 22

4. 1 2 I n specti on an d test statu s ..................................................... 23

4. 1 3 Con trol of n on con form i n g prod u ct ...................................... 24

4. 1 4 Correcti ve an d preven ti ve acti on . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25

4. 1 5 H an d l i n g , storag e, packag i n g , preservati on an d

d el i very ................................................................................... 25

4. 1 6 Con trol of q u al i ty record s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

4. 1 7 I n tern al q u al i ty au d i ts ............................................................ 28

4. 1 8 Trai n i n g . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

4. 1 9 Servi ci n g . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28

4. 20 Stati sti cal tech n i q u es . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

An n ex A Bi bl i og raph y ...................................................................... 31

An n ex B Cross-referen ces to I SO/I EC 1 2207 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

© I SO 1 997

Al l ri g h ts res erved . U n l es s o th e rwi s e s peci fi e d , n o part o f th i s pu bl i cati o n m ay be re pro d u ced

o r u ti l i z e d i n an y fo rm o r by an y m ean s , e l ectro n i c o r m ech an i cal , i n cl u d i n g ph o to co pyi n g an d

m i cro fi l m , wi th o u t pe rm i s s i o n i n wri ti n g fro m th e p u bl i s h e r.

I n te rn ati o n al Org an i z ati o n fo r S tan d ard i z ati o n

C as e po s tal e 5 6 • CH -1 21 1 G e n ève 2 0 • S wi tz e rl an d

I n te rn e t ce n tral @ i s o . ch

X. 40 0 c= ch ; a= 40 0 n e t; p= i s o ; o = i s o cs ; s = ce n tral

P ri n te d i n S wi tz e rl an d

ii
© ISO I SO 9000-3: 1 997(E)

Foreword

ISO (the International Organization for Standardization) is a worldwide

federation of national standards bodies (ISO member bodies). The work of
preparing International Standards is normally carried out through ISO
technical committees. Each member body interested in a subject for which
a technical committee has been established has the right to be represented
on that committee. International organizations, governmental and non-
governmental, in liaison with ISO, also take part in the work. ISO
collaborates closely with the International Electrotechnical Commission
(IEC) on all matters of electrotechnical standardization.
Draft International Standards adopted by the technical committees are
circulated to the member bodies for voting. Publication as an International
Standard requires approval by at least 75 % of the member bodies casting
a vote.
International Standard ISO 9000-3 was prepared by Technical Committee
ISO/TC 1 76, Quality management and quality assurance, Subcommittee
SC 2, Quality systems.
This second edition cancels and replaces the first edition
(ISO 9000-3:1 991 ), which has been technically revised.
ISO 9000 consists of the following parts, under the general title Quality
management and quality assurance standards:
— Part 1 : Guidelines for selection and use
— Part 2: Generic guidelines for the application of ISO 9001 , ISO 9002
and ISO 9003
— Part 3: Guidelines for the application of ISO 9001 :1 994 to the
development, supply, installation and maintenance of computer
software
— Part 4: Guide to dependability programme management.
Annexes A and B of this part of ISO 9000 are for information only.

iii
I SO 9000-3: 1 997(E) © I SO

I n trod u cti on

Th i s p art of I SO 9000 pro vi d e s g u i d an c e in ap p l yi n g th e re q u i re m e n ts of

I SO 9001 : 1 994 wh e re c o m p u te r s o ftware desi g n , d e ve l o p m e n t, i n s tal l ati o n

an d m ai n te n an ce are an el em en t of th e bu si n ess of a s u p p l i e r:

a) as p art of a co m m e rci al co n tract wi th an e xte rn al o rg an i z ati o n ;

b) as a p ro d u ct avai l ab l e fo r a m arke t s e cto r;

c) in s u p p o rt of th e bu si n e ss p ro ce s s e s of th e s u p p l i e r;

d) as s o ftware e m be d d e d in a h ard ware p ro d u ct.

It i d e n ti fi e s th e i ssu es wh i c h n eed to be ad d re s s e d an d is i n d e pe n d e n t of

th e te ch n o l o g y, l i fe cycl e m od el s, d e ve l o p m e n t p ro ce s s e s , s e q u e n ce of

acti vi ti e s , or o rg an i z ati o n s tru ctu re u sed by a s u p p l i e r.

Wh e re th e s co pe of an o rg an i z ati o n ' s ac ti vi ti e s i n cl u d e s are as o th e r th an

c o m pu te r s o ftware d e ve l o pm e n t, th e re l ati o n s h i p be twe e n th e c o m p u te r

s o ftware e l e m e n ts of th at o rg an i z ati o n ' s q u al i ty s ys te m an d th e re m ai n i n g

as p e ct s sh ou l d be cl e arl y d o cu m e n te d wi th i n th e q u al i ty s ys te m as a

wh o l e .

Th i s p art of I SO 9000 p ro vi d e s g u i d el i n es fo r th e ap pl i c ati o n of

I SO 9 0 0 1 : 1 99 4. Wh ere text h as been q u oted from I SO 9001 : 1 994, th at

text i s en cl osed i n a box, for ease of i d en ti fi cati on .

Th ro u g h o u t th i s p art of I SO 9000, “ s h al l ” is u sed to e x p re s s a p ro vi s i o n th at

is bi n d i n g b e twe e n two or m o re p arti e s ; “ wi l l ” to e x p re s s a d e c l arati o n of

p u rp o s e , or i n te n t, of on e p arty; “sh ou l d ” to e x p re s s a re c o m m e n d ati o n

am o n g po s s i b i l i ti e s ; an d “ m ay” to i n d i c ate a c o u rs e of ac ti o n p e rm i s s i bl e

wi th i n th e l i m i ts of th i s p arts of I SO 9000.

iv
I NTERN ATI ON AL STANDARD © I SO I SO 9000-3: 1 997(E)

Qu al i ty m an ag em en t an d q u al i ty assu ran ce stan d ard s —

Part 3:
G u i d el i n es for th e appl i cati on of I SO 9001 : 1 994 to th e d evel opm en t,
su ppl y, i n stal l ati on an d m ai n ten an ce of com pu ter software

1 Scope

Thi s part of I SO 9000 sets ou t gui deli nes to faci li tate th e appl icati on of I SO 9001 :1 994 for organizati ons devel oping,
su pplying, i nstal li ng and maintai ni ng compu ter software. I t does not add to, or otherwise ch ange, the requi rements of
I SO 9001 .

Th is part of I SO 9000 is not intended to be u sed as assessm ent criteria in qu ality system registration/certification.

2 N orm ati ve referen ces

The followi ng standards contai n provi sions wh ich , th rou gh reference i n th is text, consti tu te provisi ons of thi s part of
I SO 9000. At th e time of pu bl ication, th e edi ti ons i ndicated were val id. Al l standards are subject to revision, and parties
to agreements based on thi s part of I SO 9000 are encou raged to investigate th e possibil ity of appl ying th e most recent
edi ti on of th e standards i ndicated below. Mem bers of I EC and I SO m ai ntain regi sters of cu rrentl y val id I nternati onal
Standards.

I SO 8402:1 994, Quali ty management and quali ty assurance — Vocabulary.

I SO 9001 :1 994, Qu ality systems — Model for quality assu rance in design, development, produ ction, installation and
servicing.

3 Defi n i ti on s

For th e purposes of th is part of I SO 9000, the definitions given in I SO 8402 and th e fol lowing definitions apply.

3. 1 prod u ct: Resu l t of acti vi ti es or processes.

N OTE 1 A prod u ct m ay i n cl u d e servi ce, h ard ware, processed m ateri al s, software or a com bi n ati on th ereof.

N OTE 2 A prod u ct can be tan g i bl e (e. g . assem bl i es or processed m ateri al s) or i n tan g i bl e (e. g . kn owl ed g e or con cepts) , or a

com bi n ati on th ereof.

N OTE 3 For th e pu rposes of th i s I n tern ati on al Stan d ard , th e term “prod u ct” appl i es to th e i n ten d ed prod u ct offeri n g on l y an d

n ot to u n i n ten d ed “by-prod u cts” affecti n g th e en vi ron m en t. Th i s d i ffers from th e d efi n i ti on g i ven i n I SO 8402.

[I SO 9001 ]

3. 2 ten d er: Offer m ad e by a su ppl i er i n respon se to an i n vi tati on to sati sfy a con tract award to provi d e prod u ct.
[I SO 9001 ]

1
I SO 9000-3: 1 997(E) © I SO

3. 3 con tract: Ag re e d re q u i re m e n ts b e twe e n a su ppl i e r an d cu s to m e r tran s m i tte d by an y m e an s .

[I S O 9001 ]

3. 4 basel i ne: A fo rm al l y ap p ro ve d ve rs i o n of a c o n fi g u rati o n i te m , re g ard l e s s of m e d i a, fo rm al l y d e s i g n ate d an d

fi xe d at a s pe ci fi c ti m e d u ri n g th e co n fi g u rati o n i te m ' s l i fe cycl e .

[I S O /I E C 1 22 0 7]

3. 5 d evel opm en t: S o ftware l i fe cycl e p ro ce s s th at co m p ri s e s th e acti vi ti e s of re q u i re m e n ts an al ys i s , d esi g n ,

co d i n g , i n te g rati o n , te s ti n g , i n s tal l ati o n an d s u p p o rt fo r acce p tan ce of s o ftware p ro d u cts .

3. 6 l i fe cycl e m od el : A fram e wo rk co n tai n i n g th e p ro ce s s e s , acti vi ti e s , an d tas ks i n vo l ve d in th e d e ve l o p m e n t,

o p e rati o n , an d m ai n te n an ce of a s o ftware p ro d u ct, s p an n i n g th e l i fe of th e s ys te m fro m th e d e fi n i ti o n of i ts

re q u i re m e n ts to th e te rm i n ati o n of i ts u se.

[I S O /I E C 1 22 0 7]

3. 7 ph ase: D e fi n e d seg m en t of wo rk.

N O TE — A p h as e d oes n ot i m pl y th e u se of an y s p e c i fi c l i fe cyc l e m od el .

3. 8 reg ressi on testi n g : Te s ti n g to d e te rm i n e th at c h an g e s m ad e in o rd e r to c o rre c t d e fe c ts h ave n ot i n tro d u c e d

ad d i ti o n al d e fe cts .

3. 9 repl i cati on : C o p yi n g a s o ftware p ro d u ct fro m on e m ed i u m to an o th e r.

3. 1 0 software: See s o ftware p ro d u ct (3. 1 1 ) .

N O TE — In th i s p art of I SO 9000, th e te rm “ s o ft ware ” is co n fi n e d to co m p u te r s o ftware .

3. 1 1 software prod u ct: Th e set of c o m p u te r p ro g ram s , pro c e d u re s , an d p o s s i bl y as s o c i ate d d o c u m e n tati o n an d

d ata.

[I S O /I E C 1 22 0 7]

N O TE — A s o ftware p ro d u c t m ay be d e s i g n ate d fo r d e l i ve ry, an i n te g ral p art of an o t h e r p ro d u c t, or u sed in th e d e ve l o p m e n t

p ro ce s s .

3. 1 2 software i tem : An y i d e n ti fi ab l e part of a s o ftware p ro d u ct.

4 Qu al i ty system req u i rem en ts

4. 1 Man ag em en t respon si bi l i ty

4. 1 . 1 Qu al i ty pol i cy

Th e s u ppl i e r' s m an ag e m e n t wi th exe cu ti ve res po n s i bi l i ty s h al l d e fi n e an d d o cu m en t i ts po l i cy fo r

q u al i ty i n cl u d i n g o bj ecti ves fo r q u al i ty an d i ts co m m i tm e n t to q u al i ty. Th e q u al i ty po l i cy s h al l be

re l e van t to th e s u ppl i e r' s o rg an i z ati o n al g o al s an d th e expe ctati o n s an d n e ed s of i ts cu s to m e rs . Th e

s u ppl i er s h al l e n s u re th at th i s po l i cy is u n d e rs to o d , i m pl em en te d an d m ai n tai n ed at al l l e ve l s of th e

o rg an i z ati o n .

No fu rth er s o ftware- re l ate d g u i d an ce is pro vi d e d .

2
© I SO I SO 9000-3: 1 997(E)

4. 1 . 2 Org an i zati on

4.1 .2.1 Responsibility and authority

Th e res po n s i bi l i ty, au th o ri ty an d th e i n te rrel ati o n of pe rs o n n el wh o m an ag e, perfo rm an d ve ri fy wo rk

affecti n g q u al i ty s h al l be d e fi n e d an d d o cu m e n ted , parti cu l arl y fo r pe rs o n n el wh o n ee d th e

o rg an i z ati o n al free d o m an d au th o ri ty to :

a) i n i ti ate acti o n to pre ven t th e o ccu rre n ce o f an y n o n co n fo rm i ti e s re l ati n g to pro d u ct, pro ces s an d

q u al i ty s ys tem ;

b) i d e n ti fy an d re co rd an y pro bl e m s re l ati n g to th e pro d u ct, pro ces s an d q u al i ty s ys tem ;

c) i n i ti ate , re co m m e n d o r pro vi d e s o l u ti o n s th ro u g h d e s i g n ate d ch an n e l s ;

d) ve ri fy th e i m pl em en tati o n o f s o l u ti o n s ;

e) co n tro l fu rth er pro ces s i n g , d el i very or i n s tal l ati o n of n o n co n fo rm i n g pro d u ct u n ti l th e d e fi ci e n cy

o r u n s ati s facto ry co n d i ti o n h as be en co rre cte d .

No fu rth er s o ftware- re l ate d g u i d an ce is pro vi d e d .

4.1 .2.2 Resources

Th e s u ppl i er s h al l i d e n ti fy res o u rce re q u i re m e n ts an d pro vi d e ad eq u ate re s o u rce s , i n cl u d i n g th e

as s i g n m en t of trai n ed pe rs o n n el (see 4. 1 8) , fo r m an ag e m e n t, perfo rm an ce of wo rk an d veri fi cati o n

acti vi ti es i n cl u d i n g i n tern al q u al i ty au d i ts .

No fu rth er s o ftware - re l ate d g u i d an ce is pro vi d e d .

N O TE — Fo r fu rt h e r i n fo rm ati o n see I S O /I E C 1 2 20 7: 1 9 9 5, s u b c l au s e 7. 2.

4.1 .2.3 Management representative

Th e s u ppl i er' s m an ag em en t wi th e xecu ti ve res po n s i bi l i ty s h al l appo i n t a m e m be r of th e s u ppl i er' s

o wn m an ag e m e n t wh o , i rres pecti ve o f o th er res po n s i bi l i ti e s , s h al l h ave d efi n ed au th o ri ty fo r:

a) en s u ri n g th at a q u al i ty sys te m is es tabl i s h ed , i m pl em e n te d an d m ai n tai n e d in acco rd an ce wi th

th i s I n te rn ati o n al S tan d ard , an d ;

b) re po rti n g on th e pe rfo rm an ce o f th e q u al i ty s ys tem to th e s u ppl i e r' s m an ag e m e n t fo r re vi e w an d

as a bas i s fo r i m pro ve m e n t o f th e q u al i ty sys te m .

N O TE 5 Th e re s p o n s i b i l i t y of a m an ag e m e n t re p re s e n t ati ve m ay al s o i n cl u d e l i ai s o n wi th e x te rn al p art i e s

on m at t e rs re l at i n g to th e s u p p l i e r' s q u al i ty s ys te m .

No fu rth er s o ftware- re l ate d g u i d an ce is pro vi d e d .

N O TE — Fo r fu rt h e r i n fo rm at i o n , see I S O /I E C 1 2207: 1 995, s u b cl au s e 6. 3. 1 . 6.

4. 1 . 3 Man ag em en t revi ew

Th e s u ppl i e r' s m an ag e m en t wi th execu ti ve res po n s i bi l i ty s h al l re vi e w th e q u al i ty s ys tem at d e fi n e d

i n terval s s u ffi ci e n t to en s u re i ts co n ti n u i n g s u i tabi l i ty an d e ffecti ve n e s s in s ati s fyi n g th e req u i re m e n ts

of th i s I n tern ati o n al S tan d ard an d th e s u ppl i er' s s tate d q u al i ty po l i cy an d o bj e cti ves (see 4. 1 . 1 ) .

R eco rd s o f s u ch re vi ews s h al l be m ai n tai n ed (see 4. 1 6 ) .

3
I SO 9000-3: 1 997(E) © I SO

No fu rth er s o ftware- re l ate d g u i d an ce is pro vi d e d .

N O TE — For fu rth e r i n fo rm at i o n , see I S O /I E C 1 22 0 7: 1 9 9 5, s u b c l au s e 7. 1 . 4.

4. 2 Qu al i ty system

4. 2. 1 G en eral

Th e s u ppl i e r s h al l e s tabl i s h , d o cu m e n t an d m ai n tai n a q u al i ty s yste m as a m e an s of e n su ri n g th at

pro d u ct co n fo rm s to s peci fi ed re q u i rem en ts . Th e s u ppl i e r s h al l prepare a q u al i ty m an u al co ve ri n g

th e re q u i re m e n ts of th i s I n te rn ati o n al S tan d ard . Th e q u al i ty m an u al s h al l i n cl u d e or m ake re fe re n ce

to th e q u al i ty s ys tem pro ce d u re s an d o u tl i n e th e stru ctu re of th e d o cu m e n tati o n u s ed in th e q u al i ty

s ys tem .

N O TE 6 G u i d an c e on q u al i ty m an u al s is g i ve n in I SO 1 001 3.

No fu rth er s o ftware- re l ate d g u i d an ce is pro vi d e d .

4. 2. 2 Qu al i ty system proced u res

Th e s u ppl i e r s h al l :

a) prepare d o cu m en ted pro ce d u res co n s i s te n t wi th th e req u i rem e n ts of th i s I n tern ati o n al

S tan d ard an d th e s u ppl i er' s s tated q u al i ty po l i cy, an d ;

b) e ffecti ve l y i m pl e m en t th e q u al i ty s ys te m an d i ts d o cu m e n te d pro ce d u re s .

Fo r th e pu rpo s e of th i s I n te rn ati o n al S tan d ard , th e ran g e an d d e tai l of th e pro ce d u res th at fo rm part

of th e q u al i ty s ys tem s h al l be d e pe n d e n t u po n th e co m pl exi ty of th e wo rk, th e m e th o d s u sed , an d

th e s ki l l s an d trai n i n g n e ed ed by pe rs o n n el i n vo l ve d in carryi n g o u t th e acti vi ty.

N O TE 7 D o cu m e n te d p ro ce d u re s m ay m ake re fe re n c e to wo rk i n s tru c ti o n s t h at d e fi n e h ow an ac t i vi t y is

p e rfo rm e d .

No fu rth er s o ftware- re l ate d g u i d an ce is pro vi d e d .

4. 2. 3 Qu al i ty pl an n i n g

Th e s u ppl i er s h al l d efi n e an d d o cu m en t h ow th e re q u i re m e n ts fo r q u al i ty wi l l be m e t. Q u al i ty

pl an n i n g s h al l be co n s i s te n t wi th al l o th er re q u i re m e n ts of a s u ppl i e r' s q u al i ty sys te m an d s h al l be

d o cu m e n ted in a fo rm at to su i t th e s u ppl i e r' s m e th o d of o pe rati o n . Th e s u ppl i e r s h al l g i ve

co n s i d e rati o n to th e fo l l o wi n g acti vi ti e s , as appro pri ate, in m ee ti n g th e s peci fi ed re q u i rem en ts fo r

pro d u cts , pro j e cts o r co n tracts :

a) th e pre parati o n o f q u al i ty pl an s ;

b) th e i d en ti fi cati o n an d acq u i s i ti o n of an y co n tro l s , pro ce s s e s , e q u i pm e n t ( i n cl u d i n g i n s pe cti o n

an d tes t e q u i pm e n t) , fi xtu re s , res o u rces an d s ki l l s th at m ay be n ee d e d to ach i eve th e re q u i red

q u al i ty;

c) en s u ri n g th e co m pati bi l i ty of th e d esi g n , th e pro d u cti o n pro ces s , i n s tal l ati o n , s ervi ci n g ,

i n s pe cti o n an d te s t pro ced u res an d th e appl i cabl e d o cu m e n tati o n .

d) th e u pd ati n g , as n ece s s ary, of q u al i ty co n tro l , i n s pe cti o n an d te s ti n g te ch n i q u e s , i n cl u d i n g th e

d e vel o pm e n t o f n ew i n s tru m en tati o n ;

e) th e i d e n ti fi cati o n of an y m e as u re m e n t re q u i re m e n t i n vo l vi n g capabi l i ty th at exce ed s th e kn o wn

s tate o f th e art, in s u ffi ci en t ti m e fo r th e n e ed ed capabi l i ty to be d e vel o pe d ;

4
© I SO I SO 9000-3: 1 997(E)

f) th e i d e n ti fi cati o n o f s u i tabl e ve ri fi cati o n at appro pri ate s tag es in th e re al i z ati o n o f pro d u ct;

g) th e cl ari fi cati o n of s tan d ard s of acce ptabi l i ty fo r al l fe atu res an d req u i re m e n ts , i n cl u d i n g th o s e

wh i ch co n tai n a s u bj e cti ve el em en t;

h) th e i d e n ti fi cati o n an d preparati o n o f q u al i ty reco rd s ( s ee 4. 1 6) .

N O TE 8 Th e q u al i t y p l an s re fe rre d to [se e 4 . 2 . 3 a) ] m ay be in th e fo rm of a re fe re n c e to th e ap p ro p ri ate

d o cu m e n te d p ro ce d u re s t h at fo rm an i n t e g ral p art of th e s u p p l i e r' s q u al i t y s ys te m .

Q u al i ty pl an n i n g sh ou l d ad d res s th e fo l l o wi n g i te m s , as appro pri ate:

a) q u al i ty req u i re m e n ts , e xpres s e d in m e as u rabl e term s , wh e re appro pri ate ;

b) th e l i fe cycl e m od el to be u sed fo r s o ftware d e ve l o pm e n t;

c) d e fi n e d cri te ri a fo r s tarti n g an d en d i n g e ach pro j e ct ph as e;

d) i d e n ti fi cati o n o f types o f re vi e ws , te s ts an d o th e r veri fi cati o n an d val i d ati o n acti vi ti es to be carri e d o u t;

e) i d e n ti fi cati o n of co n fi g u rati o n m an ag em en t pro ced u res to be carri e d o u t;

f) d etai l e d pl an n i n g ( i n cl u d i n g s ch e d u l e s , pro ce d u re s , re s o u rces an d appro val ) an d s peci fi c re s po n s i bi l i ti e s an d

au th o ri ti es fo r:

— co n fi g u rati o n m an ag em en t,

— ve ri fi cati o n an d val i d ati o n o f d eve l o pe d pro d u cts ,

— ve ri fi cati o n an d val i d ati o n o f pu rch as ed pro d u cts ,

— ve ri fi cati o n o f cu s to m er- s u ppl i ed pro d u cts ,

— co n tro l o f n o n co n fo rm i n g pro d u ct an d co rrecti ve acti o n ,

— as s u ri n g th at acti vi ti e s d e s cri be d in th e q u al i ty pl an are carri e d o u t.

A q u al i ty pl an pro vi d e s th e m e an s fo r tai l o ri n g th e appl i cati o n of th e q u al i ty s ys te m to a s pe ci fi c pro j e ct, pro d u ct or

co n tract.

A q u al i ty pl an m ay i n cl u d e or re fe re n ce g en e ri c an d /o r pro j e ct/pro d u ct/co n tract- s peci fi c pro ced u res , as appro pri ate . A

q u al i ty pl an sh ou l d be u pd ate d al o n g wi th th e pro g re s s of th e d e vel o pm e n t, an d i tem s co n ce rn ed wi th each ph as e

sh ou l d be co m pl e te l y d efi n ed wh e n s tarti n g th at ph as e .

A q u al i ty pl an sh ou l d be revi e we d an d ag ree d by al l o rg an i z ati o n s co n cern e d in i ts i m pl e m e n tati o n .

Th e d o cu m e n t th at d e s cri be s a q u al i ty pl an m ay be an i n d e pe n d e n t d o cu m e n t ( en ti tl ed q u al i ty pl an ) , a part of an o th er

d o cu m e n t, o r co m po s ed o f s e veral d o cu m en ts .

A q u al i ty pl an m ay i n cl u d e, o r refe re n ce , th e pl an s fo r u n i t, i n te g rati o n , s ys te m an d acce ptan ce te sts . G u i d an ce on te s t

pl an n i n g an d th e te s t e n vi ro n m en t i s pro vi d ed as part o f i n s pecti o n an d te s ti n g .

N O TE — G u i d an c e on q u al i ty p l an s is g i ve n in I SO 1 0005 an d on c o n fi g u rati o n m an ag e m e n t in I SO 1 0 0 0 7. Fo r fu rt h e r

i n fo rm at i o n , see I S O /I E C 1 2207: 1 995, s u b cl au s e s 6. 2 to 6. 5.

4. 3 Con tract revi ew

4.3.1 G eneral

Th e s u ppl i er s h al l es tabl i s h an d m ai n tai n d o cu m e n ted pro ce d u re s fo r co n tract re vi e w an d fo r th e

co o rd i n ati o n o f th e s e acti vi ti e s .

S o ftware m ay be d e ve l o ped as part of a co n tract, as a pro d u ct avai l abl e fo r a m arket s ecto r, as s o ftware e m bed d e d in

a h ard ware pro d u ct, or in s u ppo rt of th e bu s i n e s s pro ces s e s of th e s u ppl i er. C o n tract revi e w is appl i cabl e in al l th es e

ci rcu m s tan ces .

5
I SO 9000-3: 1 997(E) © I SO

4.3.2 Review

B efo re s u bm i s s i o n of a te n d er, or th e acceptan ce of a co n tract or o rd er ( s tatem en t of req u i re m e n t) ,

th e te n d er, co n tract o r o rd e r s h al l be re vi e we d by th e s u ppl i e r to en s u re th at:

a) th e req u i re m e n ts are ad e q u ate l y d e fi n ed an d d o cu m en te d ; wh ere no wri tte n s tate m e n t of

re q u i rem en t is avai l abl e fo r an o rd e r rece i ved by verbal m e an s , th e s u ppl i e r s h al l e n s u re th at

th e o rd e r req u i re m e n ts are ag ree d be fo re th e i r acceptan ce ;

b) an y d i ffe re n ce s betwe en th e co n tract or o rd er req u i re m e n ts an d th o s e in th e te n d er are

re s o l ve d ;

c) th e s u ppl i e r h as th e capabi l i ty to m e et th e co n tract o r o rd e r re q u i rem en ts .

Th e fo l l o wi n g co n cern s m ay al s o be re l e van t d u ri n g th e s u ppl i e r' s re vi ew o f s o ftware ten d ers , co n tracts , o r o rd ers .

a) C u s to m e r- rel ate d co n ce rn s :

— th e te rm i n o l o g y to be u sed , is ag ree d by th e rel evan t parti e s ;

— th e cu s to m er h as th e capabi l i ty an d re s o u rce s to m ee t th e d efi n ed co n tractu al o bl i g ati o n s ;

— ag ree d cri teri a fo r cu s to m er to accept o r re j e ct pro d u ct;

— th e cu s to m er' s res po n s i bi l i ti e s in th e pro vi s i o n of d ata an d rel ated faci l i ti e s ;

— th e exten t to wh i ch th e cu s to m er i s to parti ci pate in j o i n t d e vel o pm e n t o r i n s u bco n tracted wo rk;

— th e arran g em en ts fo r j o i n t re vi ews to m o n i to r pro g res s o f th e co n tract;

— th e ag ree d pro ce d u re fo r h an d l i n g ch an g e s in cu s to m er' s re q u i rem en ts d u ri n g th e d e vel o pm e n t an d /o r

m ai n te n an ce;

— l i fe - cycl e pro ce s s e s i m po s e d by th e cu s to m e r;

— h an d l i n g o f pro bl e m s d etected afte r acce ptan ce , i n cl u d i n g cu s to m e r co m pl ai n ts an d cl ai m s ;

— th e re s po n s i bi l i ty fo r re m o val o f n o n co n fo rm i ti es afte r an y warran ty peri o d ;

— an y o bl i g ati o n s fo r th e cu s to m er to u pg rad e to a s u bs e q u e n t vers i o n wh e n th e s u ppl i er d i ctates , or fo r th e

s u ppl i er to m ai n tai n h i s to ri c ve rs i o n s ;

— d epl o ym e n t an d as s o ci ated u s e r trai n i n g .

b) Te ch n i cal co n cern s :

— th e fe as i bi l i ty o f m ee ti n g th e req u i re m e n ts ;

— th e s o ftware d eve l o pm en t s tan d ard s an d pro ce d u res to be u s ed ;

— faci l i ti es , to o l s , s o ftware i te m s an d d ata, to be pro vi d ed by th e cu s to m e r, are i d en ti fi ed an d m e th o d s d e fi n e d

an d d o cu m e n te d to as s e s s th e i r s u i tabi l i ty fo r u s e ;

— th e o pe rati n g s ys tem o r h ard ware pl atfo rm ;

— ag ree m e n t o n th e co n tro l o f i n terface s wi th th e s o ftware pro d u ct;

— re pl i cati o n an d d i s tri bu ti o n req u i rem e n ts .

c) M an ag e m e n t co n cern s :

— po s s i bl e co n ti n g e n ci es o r ri s ks are i d e n ti fi e d an d th e i m pact o f th e s e on s u bs e q u en t acti vi ti e s are as se s s e d ;

— th e s u ppl i e r' s res po n s i bi l i ty wi th reg ard to s u bco n tracte d wo rk;

— s ch ed u l i n g o f pro g re s s , tech n i cal revi e ws an d d el i ve rabl es ;

— i n s tal l ati o n , m ai n ten an ce an d s u ppo rt re q u i rem en ts ;

— th e ti m el y avai l abi l i ty o f te ch n i cal , h u m an an d fi n an ci al re s o u rces .

d) Le g al , s e cu ri ty an d co n fi d e n ti al i ty co n cern s :

— i n fo rm ati o n h an d l e d u n d er th e co n tract m ay be s u bj ect to co n ce rn s reg ard i n g I n te l l ectu al P ro pe rty R i g h ts ,

l i cen ce ag ree m e n ts , co n fi d en ti al i ty an d th e pro te cti o n o f s u ch i n fo rm ati o n ;

— g u ard i an s h i p of th e m as te r co py of th e pro d u ct an d th e ri g h ts of th e cu s to m e r to acce s s or ve ri fy th at m as ter

co py;

— th e l e vel o f i n fo rm ati o n d i s cl o s u re to th e cu s to m e r n e e d s to be m u tu al l y ag re ed to by th e parti e s ;

— d efi n i ti o n o f warran ty term s ;

— l i abi l i ti e s /pe n al ti e s as s o ci ate d wi th th e co n tract.

N O TE — Fo r fu rt h e r i n fo rm at i o n , see I S O /I E C 1 2207: 1 995, s u b cl au s e s 5. 2. 1 , 5. 2. 6 an d 6. 4. 2. 1 .

6
© I SO I SO 9000-3: 1 997(E)

4.3.3 Amendment to a contract

Th e s u ppl i e r s h al l i d en ti fy h ow an am e n d m en t to a co n tract is m ad e an d co rre ctl y tran s ferre d to th e

fu n cti o n s co n ce rn ed wi th i n th e s u ppl i e r' s o rg an i z ati o n .

No fu rth er s o ftware - re l ate d g u i d an ce is pro vi d e d .

N O TE — Fo r fu rt h e r i n fo rm ati o n , see I S O /I E C 1 220 7: 1 9 9 5 , s u b cl au s e s 5. 1 . 3. 5 an d 5. 2. 3. 2.

4.3.4 Records

R eco rd s o f co n tract re vi e ws s h al l be m ai n tai n e d (see 4. 1 6 ) .

N OTE 9 C h an n e l s fo r co m m u n i cati o n an d i n te rface s wi th th e cu s to m e r' s o rg an i z ati o n in th e s e co n tract

m atte rs sh ou l d be e s tabl i s h e d .

No fu rth er s o ftware- re l ate d g u i d an ce is pro vi d e d .

4. 4 Desi g n con trol

4.4.1 G eneral

Th e s u ppl i er s h al l es tabl i s h an d m ai n tai n d o cu m e n te d pro ced u res to co n tro l an d ve ri fy th e d es i g n of

th e pro d u ct i n o rd er to e n s u re th at th e s pe ci fi e d re q u i re m e n ts are m e t.

Th i s s u bcl au s e pro vi d e s g u i d an ce on th e d e vel o pm e n t acti vi ti es o f req u i re m e n ts an al ys i s , arch i tectu ral d esi g n , d e tai l ed

d es i g n an d co d i n g . Th i s s u bcl au s e al s o co n tai n s g u i d an ce on d e vel o pm e n t pl an n i n g .

A s o ftware d e ve l o pm e n t pro j e ct sh ou l d be o rg an i z e d acco rd i n g to on e or m o re l i fe cycl e m o d e l s. P ro ce s s e s, acti vi ti es

an d tas ks sh ou l d be pl an n e d an d pe rfo rm e d acco rd i n g to th e n atu re of th e l i fe cycl e m od el u sed . Th e l i fe cycl e m od el

u s ed m ay be ad apte d to su i t parti cu l ar pro j e ct n e ed s . Th i s part of I SO 9000 is i n te n d e d fo r appl i cati o n i rre s pe cti ve of

th e l i fe cycl e m od el u sed an d is n o t i n te n d e d to i n d i cate a s pe ci fi c l i fe cycl e m od el .

A l i fe cycl e m od el i d e n ti fi e s a set of pro ce ss e s an d spe ci fi es wh en an d h o w th e pro ces s e s are i n vo ke d . Th e s e q u e n ce

in wh i ch th e pro ces s e s are d es cri bed in th i s part of I SO 9000 d o es n ot s u g g es t in an y way th e s e q u en ce in wh i ch th ey

are pe rfo rm e d .

Th e d eve l o pm en t pro ce s s is th at wh i ch tran s fo rm s th e re q u i re m e n ts i n to a s o ftware pro d u ct. Th i s pro ce s s sh ou l d be

carri ed ou t in a d i s ci pl i n ed m an n e r, in o rd e r to preve n t th e i n tro d u cti o n of erro rs . Th i s appro ach re d u ce s d epen d en ce

on th e ve ri fi cati o n an d val i d ati o n pro ce s s es as th e sol e m e th o d s fo r i d e n ti fyi n g pro bl em s . Th e s u ppl i e r sh ou l d

th e re fo re e s tabl i s h an d m ai n tai n d o cu m e n te d pro ce d u re s th at e n s u re th at th e s o ftware pro d u cts are d e vel o ped in

co m pl i an ce wi th s peci fi ed re q u i rem en ts an d in acco rd an ce wi th th e d e ve l o pm e n t pl an an d /o r q u al i ty pl an .

Th e fo l l o wi n g as pects i n h eren t to th e d esi g n acti vi ti es sh ou l d be take n i n to acco u n t:

a) Desi g n m e th o d : a d es i g n m e th o d sh ou l d be s ys tem ati cal l y u s ed . C o n s i d e rati o n sh ou l d be g i ve n to th e s u i tab i l i ty

of th at m e th o d fo r th e type of tas k, pro d u ct or pro j ect an d th e co m pati bi l i ty of th e appl i cati o n , th e m eth o d s an d th e

to o l s to be u sed .

7
I SO 9000-3: 1 997(E) © I SO

b) U se of past experi en ces: u ti l i zi n g l esson s l earn ed from past experi en ces, th e su ppl i er sh ou l d avoi d recu rren ces

of th e sam e or si m i l ar probl em s by appl yin g l esson s l earn ed from previ ou s proj ects, an al ysi s of m etri cs an d post-

proj ect revi ews.

c) Su bsequ en t processes: to th e exten t practi cal , th e software produ ct sh ou l d be desi g n ed to faci l i tate testi n g , i n stal l -

ati on , m ai n ten an ce an d u se.

d) Secu ri ty an d safety: speci al con si derati on sh ou l d be g i ven to th e desi gn for testabi l i ty or val i dati on . For produ cts

wh ere fai l u re m ay cau se dam age to peopl e, property or th e en vi ron m en t, desi gn of su ch software sh ou l d en su re

defi n i ti on of speci fi c desig n requ i rem en ts th at speci fy desi red i m m u n i ty from , an d system respon se to, poten ti al

fai l u re con di ti on s.

For codi n g, ru l es for th e u se of program m i n g l an gu ages, con si sten t n am i n g con ven ti on s, codi n g an d adequ ate

com m en tary ru l es sh ou l d be speci fi ed an d observed. Su ch ru l es sh ou l d be docu m en ted an d con trol l ed.

Th e su ppl i er m ay u se tool s, faci l i ti es an d tech n i qu es i n order to m ake th e qu al i ty system g u i del i n es i n th i s part of I SO

9000 effecti ve. Th ese tool s, faci l i ti es an d tech n i qu es can be effecti ve for m an ag em en t pu rposes as wel l as for produ ct

devel opm en t an d/or servi ci n g . Wh eth er th ese tool s an d tech n i qu es are devel oped i n tern al l y, or pu rch ased, th e

su ppl i er sh ou l d eval u ate wh eth er or n ot th ey are fi t for pu rpose. Tool s u sed i n th e i m pl em en tati on of th e produ ct, su ch

as an al ysi s an d desi gn tool s, com pi l ers, an d assem bl ers sh ou l d be approved an d pl aced u n der an appropri ate l evel of

con fi g u rati on m an agem en t con trol , pri or to u se. Th e scope of u se of su ch tool s an d tech n i qu es sh ou l d be docu m en ted

an d th ei r u se revi ewed as appropri ate, to determ i n e wh eth er th ere i s a n eed to i m prove an d/or u pg rade th em .

Person n el m ay n eed trai n i n g in th e u se of su ch tool s an d tech n i qu es, at com m en cem en t of u sag e, or after an y

i m provem en ts/u pg rades.

4.4.2 Design and development planning

Th e su ppl i er sh al l prepare pl an s for each desi gn an d devel opm en t acti vi ty. Th e pl an s sh al l descri be

or referen ce th ese acti vi ti es, an d defi n e respon si bi l i ty for th ei r i m pl em en tati on . Th e desi gn an d

devel opm en t acti vi ti es sh al l be assi gn ed to qu al i fi ed person n el equ i pped wi th adequ ate resou rces.

Th e pl an s sh al l be u pdated as th e desi g n evol ves.

For software produ cts, devel opm en t pl an n i n g sh ou l d determ i n e th e acti vi ti es of requ i rem en ts an al ysi s, desi g n , codi n g ,

i n teg rati on , testi n g , i n stal l ati on an d su pport for acceptan ce of software produ cts. Devel opm en t pl an n i n g sh ou l d be

docu m en ted i n a devel opm en t pl an .

A devel opm en t pl an sh ou l d be revi ewed an d approved. A devel opm en t pl an m ay h ave oth er n am es su ch as “software

devel opm en t pl an ” or “software proj ect pl an ”.

A devel opm en t pl an m ay defi n e h ow th e proj ect i s to be m an ag ed, th e progress revi ews requ i red an d th e type an d

frequ en cy of reports to m an agem en t, th e cu stom er, an d oth er rel evan t parti es, taki n g i n to accou n t an y con tractu al

requ i rem en ts.

Devel opm en t pl an n i n g sh ou l d address th e fol l owi n g i tem s, as appropri ate:

a) th e defi n i ti on of th e proj ect, i n cl u di n g a statem en t of i ts obj ecti ves an d referen ce to an y rel ated cu stom er or

su ppl i er proj ects;

b) th e defi n i ti on of i n pu t an d ou tpu t of th e proj ect as a wh ol e;

c) th e org an i zati on of th e proj ect resou rces, i n cl u di n g th e team stru ctu re, respon si bi l i ti es, u se of su bcon tractors an d

m ateri al resou rces to be u sed;

d) organ i zati on al an d tech n i cal i n terfaces between di fferen t i n di vi du al s or grou ps, su ch as

— su b-proj ect team s,

— su bcon tractors,

8
© I SO I SO 9000-3: 1 997(E)

— users,
— custom er representatives,
— qu al ity assurance representati ve;

e) the i dentificati on of, or reference to

— devel opment activiti es to be carried ou t,

— requ ired inpu ts to each activity,
— requ ired ou tputs from each activity,
— management and su pporti ng acti viti es to be carried ou t;

f) th e analysis of th e possible risks, assu mptions, dependencies and problem s associated with th e developm ent;

g) the sch edul e i dentifying

— th e phases of th e project,
— th e work to be perform ed (the i npu ts to, outpu ts from and definition of each task) ,
— th e associated resou rces and ti mi ng,
— th e associated dependenci es,
— the mi lestones;

h) the i dentificati on of

— standards, ru les, practices and conventions,

— tool s and techniqu es for developm ent, including th e qu al ification of, and configuration controls placed on,
su ch tools and tech ni qu es,
— confi gu rati on management practices,
— meth od of controll ing nonconform ing produ cts,
— meth ods of control of nondeliverable software used to support devel opment,
— procedu res for archi ving, back-u p and recovery, including contingency pl anning,
— meth ods of control for virus protection;

i) th e identification of related plans (inclu ding system level plans) su ch as

— quality plan,
— risk management pl an,
— confi gurati on management pl an,
— integration plan,
— test pl an,
— installation plan,
— migration plan,
— trai ning plan,
— m aintenance plan,
— re-use plan.

The development pl an and any of these related plans may be an independent document, a part of another document or
composed of several docu ments.

N OTE — For fu rth er i n form ati on , see I SO/I E C 1 2207: 1 995, su bcl au se 5. 2. 4.

9
I SO 9000-3: 1 997(E) © I SO

4.4.3 Organizational and technical interfaces

O rg an i z ati o n al an d tech n i cal i n terface s betwe en d i fferen t g ro u ps wh i ch i n pu t i n to th e d esi g n pro ces s

s h al l be d e fi n e d an d th e n e ces s ary i n fo rm ati o n d o cu m e n ted , tran s m i tte d an d reg u l arl y revi e we d .

Th e bo u n d ari e s of re s po n s i bi l i ty fo r e ach part of th e s o ftware pro d u ct an d th e way th at te ch n i cal i n fo rm ati o n wi l l be

tran s m i tte d betwe en al l parti e s sh ou l d be cl e arl y d efi n ed in th e d e vel o pm e n t pl an s of s u ppl i e rs or s u bco n tracto rs . Th e

s u ppl i er m ay re q u i re s u bm i s s i o n o f a s u bco n tracto r' s d e vel o pm e n t pl an , fo r revi e w.

In d e fi n i n g i n terfaces , care sh ou l d be take n to co n s i d e r parti e s , o th e r th an th e cu s to m er an d s u ppl i e r, wh o n e ed i n pu t

to th e d es i g n , i n s tal l ati o n , m ai n te n an ce an d trai n i n g acti vi ti e s . Th e s e m ay i n cl u d e s u bco n tracto rs , re g u l ato ry

au th o ri ti es , as s o ci ated d e vel o pm e n t pro j e cts an d h e l p- d es k s taff. In parti cu l ar, th e e n d - u s ers an d an y i n te rm ed i ate

o pe rati o n s fu n cti o n m ay n ee d to be i n vo l ved to e n s u re th at appro pri ate capaci ty an d trai n i n g are avai l abl e to ach i e ve

co m m i tte d s e rvi ce l e ve l s .

Th e cu s to m e r m ay h ave certai n re s po n s i bi l i ti e s u n d er th e co n tract. P arti cu l ar co n ce rn s i n cl u d e th e n eed fo r th e

cu s to m e r to co o perate wi th th e s u ppl i e r, to pro vi d e n e ces s ary i n fo rm ati o n in a ti m e l y m an n er, an d re s o l ve acti o n i tem s .

Wh e re a cu s to m er re pre s e n tati ve is appro pri ate , h e/s h e m ay re pres e n t th e e ven tu al u ser of th e pro d u ct, as wel l as

e xecu ti ve m an ag e m e n t, an d h ave th e au th o ri ty to d eal wi th co n tractu al m atte rs wh i ch i n cl u d e , bu t are n ot l i m i ted to , th e

fo l l o wi n g :

a) d e fi n i n g th e cu s to m er' s req u i rem en ts to th e s u ppl i e r;

b) an s we ri n g q u e s ti o n s fro m th e s u ppl i er;

c) appro vi n g th e s u ppl i e r' s pro po s al s ;

d) co n cl u d i n g ag re em en ts wi th th e s u ppl i e r;

e) en s u ri n g th at th e cu s to m e r' s o rg an i z ati o n o bs e rve s th e ag re em en ts m ad e wi th th e s u ppl i e r;

f) d e fi n i n g th e acce ptan ce cri te ri a an d pro ce d u re s ;

g) d e al i n g wi th cu s to m er- s u ppl i ed s o ftware i tem s , d ata, faci l i ti es an d to o l s th at are fo u n d u n s u i tabl e fo r u s e;

h) d e fi n i n g th e cu s to m er' s res po n s i bi l i ty.

Wh e re m u tu al l y ag ree d , j oi n t re vi e ws i n vo l vi n g th e s u ppl i e r an d cu s to m e r m ay be s ch e d u l ed on a reg u l ar bas i s , or at

s i g n i fi can t pro j ect eve n ts , to co ve r th e fo l l o wi n g as pects , as appro pri ate :

a) th e pro g res s o f s o ftware d e vel o pm e n t wo rk u n d e rtaken by th e s u ppl i e r;

b) th e pro g res s o f ag re ed acti vi ti es be i n g u n d e rtake n by th e cu s to m e r;

c) co n fo rm an ce o f th e d eve l o pm en t pro d u cts to th e cu s to m e r' s ag re ed re q u i rem en ts s pe ci fi cati o n ;

d) th e pro g re ss of acti vi ti e s co n ce rn i n g th e e ve n tu al u s e rs of th e s ys te m u n d er d e ve l o pm e n t, s u ch as s yste m

co n vers i o n an d trai n i n g ;

e) ve ri fi cati o n re s u l ts ;

f) acceptan ce te s t res u l ts .

N O TE — Fo r fu rt h e r i n fo rm at i o n , see I S O /I E C 1 2207: 1 995, s u b cl au s e s 5. 2. 6. 1 an d 6. 6. 2.

4.4.4 Design input

D es i g n i n pu t re q u i re m en ts re l ati n g to th e pro d u ct, i n cl u d i n g appl i cabl e s tatu to ry an d re g u l ato ry

req u i re m e n ts , s h al l be i d e n ti fi e d , d o cu m e n te d an d th e i r s e l e cti o n revi e we d by th e s u ppl i er fo r

ad e q u acy. I n co m pl e te , am bi g u o u s or co n fl i cti n g re q u i re m e n ts s h al l be res o l ve d wi th th o s e

res po n s i bl e fo r i m po s i n g th es e re q u i rem en ts .

D es i g n i n pu t s h al l take i n to co n s i d erati o n th e re s u l ts o f an y co n tract revi ew acti vi ti e s .

Th e re q u i re m e n ts s pe ci fi cati o n sh ou l d be pro vi d e d by th e cu s to m er. H o weve r, wh e re m u tu al l y ag re ed , th e s u ppl i e r

m ay pro vi d e th e s pe ci fi cati o n . In s u ch a cas e, th e s u ppl i e r s h o u l d , wh e re appro pri ate:

10
© I SO I SO 9000-3: 1 997(E)

a) es tabl i s h d o cu m en te d pro ced u re s fo r d e vel o pi n g th e req u i re m e n ts s pe ci fi cati o n , i n cl u d i n g

— m eth o d s fo r ag ree i n g on req u i re m e n ts an d au th o ri z i n g ch an g e s , es peci al l y d u ri n g i terati ve d eve l o pm en t,

— m eth o d s fo r th e eval u ati o n o f pro to types o r d e m o n s trati o n s , wh ere u s ed ,

— reco rd i n g an d revi e wi n g d i s cu s s i o n res u l ts on bo th s i d es ,

b) d e vel o p th e re q u i re m e n ts s pe ci fi cati o n in cl o s e co o pe rati o n wi th th e cu s to m e r an d m ake e ffo rts to preve n t

m i s u n d e rs tan d i n g s by, fo r e xam pl e, pro vi s i o n of d e fi n i ti o n of term s , e xpl an ati o n of th e backg ro u n d of

re q u i rem en ts ,

c) o btai n th e cu s to m e r' s appro val o f th e req u i re m e n ts s peci fi cati o n .

I n tervi e ws , s u rve ys , s tu d i es , pro to types , d em o n s trati o n s an d an al ys i s m eth o d s m ay be u sed fo r d eve l o pi n g th e

req u i re m e n ts s pe ci fi cati o n , as appro pri ate .

Th e re q u i rem e n ts s pe ci fi cati o n m ay be pro vi d e d an d ag re ed in th e fo rm of a s ys te m s pe ci fi cati o n . In th i s cas e ,

pro ce d u re s sh ou l d be in pl ace to e n s u re th e co rre ct al l o cati o n of s ys te m re q u i re m e n ts i n to h ard ware an d s o ftware

as pe cts an d al s o th e appro pri ate i n terface s peci fi cati o n s .

Th e req u i re m e n ts s pe ci fi cati o n m ay n ot be fu l l y d efi n ed at co n tract acce ptan ce , an d m ay be d eve l o pe d d u ri n g a

pro j e ct. Th e co n tract m ay be am en d e d wh e n th e req u i re m e n ts s pe ci fi cati o n ch an g e s . C h an g es to th e req u i re m e n ts

s peci fi cati o n sh ou l d be co n tro l l e d .

Th e re q u i rem en ts sh ou l d i n cl u d e al l as pe cts n e ces s ary to s ati s fy th e cu s to m e r' s ag re e d n ee d s . Th e req u i re m e n ts

s peci fi cati o n m ay n eed to take th e o pe rati o n al e n vi ro n m en t i n to acco u n t. Th e re q u i re m e n ts m ay i n cl u d e , bu t n ot be

l i m i te d to th e fo l l o wi n g ch aracte ri s ti cs : fu n cti o n al i ty; re l i abi l i ty; u s abi l i ty; e ffi ci e n cy; m ai n tai n abi l i ty an d po rtabi l i ty ( see

al s o I S O /I E C 9 1 26 ) . S u b- ch aracteri s ti cs m ay be s pe ci fi e d , fo r exam pl e s e cu ri ty. S afety co n s i d e rati o n s an d s tatu to ry

o bl i g ati o n s m ay al s o be s pe ci fi e d .

If th e s o ftware pro d u ct n ee d s to i n te rface wi th o th er s o ftware or h ard ware pro d u cts , th e i n te rface s be twe en th e

s o ftware pro d u ct to be d eve l o pe d an d o th er s o ftware or h ard ware pro d u cts sh ou l d be s pe ci fi e d , as far as po s s i bl e ,

e i th e r d i rectl y o r by re fe re n ce , in th e req u i re m e n ts s pe ci fi cati o n .

Th e re q u i rem en ts sh ou l d be e xpres s e d in te rm s wh i ch al l o w val i d ati o n d u ri n g pro d u ct acce ptan ce .

N O TE — Fo r fu rt h e r i n fo rm at i o n , see I S O /I E C 1 2207: 1 995, s u b cl au s e s 5. 3. 2 to 5 . 3 . 4.

4.4.5 Design output

D es i g n o u tpu t s h al l be d o cu m e n ted an d expre s s ed in term s th at can be veri fi ed an d val i d ated

ag ai n s t d es i g n i n pu t req u i re m e n ts .

D es i g n o u tpu t s h al l :

a) m ee t th e d esi g n i n pu t req u i re m e n ts ;

b) co n tai n o r m ake re fe re n ce to acce ptan ce cri teri a;

c) i d en ti fy th o s e ch aracteri s ti cs of th e d es i g n th at are cru ci al to th e s afe an d pro pe r fu n cti o n i n g of

th e pro d u ct ( e . g . , o perati n g , s to rag e , h an d l i n g , m ai n te n an ce an d d i s po s al re q u i rem en ts ) .

D es i g n o u tpu t d o cu m e n ts s h al l be revi e we d befo re rel eas e.

Th e re q u i red o u tpu t fro m th e d esi g n acti vi ty sh ou l d be d efi n ed an d d o cu m en te d in acco rd an ce wi th th e ch o s e n

m eth o d . Th i s d o cu m en tati o n sh ou l d be co rrect, co m pl ete an d co n s i s ten t wi th th e re q u i rem en ts . Desi g n o u tpu ts m ay

i n cl u d e :

— arch i te ctu ral d es i g n s pe ci fi cati o n ;

— d etai l e d d esi g n s peci fi cati o n ;

— s o u rce co d e;

— u s e r g u i d es .

N O TE — Fo r fu rt h e r i n fo rm at i o n , see I S O /I E C 1 2207: 1 995, s u b cl au s e s 5. 3. 5 to 5. 3. 7.

11
I SO 9000-3: 1 997(E) © I SO

4.4.6 Design review

At appropri ate stages of desi gn, formal documented reviews of th e design resu lts sh al l be pl anned
and condu cted. Parti cipants at each desi gn review sh al l i nclude representatives of all fu nctions
concerned wi th the design stage bei ng reviewed, as wel l as other speci al ist personnel, as requi red.
Records of su ch reviews sh al l be maintained (see 4. 1 6) .

The su ppli er sh ou ld pl an and implement review processes for all software devel opment projects. The degree of
formali ty and rigour of the activiti es associated with the review processes sh ou ld be appropri ate to th e complexity of the
produ ct and th e degree of risk associated with the specified u se of th e software produ ct. Th e su ppl ier sh ou ld establi sh
docu mented procedures for deali ng wi th process and produ ct deficienci es or nonconformi ti es i denti fi ed during th ese
acti viti es.

During design reviews, aspects inh erent to the design activities sh oul d be taken i nto accou nt, for exam pl e feasibil ity,
security and safety, program mi ng ru les and testabi li ty.

The resu lts of review, and any further activities requi red to ensure th at th e specified requi rements are met, sh oul d be
recorded and checked wh en th ey are completed.

M ost desi gn reviews during th e developm ent are sch edu led, bu t th ere m ay al so be unschedu led desi gn reviews.

A docu mented design review procedu re shoul d address the foll owing:

a) wh at i s to be reviewed, when, and th e type of review;

b) wh at fu nctional groups woul d be concerned i n each type of review and, i f there i s to be a review meeting, who
woul d chair it;
c) what records h ave to be produ ced, for example m eeti ng minu tes, issu es, problems, acti ons and action status.

Also the foll owing may be addressed in the design review procedu re:

a) th e meth ods for monitoring the appl icati on of ru les, practi ces and conventions to ensu re com pl iance, su ch as peer
reviews, walkthrou gh s, code i nspections;
b) wh at has to be done prior to th e condu ct of a review, su ch as establ ish ment of objecti ves, meeting agenda,
docum ents requ ired and rol es of review personnel;
c) wh at h as to be done du ri ng th e review, including the techniques to be used and gui deli nes for all parti cipants;
d) th e success criteria for th e review;
e) wh at fol low-up meth ods are to be u sed to ensu re th at issu es identi fi ed at the review are resol ved.

Where specified in th e contract, the su ppli er shoul d condu ct desi gn review m eeti ngs in cooperation wi th th e custom er.
Both parti es shoul d agree on the resul ts of such reviews.

I t i s recom mended that fu rther design acti viti es sh ou ld proceed only wh en the consequ ences of al l known defici encies
are sati sfactorily resolved, or the risk of proceedi ng otherwise i s known.

N OTE — For fu rth er i n form ati on , see I SO/I E C 1 2207: 1 995, su bcl au ses 5. 3. 4. 2, 5. 3. 5. 6, 5. 3. 6. 7 an d 6. 6. 3.

4.4.7 Design verification

At appropri ate stages of desi gn, desi gn verifi cation sh al l be performed to ensu re th at the design stage ou tpu t
meets th e design stage inpu t requi rements. The design verificati on measu res sh al l be recorded (see 4. 1 6) .

N OTE 1 0 I n addi ti on to condu cti n g desi gn revi ews (see 4. 4. 6) , desi gn veri fi cati on may i ncl u de acti vi ti es su ch as

— performi n g al tern ati ve cal cu l ati ons,

— compari n g th e new desi gn wi th a si mi l ar proven desi g n, i f avai l abl e,

— u n dertaki ng tests an d demonstrati on s, and

— revi ewi ng th e desi gn stage docu ments before rel ease.

12
© I SO I SO 9000-3: 1 997(E)

Verifi cation of desi gn sh ou ld be perform ed as appropriate du ri ng the devel opment process. Design verificati on may
compri se reviews of design output, dem onstrations inclu ding prototypes and simu lati ons, or tests. Verifi cation m ay be
conducted on th e ou tput from oth er developm ent activiti es. These verificati on acti vities sh ou ld be planned and
conducted in accordance wi th th e quali ty pl an or docum ented procedures to ensu re th at process outpu ts m eet the
process inpu t requi rements.

The verificati on resu lts and any fu rth er acti ons requi red to ensu re th at the desi gn stage i nput requi rements are met
sh ou ld be recorded and ch ecked wh en th e actions are completed.

Only verified design outpu ts shou ld be submi tted for acceptance and subsequent use. Any fi ndings sh ou ld be
adequ ately addressed and resol ved.

N OTE — For fu rth er i n form ati on , see I SO/I E C 1 2207: 1 995, su bcl au ses 5. 3. 4. 2, 5. 3. 5. 6, 5. 3. 5. 7, 5. 3. 7. 5, 5. 3. 9 an d 6. 4.

4.4.8 Design validation

Design vali dati on sh al l be perform ed to ensure th at produ ct conform s to defi ned u ser needs and/or
requi rements.

N OTES

11 Desi gn val i dati on fol l ows su ccessfu l desi gn veri fi cati on (see 4. 4. 7) .

12 Val i dati on i s normal l y performed u nder defi ned operati n g con di ti ons.

13 Val i dati on i s n ormal l y performed on th e fi n al produ ct, bu t may be n ecessary i n earl i er stag es pri or to

produ ct compl eti on .

14 Mu l ti pl e val i dati on s may be performed i f th ere are di fferent i nten ded u ses.

Before offering th e produ ct for cu stomer acceptance, th e suppl ier shoul d val idate th e produ ct in accordance with its
speci fi ed i ntended u se, for example du ri ng fi nal inspecti on and test.

I n software devel opment, i t is im portant th at th e val idation resu lts and any fu rth er actions requi red to ensu re that the
speci fi ed requ irem ents are met sh ou ld be recorded and ch ecked when the actions are com pl eted. Only vali dated
produ cts sh ou ld be su bm itted for acceptance and subsequ ent use.

N OTE — For fu rth er i n form ati on , see I SO/I E C 1 2207: 1 995, su bcl au ses 5. 3. 1 an d 6. 5.

4.4.9 Design changes

All desi gn changes and m odificati ons shall be identi fi ed, docu mented, reviewed and approved by
authori zed personnel before their implementati on.

The su ppli er shoul d establi sh and m ai ntain procedu res for controlli ng th e i mplementation of any desi gn changes, wh ich
m ay arise at any tim e during the produ ct life cycle, in order to:

a) docum ent and justify th e change;

b) evalu ate consequ ences of th e change;
c) approve or disapprove the ch ange;
d) implement and verify the ch ange.

I n th e software devel opment envi ronment, control of design ch anges i s u suall y addressed under the discipline of
configuration m anagem ent.

N OTE — For fu rth er i n form ati on , see I SO/I E C 1 2207: 1 995, su bcl au ses 5. 5. 2, 5. 5. 3 an d 6. 2. 3.

13
I SO 9000-3: 1 997(E) © I SO

4. 5 Docu m en t an d d ata con trol

4.5.1 G eneral

Th e su ppl i er sh al l establ i sh an d m ai n tai n docu m en ted procedu res to con trol al l docu m en ts an d data

th at rel ate to th e requ i rem en ts of th i s I n tern ati on al Stan dard i n cl u di n g, to th e exten t appl i cabl e,

docu m en ts of extern al ori g i n su ch as stan dards an d cu stom er drawi n gs.

N OTE 1 5 Docu men ts an d d ata can be i n th e form of an y type of medi a, su ch as h ard copy or el ectron i c

med i a.

Con fi gu rati on m an agem en t procedu res m ay be u sed to i m pl em en t docu m en t an d data con trol . I n establ i sh i n g th e

procedu res to con trol docu m en ts an d data, th e su ppl i er sh ou l d i den ti fy th ose docu m en ts an d data, i n cl u di n g th ose of

extern al ori g i n su ch as stan dards an d cu stom er data, wh i ch sh ou l d be su bj ect to th e con trol procedu res.

Th e docu m en t an d data con trol procedu res sh ou l d be appl i ed to rel evan t docu m en ts an d data, i n cl u di n g th e fol l owi n g :

a) con tractu al docu m en ts i n cl u di n g speci fi cati on of requ i rem en ts;

b) procedu ral docu m en ts descri bi n g th e qu ali ty system to be appl i ed in th e software l i fe cycl e;

c) pl an n i n g docu m en ts descri bi n g th e pl an n i n g an d progress of acti vi ti es of th e su ppl i er an d th e su ppl i ers

i n teracti on s wi th th e cu stom er;

d) produ ct docu m en ts an d data descri bi n g or associ ated wi th a parti cu l ar software produ ct.

N OTE — For fu rth er i n form ati on , see I S O/I E C 1 2207, cl au se 6. 1 .

4.5.2 Document and data approval and issue

Th e docu m en ts an d data sh al l be revi ewed an d approved for adequ acy by au th ori zed person n el

pri or to i ssu e. A m aster l i st or equ i val en t docu m en t con trol procedu re i den ti fyi n g th e cu rren t revi si on

statu s of docu m en ts sh al l be establ i sh ed an d be readi l y avai l abl e to precl u de th e u se of i n val i d

an d/or obsol ete docu m en ts.

Th i s con trol sh al l en su re th at:

a) th e perti n en t i ssu es of appropri ate docu m en ts are avai l abl e at al l l ocati on s wh ere operati on s

essen ti al to th e effecti ve fu n cti on i n g of th e qu al i ty system are perform ed;

b) i n val i d an d/or obsol ete docu m en ts are prom ptl y rem oved from al l poi n ts of i ssu e or u se, or

oth erwi se assu red ag ai n st u n i n ten ded u se;

c) an y obsol ete docu m en ts retai n ed for l egal an d/or kn owl edge-preservati on pu rposes are

su i tabl y i den ti fi ed.

Wh ere docu m en t con trol i s ach i eved by el ectron i c m ean s, speci al atten ti on sh ou l d be gi ven to appropri ate approval ,

access, di stri bu ti on , m edi a an d arch i vi n g procedu res.

4.5.3 Document and data changes

Ch an g es to docu m en ts an d data sh al l be revi ewed an d approved by th e sam e

fu n cti on s/org an i zati on s th at perform ed th e ori g i n al revi ew an d approval , u n l ess speci fi cal l y

desi gn ated oth erwi se. Th e desi g n ated fu n cti on s/org an i zati on s sh al l h ave access to perti n en t

backg rou n d i n form ati on u pon wh i ch to base th ei r revi ew an d approval .

Wh ere practi cabl e, th e n atu re of th e ch an ge sh al l be i den ti fi ed i n th e docu m en t or th e appropri ate

attach m en ts.

14
© I SO I SO 9000-3: 1 997(E)

N o fu rth er software-related gui dance i s provided.

4. 6 Pu rch asi n g

4.6.1 G eneral

The su ppl ier shall establi sh and maintain docum ented procedures to ensu re th at pu rch ased product
(see 3. 1 ) conforms to specified requ irem ents.

I n developi ng, suppl ying, i nstal li ng and maintaining software products, pu rch ased produ cts may inclu de:

— comm ercial off-the-sh el f software;

— su bcontracted development;
— computer and com mu ni cations h ardware;
— a tool i ntended to assist in th e devel opment of software;
— contract staff;
— m ai ntenance and cu stom er su pport servi ces;
— training courses and m ateri al s.

N OTE — For fu rth er i n form ati on , see I SO/I E C 1 2207: 1 995, su bcl au se 5. 1 .

4.6.2 Eval uation of subcontractors

Th e supplier shall:

a) evaluate and select subcontractors on the basi s of their abi lity to meet subcontract
requ irements inclu ding th e qu ality system and any specific qu ality assu rance requirem ents;

b) defi ne the type and extent of control exercised by th e su ppli er over su bcontractors. Thi s sh al l
be dependent u pon th e type of product, the impact of subcontracted produ ct on th e quali ty of
final product and, wh ere appli cable, on the qu al ity audit reports and/or quali ty records of th e
previou sly demonstrated capabi li ty and perform ance of subcontractors;

c) establi sh and m ai ntai n qu al ity records of acceptable subcontractors (see 4. 1 6) .

N o fu rth er software-related gu idance i s provided.

4.6.3 Pu rchasi ng data

Purchasing docu ments sh al l contai n data clearl y descri bi ng th e produ ct ordered, including where
appli cable:

a) th e type, class, grade or other preci se identificati on;

b) th e title or oth er positive identi fi cation, and appl icabl e i ssues of specificati ons, drawi ngs,
process requ irem ents, inspecti on instru cti ons and oth er rel evant technical data, i ncluding
requ irem ents for approval or quali fi cation of produ ct, procedu res, process equ ipment and
personnel ;

c) th e title, nu m ber and issu e of th e qu ality system standard to be applied.

The su ppli er shall review and approve pu rch asi ng docum ents for adequacy of specified
requi rements prior to release.

15
I SO 9 000 -3 : 1 9 9 7(E ) © I SO

P u rch as i n g d o cu m e n ts fo r s o ftware d e vel o pm e n t sh ou l d co n tai n d ata cl earl y d e s cri bi n g th e pro d u ct o rd e red , i n cl u d i n g ,

wh e re appl i cabl e :

a) pre ci s e i d e n ti fi cati o n o f th e pro d u ct o rd e re d , s u ch as pro d u ct n am e an d /o r pro d u ct n u m be r;

b) req u i re m e n ts s pe ci fi cati o n , or th e i d e n ti ty of it (or th e pro ce d u re to i d en ti fy req u i re m e n ts s peci fi cati o n s wh ere n ot

fi xe d at th e ti m e o rd e re d ) ;

c) s tan d ard s to be appl i ed (e. g . co m m u n i cati o n s pro to co l , arch i te ctu ral s peci fi cati o n ) ;

d) pro ced u res an d /o r wo rk i n s tru cti o n s ;

e) d eve l o pm en t en vi ro n m e n t;

f) re q u i re m en ts on pers o n n e l .

Th e co n s i d e rati o n s u n d e r co n tract revi e w m ay al s o be appl i ed to s u bco n tracts .

4. 6. 4 Veri fi cati on of pu rch ased prod u ct

4. 6. 4. 1 Su ppl i er veri fi cati on at su bcon tractor' s prem i ses

Wh e re th e s u ppl i e r pro po s e s to ve ri fy pu rch as e d pro d u ct at th e s u bco n tracto r' s pre m i s es , th e

s u ppl i er s h al l s pe ci fy ve ri fi cati o n arran g e m e n ts an d th e m e th o d of pro d u ct re l e as e in th e pu rch as i n g

d o cu m e n ts .

No fu rth er s o ftware - re l ate d g u i d an ce is pro vi d e d .

4. 6. 4. 2 Cu stom er veri fi cati on of su bcon tracted prod u ct

Wh e re s pe ci fi e d in th e co n tract, th e s u ppl i e r' s cu s to m e r or th e cu s to m e r' s re pres e n tati ve s h al l be

affo rd e d th e ri g h t to ve ri fy at th e s u bco n tracto r' s pre m i s e s an d th e s u ppl i er' s prem i s e s th at

s u bco n tracte d pro d u ct co n fo rm s to s pe ci fi e d req u i re m e n ts . S u ch ve ri fi cati o n s h al l n ot be u s ed by

th e s u ppl i er as evi d e n ce o f e ffe cti ve co n tro l o f q u al i ty by th e s u bco n tracto r.

Veri fi cati o n by th e cu s to m er s h al l n ot abs o l ve th e s u ppl i er of th e re s po n s i bi l i ty to pro vi d e acce ptabl e

pro d u ct, n o r s h al l i t pre cl u d e s u bs e q u e n t re j e cti o n by th e cu s to m e r.

No fu rth er s o ftware - re l ate d g u i d an ce is pro vi d e d .

4. 7 Co n t ro l o f cu sto m er-s u ppl i ed pro d u ct

Th e s u ppl i e r s h al l e s tabl i s h an d m ai n tai n d o cu m en te d pro ce d u res fo r th e co n tro l of veri fi cati o n ,

s to rag e an d m ai n ten an ce of cu s to m er- s u ppl i ed pro d u ct pro vi d e d fo r i n co rpo rati o n i n to th e s u ppl i e s

or fo r rel ate d acti vi ti e s . An y s u ch pro d u ct th at is l o s t, d am ag e d or is o th erwi s e u n s u i tabl e fo r u se

s h al l be re co rd e d an d repo rted to th e cu s to m er ( s ee 4. 1 6 ) .

Veri fi cati o n by th e s u ppl i er d o es n o t abs o l ve th e cu s to m er of th e res po n s i bi l i ty to pro vi d e acceptabl e

pro d u ct.

Th e s u ppl i er m ay be req u i re d to acq u i re an d i n cl u d e pro d u ct, i n cl u d i n g d ata, s u ppl i ed by th e cu s to m e r. Fo r e xam pl e:

a) s o ftware pro d u cts i n cl u d i n g co m m e rci al s o ftware pro d u ct s u ppl i e d by th e cu s to m e r;

b) d e vel o pm e n t to o l s ;

c) d e vel o pm e n t e n vi ro n m e n t i n cl u d i n g n e two rk s e rvi ces ;

d) te s t an d o pe rati o n al d ata;

e) i n te rface o r o th e r s pe ci fi cati o n s ;

f) h ard ware ;

g) cu s to m er pro pri etary i n fo rm ati o n , i n cl u d i n g s peci fi cati o n s .

1 6
© I SO I SO 9000-3: 1 997(E)

Consideration shou ld be gi ven to th e requi rements of th e contract in addressing requi red l icensing and th e support of
su ch software produ ct, in any maintenance agreement related to th e produ ct to be delivered.

The means by whi ch u pdates to custom er-su ppli ed item s are accepted and integrated sh ou ld be defi ned. Th e suppl ier
m ay apply th e sam e kinds of verificati on activiti es to custom er-su ppli ed product as to pu rch ased produ ct.

N OTE — For fu rth er i n form ati on , see I SO/I E C 1 2207: 1 995, su bcl au se 6. 1 .

4. 8 Prod u ct i d en ti fi cati on an d traceabi l i ty

Wh ere appropriate, th e suppl ier shall establi sh and maintai n docum ented procedures for identi fying
the produ ct by su itable m eans from receipt and during all stages of produ ction, deli very and
i nstall ation.

Wh ere and to th e extent that traceabi lity i s a speci fi ed requi rement, the su ppli er sh al l establi sh and
m ai ntai n docu mented procedu res for uniqu e i dentificati on of indi vidu al produ ct or batch es. Th is
i dentificati on sh al l be recorded (see 4. 1 6) .

The suppl ier sh ou ld establ ish and m ai ntai n procedu res for identi fying software i tems during all phases, starting from
speci fi cation th rou gh devel opment, repli cation and delivery. Wh ere requi red by contract, th ese procedu res may al so
apply after del ivery of th e produ ct.

Th rou gh ou t th e produ ct life cycle, th ere shou ld be procedu res to trace th e com ponents of th e software item or produ ct.
Such traci ng may vary in scope accordi ng to th e requ irem ents of the contract or marketplace, from bei ng abl e to pl ace
a certain ch ange requ est in a specific release, to recordi ng th e desti nation and u sage of each variant of the product.

In software, a means by whi ch i denti fi cation and traceabil ity m ay be achi eved, is configuration m anagem ent.
Confi gu rati on m anagement is a management discipli ne that appl ies tech ni cal and adm inistrati ve di recti on to th e
developm ent and su pport life cycle of configu ration items, inclu ding software item s. Th is discipline is also applicable to
rel ated docu mentation and h ardware. U se of configuration managem ent is dependent on the project size and
complexity, and the ri sk level .

One objective of configuration management is to docum ent and provi de ful l visibili ty of the produ ct’s present
configuration and on th e statu s of ach ievement of its requi rements. Anoth er objective i s th at everyone worki ng on th e
produ ct at any time in its life cycle uses correct and accurate information.

A configuration m anagement system may provide th e capability to:

a) identify uniqu ely the versi ons of each software item;

b) identify th e versions of each software item wh ich togeth er consti tute a specifi c version of a complete product;
c) identify th e buil d status of software products u nder development, delivered or instal led;
d) control simu ltaneous u pdating of a gi ven software i tem by two or m ore people working independently;
e) provide coordination for the updating of multipl e products in one or more locations as required;
f) identify and track all actions and changes resu lting from a change request, or problem, from ini tiation through to
release.

Th e su pplier should i dentify th e confi guration wi th th e foll owi ng:

a) product stru cture and sel ection of configu ration i tem s;

b) documentation and com puter fi les;
c) naming conventions;
d) establ ishment of configuration baselines.

Th e produ cts th at may be managed by a configu ration m anagement system inclu de:

a) docu ments and data pertaining to contract, process, planning and product;
b) source, object and execu tabl e code;
c) i ncorporated produ cts including
— software tool s,

17
I SO 9000-3: 1 997(E) © I SO

— re-u sed software including l ibraries,

— pu rch ased software,
— custom er su ppl ied software.

Procedu res shoul d be appl ied to ensu re that the foll owing can be i dentified for each software i tem:

a) the docum entati on;

b) any associated devel opment tool s;
c) interfaces to other software i tems and to h ardware;
d) the h ardware and software environm ent.

Th e su ppli er sh ou ld establi sh and m ai ntain configurati on statu s accou nting procedu res to record, m anage and report
on th e status of software item s, of change requests and of the implementati on of approved changes.

Th e su ppli er sh ou ld devel op and im pl em ent a configuration m anagement plan whi ch includes th e fol lowi ng:

a) organizati ons invol ved in configu rati on management and responsibil ities assigned to each of th em;
b) configuration m anagem ent acti vities to be carried ou t;
c) configuration m anagem ent tools, techniques and meth odologi es to be u sed;
d) the point at wh ich i tems shoul d be brought under configuration control.

N OTE — For fu rth er i n form ati on on con fi g u rati on m an ag em en t, refer to I SO 1 0007, an d I SO/I EC 1 2207: 1 995, su bcl au ses 6. 1

an d 6. 2.

4. 9 Process con trol

Th e su pplier sh all identify and plan the produ ction, installation and servici ng processes which
di rectly affect qu ality and shall ensu re th at these processes are carried ou t under controll ed
conditions. Controlled condi tions shall include the foll owing:

a) documented procedu res defining the manner of produ ction, install ati on and servi ci ng, where
the absence of such procedures coul d adversely affect quality;

b) u se of suitable producti on, instal lation and servicing equipment, and a sui table working
environm ent;

c) com pliance wi th reference standards/codes, quality pl ans and/or docu mented procedures;

d) monitoring and control of su itable process parameters and produ ct ch aracteristics;

e) th e approval of processes and equ ipm ent, as appropriate;

f) criteri a for workmansh ip, whi ch sh all be stipu lated, in th e clearest practicabl e manner (e. g. ,
written standards, representative sampl es or illu strations) ;

g) sui table maintenance of equi pment to ensure continu ing process capabil ity.

Wh ere th e results of processes cannot be fu lly verified by su bsequent i nspection and testi ng of th e
product and where, for example, processing deficiencies may become apparent only after th e
product i s in u se, the processes shal l be carried ou t by qualified operators and/or sh all requi re
continuou s monitoring and control of process parameters to ensu re that the speci fied requirements
are met.

Th e requirements for any qualifi cation of process operations, i nclu ding associated equi pment and
personnel (see 4. 1 8) , shall be speci fied.

N OTE 1 6 Su ch processes requ i ri ng pre-qu al i fi cati on of th ei r process capabi l i ty are frequ en tl y referred to as

speci al processes.

Records sh al l be maintained for qu al ified processes, equ ipment and personnel, as appropriate (see
4. 1 6) .

As stated in gu idance for th e desi gn control element of I SO 9001 , a software devel opment project sh ou ld be organized
according to a set of processes wh ich transform the requi rements into a software product. Th e “process control”

18
© I SO I SO 9000-3: 1 997(E)

e l e m e n t, as appl i e d to s o ftware d e vel o pm e n t, is appl i cabl e to th e re pl i cati o n , d e l i very an d i n s tal l ati o n of s o ftware i tem s

o r pro d u cts .

Wh e re req u i re d by co n tract, th e s u ppl i er sh ou l d e s tabl i s h an d perfo rm th e repl i cati o n pro ce d u res , co n s i d e ri n g th e

fo l l o wi n g , to en s u re th at re pl i cati o n is co n d u cte d co rrectl y:

a) i d en ti fi cati o n o f th e m as te r an d th e co pi e s i n cl u d i n g fo rm at, vari an t an d vers i o n ;

b) th e n u m be r o f co pi e s o f e ach s o ftware i tem to be d e l i vered ;

c) d i s as ter re co ve ry pl an s i n cl u d i n g cu s to d y o f m as ter an d back- u p co pi es wh ere appl i cabl e ;

d) th e peri o d o f o bl i g ati o n o f th e s u ppl i e r to s u ppl y co pi es an d th e capabi l i ty o f read i n g m as te r co pi e s ;

e) th e type o f m e d i a fo r each s o ftware i te m an d as s o ci ate d l abe l l i n g ;

f) ch e cks ag ai n s t th e po s s i bi l i ty o f s o ftware vi ru s e s ;

g) th e s ti pu l ati o n of re q u i red d o cu m e n tati o n s u ch as m an u al s an d u ser g u i d es, i n cl u d i n g i d e n ti fi cati o n an d

packag i n g ;

h) co pyri g h t an d l i cen s i n g co n cern s ad d re s s ed an d ag re e d ;

i) co n tro l l i n g th e e n vi ro n m en t u n d er wh i ch th e re pl i cati o n is e ffe cte d to en s u re repeatabi l i ty.

Fo r s o ftware pro d u ct re l e as e s , th e s u ppl i e r an d cu s to m e r sh ou l d ag re e an d d o cu m en t pro ce d u re s fo r i n i ti al an d

s u bs e q u en t rel eas es .

It is reco m m en d e d th at th e rel eas e of s o ftware sh ou l d es tabl i s h a bas el i n e th at reco rd s th e te s ts co m pl e te d an d th e

re s o l u ti o n of i d e n ti fi e d d e fi ci e n ci e s . Qu an ti tati ve an al ys i s , to pred i ct s ys te m rel i ab i l i ty, m ay be carri ed ou t fo r s o ftware

wi th s afety an d /o r s e cu ri ty req u i re m e n ts .

Th e s e pro ced u res sh ou l d i n cl u d e th e fo l l o wi n g :

a) d e s cri pti o n s of th e type s (or cl as s es ) of rel eas e, d epe n d i n g on th e freq u en cy an d /o r i m pact on th e cu s to m e r' s

o perati o n s an d abi l i ty to i m pl em en t ch an g e s at an y po i n t i n ti m e ;

b) m e th o d s by wh i ch th e cu s to m er wi l l be ad vi s e d o f cu rre n t o r pl an n e d fu tu re ch an g es ;

c) m e th o d s to co n fi rm th at ch an g e s i m pl e m e n te d wi l l n ot i n tro d u ce o th er pro bl e m s ; s u ch m eth o d s sh ou l d i n cl u d e

th e d eterm i n ati o n o f th e l e vel o f re g re s s i o n tes ti n g to be appl i e d to e ach rel eas e;

d) g ro u n d ru l e s to d eterm i n e wh ere l o cal i z ed te m po rary fi xes m ay be i n co rpo rated or rel eas e of a co m pl e te u pd ated

co py o f th e s o ftware pro d u ct i s n e ces s ary;

e) re q u i rem en ts fo r re co rd s i n d i cati n g wh i ch ch an g e s h ave be en i m pl em en te d an d at wh at l o cati o n s , fo r m u l ti pl e

pro d u cts an d s i te s .

Wh e n i n s tal l ati o n of th e s o ftware pro d u ct is co n tractu al l y re q u i red , th e s u ppl i er an d cu s to m e r sh ou l d ag ree on th e i r

res pecti ve ro l e s , re s po n s i bi l i ti e s an d o bl i g ati o n s , an d s u ch ag ree m e n ts sh ou l d be d o cu m e n ted . In pro vi d i n g fo r

i n s tal l ati o n , co n s i d e rati o n sh ou l d be g i ven to th e fo l l o wi n g :

a) th e n e ed fo r val i d ati o n at e ach i n s tal l ati o n re q u i red by co n tract;

b) an i n s tal l ati o n pro ce d u re ;

c) a pro ce d u re fo r appro val o f e ach i n s tal l ati o n u po n co m pl eti o n ;

d) a s ch e d u l e ;

e) acce s s to cu s to m e r' s faci l i ti es ( e. g . s e cu ri ty bad g e s , pas s wo rd s , es co rts ) ;

f) avai l abi l i ty o f s ki l l e d pers o n n el ;

g) avai l abi l i ty o f an d acces s to cu s to m er' s s ys te m s an d e q u i pm e n t;

h) i d en ti fi cati o n o f wh at th e cu s to m e r i s to pro vi d e at th e s i te;

i) trai n i n g fo r th e u se o f n ew faci l i ti e s .

N O TE — Fo r fu rt h e r i n fo rm at i o n , see I S O /I E C 1 2207: 1 995, s u b cl au s e s 5. 3. 1 2 an d 6. 3. 3.

4. 1 0 I n specti on an d testi n g

4.1 0.1 General

Th e s u ppl i e r s h al l es tabl i s h an d m ai n tai n d o cu m en te d pro ce d u re s fo r i n s pe cti o n an d tes ti n g

acti vi ti e s in o rd e r to ve ri fy th at th e s pe ci fi ed re q u i rem en ts fo r th e pro d u ct are m e t. Th e req u i re d

i n s pecti o n an d tes ti n g , an d th e reco rd s to be e s tabl i s h ed , s h al l be d e tai l ed in th e q u al i ty pl an or

d o cu m e n ted pro ce d u re s .

19
I SO 9000-3: 1 997(E) © I SO

Tes ti n g m ay be req u i red at s e ve ral l eve l s , fro m th e i n d i vi d u al s o ftware i te m to th e co m pl ete s o ftware pro d u ct. Th e re

are s eve ral d i ffe re n t appro ach e s to te s ti n g , an d th e e xte n t of te s ti n g , th e d e g ree of co n tro l s on th e te s t e n vi ro n m en t,

te s t i n pu ts an d te s t o u tpu ts , m ay vary wi th th e appro ach , co m pl exi ty of th e pro d u ct, an d th e ri s ks . S o ftware te s ti n g is

al s o pe rfo rm e d d u ri n g s o ftware i n teg rati o n . Th e te ch n i q u e s d e s cri be d u n d er Desi g n re vi e w m ay al s o be re l e van t in

i n s pecti o n an d tes ti n g acti vi ti es .

Th e s u ppl i e r sh ou l d e s tabl i s h , d o cu m e n t an d re vi e w pl an s fo r u n i t, i n te g rati o n , s yste m an d acceptan ce te s ts, in

acco rd an ce wi th th e q u al i ty pl an o r d o cu m en ted pro ced u re s , co ve ri n g , as appro pri ate :

a) te s t o bj e cti ves ;

b) co n fi g u rati o n s to be te s ted ;

c) type s o f te s ts to be perfo rm e d (e. g . fu n cti o n al te s ts , bo u n d ary tes ts , perfo rm an ce te s ts , u s abi l i ty tes ts ) ;

d) s e q u e n ce o f tes ts , tes t cas e s , te s t pro ced u re s , te s t d ata an d e xpe cte d res u l ts ;

e) s co pe o f te s ts to be pe rfo rm e d , in term s o f co verag e an d vo l u m es ;

f) rel evan cy o f th e tes ts to th e te s t o bj e cti ves an d to o pe rati o n al u se;

g) s pe ci al co n cern s s u ch as s ecu ri ty an d s afety;

h) te s t en vi ro n m e n t, to o l s an d tes t s o ftware, i n cl u d i n g an y as s o ci ate d q u al i fi cati o n an d co n tro l s ;

i) tes ti n g o f en d - u s er d o cu m e n tati o n ;

j) pers o n n e l req u i re d an d as s o ci ate d trai n i n g re q u i re m e n ts , i n cl u d i n g trai n i n g m ateri al ;

k) th e d e g re e of i n d epen d e n ce be twee n th e pe rs o n n e l d e vel o pi n g th e s o ftware an d th e pe rs o n n e l pe rfo rm i n g th e

tes ts ;

l) th e re s po n s i bi l i ti e s fo r s pe ci fi cati o n an d pe rfo rm an ce o f th e te s ts ;

m) th e te s t co m pl e ti o n cri teri a;

n) th e m e th o d o f re co rd i n g res u l ts ;

o) pro ce d u re s fo r an al ys i n g an d appro vi n g re s u l ts ;

p) pro ce d u re s fo r h an d l i n g pro bl e m s fo u n d d u ri n g te s t e xecu ti o n , i n cl u d i n g s u s pe n s i o n cri teri a an d re s u m pti o n

req u i re m e n ts ;

q) th e n e ed fo r, an d e xte n t o f, re g res s i o n tes ts ;

r) th e re pe atabi l i ty o f th e te s ts .

N O TE — For fu rth e r i n fo rm ati o n , see I S O /I E C 1 2207: 1 995, s u b cl au s e s 5. 1 . 5, 5. 3. 5. 5, 5. 3. 6. 5, 5. 3. 6. 6, 5. 3 . 7, 5. 3. 1 1 an d

5. 3. 1 3.

4.1 0.2 Receiving inspection and testing

4.1 0.2.1 Th e s u ppl i e r s h al l en s u re th at i n co m i n g pro d u ct is n ot u sed or pro ces s e d ( exce pt in th e

ci rcu m s tan ces d es cri bed in 4. 1 0 . 2 . 3 ) u n ti l it h as bee n i n s pected or o th erwi s e ve ri fi e d as co n fo rm i n g

to s peci fi e d re q u i rem en ts . Veri fi cati o n of co n fo rm an ce to th e s peci fi ed req u i re m e n ts s h al l be in

acco rd an ce wi th th e q u al i ty pl an an d /o r d o cu m en ted pro ced u re s .

4.1 0.2.2 In d eterm i n i n g th e am o u n t an d n atu re o f rece i vi n g i n s pecti o n , co n s i d erati o n s h al l be g i ve n

to th e am o u n t of co n tro l e xerci s ed at th e s u bco n tracto r' s prem i s e s an d re co rd e d evi d e n ce of

co n fo rm an ce pro vi d e d .

4.1 0.2.3 Wh e re i n co m i n g pro d u ct is re l e as e d fo r u rg en t pro d u cti o n pu rpo s e s pri o r to veri fi cati o n , it

s h al l be po s i ti ve l y i d en ti fi ed an d reco rd e d ( s ee 4. 1 6 ) in o rd e r to perm i t i m m e d i ate recal l an d

repl acem en t i n th e e ve n t o f n o n co n fo rm i ty to s pe ci fi e d re q u i re m e n ts .

Th e s u ppl i er m ay be re q u i re d to acq u i re an d i n cl u d e s o ftware pro d u ct, i n cl u d i n g d ata, s u ppl i ed by a th i rd party. Th e

s u ppl i er sh ou l d e s tabl i s h an d m ai n tai n d o cu m e n te d pro ced u res fo r veri fi cati o n ( u po n rece i pt) of s u ch pro d u ct, taki n g

i n to acco u n t th e re q u i rem en ts o f th e co n tract.

Th e s u ppl i er m ay appl y th e s am e ki n d s o f veri fi cati o n acti vi ti e s to cu s to m e r- s u ppl i e d pro d u ct as to pu rch as ed pro d u ct.

20
© I SO I SO 9000-3: 1 997(E)

4.1 0.3 In-process inspection and testing

Th e supplier shall:

a) inspect and test product as requ ired by the qual ity plan and/or docum ented procedures;

b) h old product u nti l the required inspecti on and tests have been completed or necessary reports
have been recei ved and verified, except when produ ct is rel eased under posi tive-recal l
procedures (see 4. 1 0. 2. 3) . Release u nder positive-recall procedures shall not preclude th e
activities ou tli ned in 4. 1 0. 3a) .

The general considerations for testing apply.

4.1 0.4 Final inspection and testing

The suppl ier sh al l carry ou t all fi nal i nspection and testi ng in accordance wi th the qu ality plan and/or
docu mented procedu res to complete th e evidence of conformance of the fi ni shed product to the
specified requi rements.

The quali ty pl an and/or docum ented procedures for fi nal inspecti on and testi ng sh al l requ ire th at al l
specified inspecti on and tests, i nclu di ng th ose specified ei th er on receipt of product or in-process,
h ave been carried ou t and that the resu lts meet speci fi ed requ irem ents.

N o produ ct sh al l be dispatched unti l all th e acti viti es speci fi ed in the quali ty plan and/or docum ented
procedures have been satisfactori ly completed and th e associated data and docum entation are
avai labl e and au th ori zed.

Before offering the product for cu stom er acceptance, the su ppli er sh oul d val idate the operation of the product i n
accordance with i ts specified i ntended u se, u nder conditions sim il ar to th e appl ication environment, as specified in th e
contract. Any di fferences between the vali dati on envi ronm ent and the actu al appli cation environment, and the risks
associated with su ch differences, sh ou ld be identified and ju stified as early in th e life cycle as possible, and recorded.

I n the course of vali dation, confi gu rati on audits or eval uati ons may be performed, wh ere appropri ate, before release of
a confi gu rati on basel ine to confirm, by exami nati on of th e review, i nspection and test records, th at th e software produ ct
complies wi th i ts contractu al or speci fi ed requ irements.

When considering the test environment, the foll owing concerns sh ou ld be addressed:

a) th e featu res to be tested;

b) th e controls to be placed on the test envi ronm ent, i nclu di ng th e test tools;
c) any l im itations pl aced on th e tests, by th e environment.

Where testi ng i n the target envi ronm ent i s requi red, th e fol lowing concerns sh oul d be addressed:

a) th e specific responsi bi li ti es of th e su ppli er and custom er for carryi ng ou t and eval uati ng th e test;
b) restorati on of th e user environm ent (after test) .

Acceptance test support may be requ ired wh en the suppl ier is ready to deli ver the vali dated produ ct. The cu stomer
sh ou ld judge wh ether or not the product is acceptable according to previ ou sly agreed criteria and i n a m anner speci fi ed
i n th e contract. Acceptance tests sh ou ld be performed by th e cu stomer or m ay be perform ed on beh al f of th e
cu stomer by the supplier or a th ird party. The su ppli er shou ld cooperate in acceptance activities wi th the cu stomer as
stipul ated in the contract.

When acceptance testing, if requi red by the contract, is performed by the suppl ier, th e acceptance test activiti es may
be recogni zed as rel ating to final inspection and test, and val idation. I n some i nstances, val idation, field testi ng and
acceptance testi ng m ay be one and th e sam e acti vity.

Before carryi ng ou t acceptance acti viti es, the suppl ier shou ld assist th e cu stomer to identi fy the fol lowi ng:

21
I SO 9000-3: 1 997(E) © I SO

a) ti me schedule;
b) procedu res for evalu ation, including acceptance criteria;
c) software/hardware environments, i nclu di ng the controls on them;
d) hu man resources requ ired and associated trai ni ng.

The method of handling problems detected during the acceptance procedure and their di sposition shou ld be agreed
between the cu stomer and su ppli er and documented.

4.1 0.5 Inspection and test records

The su pplier shall establi sh and maintain records which provi de evi dence that the product has been
i nspected and/or tested. These records shall show clearly whether te product has passed or fai led
the i nspections and/or tests according to defi ned acceptance criteria. Where the produ ct fails to
pass any i nspection and/or test, the procedures for control of nonconformi ng produ ct shall apply
(see 4. 1 3) .

Records shall identify the i nspection authori ty responsible for the release of product (see 4. 1 6) .

The su ppli er should ensu re that the test results are recorded as defined i n the relevant specificati on.

4. 1 1 Con trol of i n specti on , m easu ri n g an d test eq u i pm en t

4.1 1 .1 General

The supplier shall establish and mai ntai n documented procedu res to control, calibrate and mai ntai n
i nspection, measu ring and test equi pment (inclu di ng test software) , used by the su ppli er to
demonstrate the conformance of product to the specified requ irements. I nspection, measuring and
test equi pment shall be u sed i n a manner which ensures that the measurement u ncertai nty is
known and i s consi stent with the requ ired measurement capabi li ty.

Where test software or comparative references su ch as test hardware are used as su itable forms of
i nspection, they shall be checked to prove that they are capable of verifying the acceptability of
produ ct, prior to release for use during produ cti on, i nstallati on or servi cing and shall be rechecked at
prescribed intervals. The su pplier shall establish the extent and frequ ency of su ch checks and shall
mai ntai n records as evidence of control (see 4. 1 6) .

Where the availability of techni cal data pertaining to the i nspection, measuring and test equ ipment i s
a specified requ irement, su ch data shall be made available, when requ ired by the customer or
cu stomer's representati ve, for verification that the i nspection, measu ri ng and test equ ipment is
functi onally adequ ate.

NOTE 17 For the pu rposes of thi s I nternati onal Standard, the term "measu ri ng equ i pment" i nclu des
measu remen t devi ces.

Where the su ppli er u ses tools, facilities and techni qu es, i n the condu ct of any tests verifyi ng conformance of the
software product to speci fi ed requ irements, the su pplier should consi der the effect of su ch tools on the qu ality of the
software produ ct, when approving them. I n addi ti on, such tools may be placed u nder configuration management pri or
to u se.

The scope of use of test tools and techni qu es shou ld be documented and their use reviewed at defi ned intervals, to
determi ne if there is a need to improve and/or u pgrade them.

N OTE — For fu rth er i n form ati on , see I SO/I EC 1 2207: 1 995, su bcl au se 7. 2.

22
© I SO I SO 9000-3: 1 997(E)

4.1 1 .2 Control procedure

Th e supplier shall:

a) determine the m easurements to be made and the accuracy requ ired, and select the
appropriate inspection, measu ring and test equi pment that is capabl e of th e necessary
accuracy and precision;

b) identify all inspection, measuri ng and test equ ipm ent th at can affect product qu ality, and
calibrate and adjust th em at prescribed interval s, or pri or to use, against certifi ed equipment
having a known valid rel ati onsh ip to international ly or nationall y recogni zed standards. Wh ere
no such standards exi st, the basis u sed for cal ibrati on shal l be docu mented;

c) defi ne th e process employed for th e cali bration of inspection, measuring and test equ ipm ent,
inclu ding details of equ ipm ent type, u niqu e identification, location, frequ ency of ch ecks, ch eck
meth od, acceptance criteri a and th e action to be taken when resu lts are u nsati sfactory;

d) identi fy inspection, measu ri ng and test equi pm ent wi th a sui tabl e i ndicator or approved
identi fi cation record to sh ow th e cali bration statu s;

e) mai ntain cali bration records for inspection, measu ri ng and test equi pment (see 4. 1 6) ;

f) assess and docu ment th e vali di ty of previ ou s i nspection and test resu lts wh en inspecti on,
measu ring and test equ ipment is found to be ou t of cal ibrati on;

g) ensure that th e envi ronmental conditions are sui tabl e for the cal ibrati ons, i nspections,
measu rements and tests bei ng carried ou t;

h) ensure that th e h andli ng, preservation and storage of inspecti on, measu ring and test
equi pm ent i s su ch that the accu racy and fitness for use are m ai ntai ned;

i) safegu ard inspecti on, measuring and test facili ti es, including both test h ardware and test
software, from adjustments whi ch woul d i nvali date the cal ibrati on setting.

N OTE 1 8 Th e metrol ogi cal confi rmati on system for measu ri ng equ i pment g i ven i n I SO 1 001 2 may be u sed

for g u i dance.

Cal ibrati on is a verifi cation technique that i s not directly appli cable to software. H owever, i t m ay be appli cable to
h ardware and tools used to test and vali date th e software. Consequ entl y, i tems b) to f) above are not appl icabl e to th e
software itself bu t may be appli cable to th e environment used wh en testi ng th e software.

4. 1 2 I n specti on an d test statu s

The inspecti on and test statu s of produ ct sh al l be identi fi ed by su itable m eans, wh ich indi cate th e
conformance or nonconformance of produ ct with regard to i nspection and tests performed. The
i dentificati on of i nspection and test statu s sh al l be maintained, as defined in the qu al ity plan and/or
docu mented procedures, th roughou t produ cti on, i nstal lati on and servicing of th e produ ct to ensu re
that only produ ct th at has passed the requi red inspecti ons and tests [or rel eased u nder an
authori zed concession (see 4. 1 3. 2) ] is di spatch ed, u sed or i nstalled.

The su ppli er shoul d have a m eans of identi fying th e stage of development of the com ponents of th e produ ct and th e
test status. For example: untested; tested with error; tested successfu ll y or approved for rel ease to any fu rther
developm ent activity. The creation of bu ilds or the movem ent of software i tems between development, test and
operati onal environments m ay serve to indi cate th is statu s. I nspecti on and test records may be u sed to i dentify
i nspection and test statu s.

N OTE — For fu rth er i n form ati on , see I SO/I E C 1 2207: 1 995, su bcl au se 6. 2.

23
I SO 9000-3: 1 997(E) © I SO

4. 1 3 Con trol of n on con form i n g prod u ct

4.1 3.1 General

Th e s u ppl i e r s h al l e s tabl i s h an d m ai n tai n d o cu m e n ted pro ce d u re s to en s u re th at pro d u ct th at d oes

n ot co n fo rm to s pe ci fi e d req u i rem en ts is preve n ted fro m u n i n te n d e d u se or i n s tal l ati o n . Th i s co n tro l

s h al l pro vi d e fo r i d en ti fi cati o n , d o cu m en tati o n , eval u ati o n , s eg re g ati o n ( wh e n practi cal ) , d i s po s i ti o n

o f n o n co n fo rm i n g pro d u ct, an d fo r n o ti fi cati o n to th e fu n cti o n s co n cern e d .

In s o ftware d e vel o pm e n t, s e g reg ati o n of n o n co n fo rm i n g i tem s m ay be effe cted by tran s ferri n g th e i te m ou t of a

pro d u cti o n or a te s ti n g e n vi ro n m en t, i n to a s eparate e n vi ro n m en t. In th e cas e of em be d d e d s o ftware it m ay be co m e

n ece s s ary to s e g reg ate th e n o n co n fo rm i n g i te m ( h ard ware ) wh i ch co n tai n s th e n o n co n fo rm i n g s o ftware.

Th e s u ppl i e r sh ou l d i d en ti fy at wh at po i n ts co n tro l an d re co rd i n g of n o n co n fo rm i n g pro d u ct is req u i re d . Wh ere a

s o ftware i te m m an i fe s ts a d e fe ct d u ri n g th e d e vel o pm e n t or m ai n te n an ce pro ce s s , th e i n ves ti g ati o n an d re s o l u ti o n of

s u ch d e fe cts sh ou l d be co n tro l l ed an d re co rd ed .

A co n fi g u rati o n m an ag e m e n t pro ces s m ay be i n vo ked to i m pl e m e n t part o r th e wh o l e o f th i s re q u i rem en t.

N O TE — Fo r fu rt h e r i n fo rm at i o n , see I S O /I E C 1 2207: 1 995, s u b cl au s e s 6. 2 an d 6. 8.

4.1 3.2 Revi ew and di sposition of nonconforming product

Th e re s po n s i bi l i ty fo r re vi ew an d au th o ri ty fo r th e d i s po s i ti o n of n o n co n fo rm i n g pro d u ct s h al l be

d efi n ed .

N o n co n fo rm i n g pro d u ct s h al l be revi ewed in acco rd an ce wi th d o cu m e n ted pro ce d u res . I t m ay be:

a) re wo rke d to m e et th e s pe ci fi e d re q u i re m e n ts ;

b) accepted wi th o r wi th o u t repai r by co n ce s s i o n ;

c) re g rad ed fo r al te rn ati ve appl i cati o n s ; or

d) re j e cte d o r s crapped .

Wh e re req u i re d by th e co n tract, th e pro po s e d u se o r re pai r o f pro d u ct [s e e 4. 1 3 . 2b) ] wh i ch d o es n ot

co n fo rm to s pe ci fi e d re q u i re m e n ts s h al l be repo rte d fo r co n ces s i o n to th e cu s to m e r or cu s to m e r' s

repre s en tati ve. Th e d e s cri pti o n of th e n o n co n fo rm i ty th at h as bee n accepte d , an d of repai rs , s h al l

be re co rd ed to d en o te th e actu al co n d i ti o n (see 4. 1 6 ) .

R epai re d an d /o r rewo rked pro d u ct s h al l be re - i n s pe cte d in acco rd an ce wi th th e q u al i ty pl an an d /o r

d o cu m e n ted pro ce d u re s .

Atten ti o n sh ou l d be pai d to th e fo l l o wi n g as pe cts , in th e d i s po s i ti o n o f n o n co n fo rm i ti e s :

a) an y d i s co ve re d pro bl e m s an d th ei r po s s i bl e i m pacts to an y o th e r parts of th e s o ftware sh ou l d be n o te d an d th o s e

res po n s i bl e n o ti fi e d so th e pro bl e m s can be tracke d u n ti l th e y are re s o l ve d ;

b) are as i m pacte d by an y m o d i fi cati o n s sh ou l d be i d e n ti fi e d an d re - te s te d , an d th e m e th o d fo r d e te rm i n i n g th e s co pe

o f re - te s ti n g sh ou l d be i d en ti fi ed in a d o cu m e n te d pro ce d u re;

c) th e pri o ri ty o f th e n o n co n fo rm i ti e s .

Wi th s o ftware , re pai r or re wo rk to ach i e ve fu l fi l m e n t of s pe ci fi e d re q u i rem en ts cre ates a n ew s o ftware vers i o n . In

s o ftware d e ve l o pm e n t, d i s po s i ti o n o f n o n co n fo rm i n g pro d u ct m ay be ach i eve d by:

a) re pai r o r rewo rk ( i . e . to fi x d e fe cts ) to m e et th e req u i re m e n t;

b) acce ptan ce wi th o r wi th o u t re pai r by co n ces s i o n ;

c) treatm en t as a co n fo rm i n g pro d u ct afte r th e am e n d m e n t o f re q u i rem en ts ;

d) re j ecti o n .

24
© I SO I SO 9000-3: 1 997(E)

4. 1 4 Correcti ve an d preven ti ve acti on

4.1 4.1 General

The su ppli er sh all establ ish and maintain docu mented procedu res for im pl em enti ng correcti ve and
preventi ve action.

Any correcti ve or preventive acti on taken to elim inate the causes of actual or potenti al
nonconform ities sh al l be to a degree appropriate to the m agni tu de of problems and commensu rate
with th e risks encou ntered.

The su ppl ier shall im pl em ent and record any ch anges to th e docum ented procedu res resul ti ng from
corrective and preventi ve acti on.

Where corrective acti on di rectl y affects th e software produ ct, th e configuration managem ent process m ay be invoked
to m anage th e ch anges. Corrective actions that involve ch anges to th e software life cycle processes sh ou ld be
reviewed by managem ent and i mplemented by means of docu ment and data control procedu res.

N OTE — For fu rth er i n form ati on , see I SO/I E C 1 2207: 1 995, su bcl au ses 6. 2, 6. 8 an d 7. 3.

4.1 4.2 Corrective action

The procedu res for correcti ve action sh al l include:

a) th e effective handli ng of custom er com pl ai nts and reports of produ ct nonconform ities;

b) investigation of th e cau se of nonconform ities relating to produ ct, process and qu ality system ,
and recordi ng th e resu lts of the i nvesti gation (see 4. 1 6) ;

c) determ ination of th e corrective acti on needed to eli mi nate th e cause of nonconform ities;

d) appl icati on of controls to ensure th at correcti ve acti on i s taken and th at i t i s effective.

N o fu rth er software-related gu idance i s provided.

4.1 4.3 Preventive action

The procedu res for preventive acti on shall i nclu de:

a) th e use of appropriate sources of i nformati on su ch as processes and work operations wh ich

affect product qu ality, concessions, au di t resul ts, qu ality records, servi ce reports and cu stomer
complaints to detect, anal yze and eli mi nate potential cau ses of nonconform ities;

b) determ ination of th e steps needed to deal with any problems requ iring preventive acti on;

c) initi ation of preventi ve action and appl ication of controls to ensure th at it i s effecti ve;

d) ensuring that rel evant inform ation on actions taken i s su bmitted for m anagement review (see
4. 1 . 3) .

Analysis of th e root causes of nonconformi ti es may provi de inpu t to preventi ve acti on. Th e m easures taken to reverse
u nfavou rabl e trends i n metric l evels may be consi dered as preventive acti ons.

4. 1 5 H an d l i n g , storag e, packag i n g , preservati on an d d el i very

4.1 5.1 General

The suppl ier sh al l establ ish and m ai ntai n docum ented procedu res for h andl ing, storage, packagi ng,
preservation and del ivery of product.

25
I SO 9000-3: 1 997(E) © I SO

No fu rth er s o ftware- re l ate d g u i d an ce is pro vi d e d .

N O TE — Fo r fu rt h e r i n fo rm at i o n , see I S O /I E C 1 2207: 1 995, s u b cl au s e s 5 . 2 . 7. 1 , 5. 3. 1 3. 2 an d 6. 2. 6.

4.1 5.2 Handling

Th e s u ppl i er s h al l pro vi d e m e th o d s o f h an d l i n g pro d u ct th at pre ven t d am ag e o r d e teri o rati o n .

D am ag e to s o ftware m e an s al terati o n of co n ten ts . S o ftware i n fe cti o n by co m pu ter vi ru s sh ou l d be treate d as d am ag e d

s o ftware .

S o ftware i n fo rm ati o n d oes n ot d e te ri o rate; h o weve r, th e m ed i a on wh i ch it is s to red m ay be s u bj ect to d eteri o rati o n ,

an d appro pri ate pre cau ti o n s sh ou l d be taken by th e s u ppl i e r.

Vi ru s pro te cti o n req u i re m e n ts , as appl i cabl e to s o ftware pro d u cts d e s i g n ate d fo r d e l i ve ry, are d es cri be d as part of th e

g u i d an ce on repl i cati o n .

4.1 5.3 Storag e

Th e s u ppl i e r s h al l u se d e s i g n ate d s to rag e areas or s to ck ro o m s to preve n t d am ag e or d ete ri o rati o n

of pro d u ct, pen d i n g u se or d el i ve ry. Appro pri ate m e th o d s fo r au th o ri z i n g rece i pt to an d d i s patch

fro m s u ch are as s h al l be s ti pu l ate d .

In o rd er to d etect d e te ri o rati o n , th e co n d i ti o n of pro d u ct in s to ck s h al l be as s e s s e d at appro pri ate

i n terval s .

A s ys te m sh ou l d be e s tabl i s h e d fo r:

a) s to ri n g s o ftware i tem s ;

b) co n tro l l i n g acces s to s o ftware i tem s ;

c) m ai n tai n i n g vers i o n s o f pro d u cts in e s tabl i s h ed bas el i n es .

To pro te ct th e i n teg ri ty o f th e pro d u ct an d pro vi d e a bas i s fo r th e co n tro l o f ch an g e , it is e s s en ti al th at s o ftware i tem s be

h el d in an e n vi ro n m e n t wh i ch :

a) pro tects th e m fro m u n au th o ri z e d ch an g e o r co rru pti o n ;

b) pe rm i ts th e co n tro l l e d acce s s to an d re tri e val o f th e m as ter an d an y co pi e s .

C o n s i d erati o n sh ou l d be g i ve n to th e s to rag e of co m pu te r m e d i a, parti cu l arl y wi th re s pe ct to th e el ectro m ag n eti c an d

e l e ctro s tati c en vi ro n m e n t.

4.1 5.4 Packaging

Th e s u ppl i er s h al l co n tro l packi n g , packag i n g an d m arki n g pro ce s s es ( i n cl u d i n g m ate ri al s u s ed ) to

th e e xte n t n e ces s ary to en s u re co n fo rm an ce to s peci fi ed req u i re m e n ts .

P ackag i n g req u i re m e n ts , as appl i cabl e to s o ftware pro d u cts , d es i g n ated fo r d el i ve ry, are d es cri bed as part of th e

g u i d an ce on repl i cati o n . In cas es wh ere el ectro n i c s to rag e is u sed th e re m ay be no ph ys i cal acti vi ty rel ated to th i s

cl au s e . D u ri n g packag i n g , s o ftware m ay be co m pre s s ed an d /o r e n crypte d .

4.1 5.5 Preservation

Th e s u ppl i e r s h al l appl y appro pri ate m e th o d s fo r pre s ervati o n an d s eg re g ati o n of pro d u ct wh e n th e

pro d u ct i s u n d er th e s u ppl i e r' s co n tro l .

26
© I SO I SO 9000-3: 1 997(E)

A s ys te m sh o u l d be e s tabl i s h e d to pro vi d e th e capab i l i ty to pres e rve s o ftware i te m s , fo r exam pl e :

a) reg u l ar back- u p o f s o ftware ;

b) e n s u ri n g th e ti m e l y co pyi n g o f s o ftware to re pl ace m e n t m e d i a;

c) th e s to rag e o f s o ftware m ed i a i n a pro tected en vi ro n m e n t;

d) th e s to rag e of s o ftware m ed i a i n red u n d an t en vi ro n m e n ts to e n s u re d i s as ter re co ve ry.

4.1 5.6 Delivery

Th e s u ppl i er s h al l arran g e fo r th e pro te cti o n of th e q u al i ty of pro d u ct afte r fi n al i n s pecti o n an d te s t.

Wh ere co n tractu al l y s peci fi e d , th i s pro te cti o n s h al l be exten d e d to i n cl u d e d el i ve ry to d e s ti n ati o n .

D el i ve ry m ay be ach i eve d by ph ys i cal m o ve m e n t of m ed i a co n tai n i n g s o ftware , or by e l e ctro n i c tran s m i s s i o n . In cas es

wh e re e l e ctro n i c tran s m i s s i o n is u sed , co n s i d e rati o n sh ou l d be g i ve n to pro tecti o n ag ai n s t d am ag e by vi ru s es .

D o cu m e n ted pro ced u re s sh ou l d be es tabl i s h e d an d m ai n tai n ed fo r ve ri fyi n g th e co rre ctn e s s an d co m pl eten e s s of

co pi es o f th e s o ftware pro d u ct d e l i vered . Th e s e pro ced u res sh ou l d pro vi d e fo r appro pri ate preve n ti ve acti o n to pro tect

th e s o ftware pro d u ct fro m d am ag e d u ri n g d e l i very. In ad d i ti o n , d o cu m e n ted pro ce d u re s sh ou l d exi s t to ve ri fy th at an

appro pri ate l e ve l of s o ftware vi ru s ch ecki n g h as bee n pe rfo rm e d an d th at appro pri ate m e as u re s h ave be en taken to

pro te ct pro d u ct i n te g ri ty.

4. 1 6 Con trol of q u al i ty record s

Th e s u ppl i e r s h al l es tabl i s h an d m ai n tai n d o cu m en te d pro ced u re s fo r i d en ti fi cati o n , co l l e cti o n ,

i n d exi n g , acce s s , fi l i n g , s to rag e , m ai n te n an ce an d d i s po s i ti o n o f q u al i ty re co rd s .

Q u al i ty re co rd s s h al l be m ai n tai n e d to d em o n s trate co n fo rm an ce to s pe ci fi e d re q u i rem en ts an d th e

e ffe cti ve o pe rati o n of th e q u al i ty s yste m . P erti n e n t q u al i ty re co rd s fro m th e su bco n tracto r s h al l be

an el em en t o f th e s e d ata.

Al l q u al i ty reco rd s s h al l be l eg i bl e an d s h al l be s to red an d retai n ed in s u ch a way th at th e y are

read i l y re tri e vabl e in faci l i ti e s th at pro vi d e a s u i tabl e e n vi ro n m en t to preve n t d am ag e or d eteri o rati o n

an d to pre ven t l oss. Re ten ti o n ti m e s of q u al i ty re co rd s s h al l be e s tabl i s h ed an d re co rd ed . Wh ere

ag ree d co n tractu al l y, q u al i ty reco rd s s h al l be m ad e avai l abl e fo r e val u ati o n by th e cu s to m er or th e

cu s to m e r' s re pres e n tati ve fo r an ag re e d pe ri o d .

N OTE 1 9 Re co rd s m ay be in th e fo rm o f an y type o f m e d i a, s u ch as h ard co py o r e l e ctro n i c m e d i a.

E xam pl es o f q u al i ty reco rd s are:

— d o cu m e n te d te s t res u l ts ;

— pro bl e m re po rts ;

— ch an g e re q u es ts ;

— an n o tate d d o cu m e n ts ;

— revi e w re co rd s ;

— m i n u tes ;

— au d i t re po rts .

Wh e re re co rd s are h el d on el ectro n i c m ed i a, co n s i d e rati o n o f th e re te n ti o n ti m es an d acces s i bi l i ty o f th e re co rd s sh ou l d

take i n to acco u n t th e rate of d e g rad ati o n of th e el ectro n i c i m ag e s an d th e avai l abi l i ty of th e d evi ce s an d s o ftware

n ee d e d to acce s s th e re co rd s .

N O TE — Fo r fu rt h e r i n fo rm at i o n , see I S O /I E C 1 2207: 1 995, s u b cl au s e 6. 1 . 6. 2.

27
I SO 9000-3: 1 997(E) © I SO

4. 1 7 I n tern al q u al i ty au d i ts

Th e s u ppl i e r s h al l es tabl i s h an d m ai n tai n d o cu m e n ted pro ce d u re s fo r pl an n i n g an d i m pl em en ti n g

i n tern al q u al i ty au d i ts to veri fy wh e th e r q u al i ty acti vi ti es an d re l ate d re s u l ts co m pl y wi th pl an n e d

arran g e m e n ts an d to d e te rm i n e th e e ffe cti ve n e s s o f th e q u al i ty s ys te m .

I n tern al q u al i ty au d i ts s h al l be s ch e d u l e d on th e bas i s of th e s tatu s an d i m po rtan ce of th e acti vi ty to

be au d i ted an d s h al l be carri ed o u t by pe rs o n n e l i n d epen d e n t of th o s e h avi n g d i rect re s po n s i bi l i ty fo r

th e acti vi ty be i n g au d i ted .

Th e res u l ts of th e au d i ts s h al l be re co rd ed ( s ee 4. 1 6) an d bro u g h t to th e atten ti o n of th e pe rs o n n el

h avi n g re s po n s i bi l i ty in th e area au d i ted . Th e m an ag em en t pe rs o n n e l res po n s i bl e fo r th e area s h al l

take ti m el y co rrecti ve acti o n on d e fi ci e n ci es fo u n d d u ri n g th e au d i t.

Fo l l o w- u p au d i t acti vi ti es s h al l ve ri fy an d re co rd th e i m pl e m e n tati o n an d e ffe cti ven es s of th e

co rrecti ve acti o n taken ( s ee 4. 1 6 ) .

N OTE S

20 Th e re s u l ts of i n te rn al q u al i ty au d i ts fo rm an i n te g ral part of th e i n pu t to m an ag e m e n t re vi e w

acti vi ti e s (see 4. 1 . 3) .

21 G u i d an ce on q u al i ty s ys te m au d i ts is g i ve n in I SO 1 001 1 .

Wh e n s o ftware s u ppl i e rs o rg an i z e th ei r wo rk i n to pro j e cts , th e au d i t pl an sh ou l d d e fi n e a s el ecti o n of pro j ects .

C o n s i d erati o n sh o u l d be g i ve n to co ve ri n g pro g re s s i ve l y th e wh o l e q u al i ty s ys te m of th e s u ppl i e r. Th i s m ay be

ach i e ved by au d i ti n g s e ve ral pro j e cts at d i ffe re n t s tag e s th ro u g h o u t th e l i fe cycl e . Wh e re a si n g l e pro j e ct is co n s u m i n g

m ost of th e re s o u rce s of th e o rg an i z ati o n , au d i ts of th at pro j ect m ay be s ch ed u l ed as it pro g res s e s . Wh ere th e

i n ten d e d pro j ect ch an g e s i ts ti m e s cal es , th e i n tern al au d i t s ch ed u l e sh ou l d be revi e we d , e i th e r to ch an g e th e ti m i n g of

th e au d i t, o r to co n s i d er a d i ffe re n t pro j e ct.

Th e s u ppl i e r' s i n te rn al au d i to r s h o u l d co n s i d er th e co n s i s ten cy be twee n th e pro j e ct q u al i ty pl an s wi th th e o rg an i z ati o n ' s

q u al i ty s ys te m .

N O TE Fo r fu rt h e r i n fo rm at i o n , see I S O /I E C 1 2207: 1 995, s u b cl au s e s 6. 7, 6. 8 an d 7. 3. 2.

4. 1 8 Trai n i n g

Th e s u ppl i e r s h al l e s tabl i s h an d m ai n tai n d o cu m e n te d pro ce d u re s fo r i d e n ti fyi n g trai n i n g n e ed s an d

pro vi d e fo r th e trai n i n g of al l pe rs o n n el perfo rm i n g acti vi ti e s affecti n g q u al i ty. P e rs o n n el perfo rm i n g

s pe ci fi c ass i g n e d tas ks s h al l be q u al i fi ed on th e bas i s of appro pri ate e d u cati o n , trai n i n g an d /o r

e xpe ri en ce, as re q u i re d . Appro pri ate reco rd s o f trai n i n g s h al l be m ai n tai n ed (see 4. 1 6) .

Th e trai n i n g n e ed s to be ad d re s s ed sh ou l d be d eterm i n e d co n s i d e ri n g th e s peci fi c to o l s , tech n i q u es , m e th o d s an d

co m pu ter re s o u rce s to be u sed in th e d eve l o pm en t an d m an ag e m e n t o f th e s o ftware pro d u ct. It might al s o be re q u i red

to i n cl u d e trai n i n g in th e s ki l l s an d kn o wl ed g e of th e s peci fi c fi el d wi th wh i ch th e s o ftware is to d e al . Q u al i fi cati o n an d

trai n i n g re q u i re m e n ts sh ou l d be d o cu m e n te d .

N O TE — Fo r fu rt h e r i n fo rm at i o n , see I S O /I E C 1 2207: 1 995, s u b cl au s e 7. 4.

4. 1 9 Servi ci ng

Wh ere s ervi ci n g is a s pe ci fi e d req u i rem e n t, th e s u ppl i er s h al l e s tabl i s h an d m ai n tai n d o cu m en ted

pro ced u re s fo r pe rfo rm i n g , veri fyi n g an d re po rti n g th at th e s ervi ci n g m ee ts th e s peci fi ed

re q u i re m en ts .

28
© I SO I SO 9000-3: 1 997(E)

Fo r th e pu rpo s e s of th i s part of I SO 9000, s ervi ci n g is reco g n i z e d as bei n g rel ated to th e s o ftware te rm s : m ai n te n an ce

an d cu s to m er s u ppo rt. C u s to m e r s u ppo rt i s d e s cri be d in I SO 9000-2.

M ai n ten an ce acti vi ti e s fo r s o ftware pro d u cts are typi cal l y cl as s i fi ed i n to th e fo l l o wi n g .

a) P ro bl e m res o l u ti o n : th i s i n vo l ve s th e d e te cti o n an d an al ys i s of s o ftware n o n co n fo rm i ti e s cau s i n g o perati o n al

pro bl e m s , an d co rrecti o n of th e u n d erl yi n g s o ftware fau l ts . Wh en re s o l vi n g pro bl e m s , tem po rary fi xe s m ay be

u sed to m i n i m i ze d o wn ti m e an d pe rm an e n t m o d i fi cati o n s carri ed o u t l ate r.

b) I n te rface m o d i fi cati o n s: th e se m ay be re q u i re d wh e n ad d i ti o n s or ch an g es are m ad e to th e h ard ware s ys tem , or

co m po n e n ts , co n tro l l ed by th e s o ftware .

c) Fu n cti o n al expan s i o n o r perfo rm an ce i m pro ve m e n t.

Fo r i n terface m o d i fi cati o n s an d fu n cti o n al e xpan s i o n , d e pen d i n g u po n th e s cal e of wo rk, ch an g e co n tro l pro ce d u res

sh ou l d appl y, or a n ew an d s e parate d e vel o pm e n t pro j ect sh ou l d be i n i ti ate d , an d th e wh o l e of th i s part of I SO 9000

beco m e s re l e van t. Th e m ai n ten an ce acti vi ti es d e s cri be d in th i s cl au s e are th e re fo re l i m i te d to pro bl em res o l u ti o n

( o fte n cal l ed co rrecti ve m ai n te n an ce ) .

Wh e n m ai n te n an ce of th e s o ftware pro d u ct is req u es ted by th e cu s to m er after i n i ti al d e l i very an d i n s tal l ati o n , th i s

sh ou l d be s ti pu l ated in th e co n tract. Th e s u ppl i er sh ou l d es tabl i s h an d m ai n tai n d o cu m e n te d pro ce d u re s fo r

perfo rm i n g m ai n ten an ce acti vi ti es an d ve ri fyi n g th at s u ch acti vi ti e s m e et th e s pe ci fi e d req u i re m e n ts fo r m ai n ten an ce .

M ai n ten an ce acti vi ti e s m ay al s o be perfo rm ed on th e d e vel o pm e n t en vi ro n m e n t, to o l s an d d o cu m e n tati o n .

Th e i tem s to be m ai n tai n ed , an d th e pe ri o d of ti m e fo r wh i ch th e y sh ou l d be m ai n tai n ed , sh ou l d be s pe ci fi e d in th e

co n tract. Th e fo l l o wi n g are e xam pl es o f s u ch i te m s :

a) pro g ram ( s ) ;

b) d ata an d th e i r s tru ctu res ;

c) s peci fi cati o n s ;

d) d o cu m en ts fo r cu s to m e r an d /o r u s er;

e) d o cu m en ts fo r s u ppl i er' s u se;

f) te s t pl an s .

Al l m ai n te n an ce acti vi ti e s sh ou l d be carri ed ou t an d m an ag e d in acco rd an ce wi th a m ai n te n an ce pl an an d /o r

pro ced u re s d efi n ed an d ag re ed be fo re h an d by th e s u ppl i e r an d cu s to m er. Th e pl an sh ou l d i n cl u d e th e fo l l o wi n g , as

appro pri ate:

a) s co pe o f m ai n te n an ce ;

b) i d en ti fi cati o n o f th e i n i ti al s tatu s o f th e pro d u ct;

c) s u ppo rt o rg an i z ati o n ( s ) ;

d) m ai n te n an ce acti vi ti es ;

e) m ai n te n an ce re co rd s an d repo rts ;

f) co n fi g u rati o n m an ag e m e n t acti vi ti es ;

g) pro po s e d rel eas e s ch ed u l e.

Wh e re appro pri ate, m ai n te n an ce acti vi ti es sh ou l d be re co rd e d an d th e re co rd s retai n e d . R u l es fo r th e s u bm i s s i o n of

m ai n ten an ce repo rts sh ou l d be e s tabl i s h ed an d ag re e d u po n by th e s u ppl i er an d cu s to m e r.

Th e m ai n ten an ce reco rd s sh ou l d i n cl u d e th e fo l l o wi n g i te m s , as appro pri ate, fo r each s o ftware pro d u ct bei n g

m ai n tai n e d :

a) pro bl e m re po rts th at h ave bee n re cei ved an d th e cu rren t s tatu s o f each ;

b) o rg an i z ati o n re s po n s i bl e fo r res po n d i n g to re q u e s ts fo r as s i s tan ce or i m pl em en ti n g th e appro pri ate co rre cti ve

acti o n s ;

c) pri o ri ti e s th at h ave be en as s i g n ed to th e co rre cti ve acti o n s ;

d) re s u l ts o f th e co rre cti ve acti o n s ;

e) s tati s ti cal d ata o n fai l u re o ccu rre n ce s an d m ai n te n an ce acti vi ti e s .

Th e re co rd of th e m ai n ten an ce acti vi ti es m ay be u s ed fo r eval u ati o n an d en h an ce m e n t of th e s o ftware pro d u ct an d fo r

i m pro ve m e n t o f th e q u al i ty s ys te m i tse l f.

29
I SO 9000-3: 1 997(E) © I SO

N OTE — For fu rth er i n form ati on , see I SO/I E C 1 2207: 1 995, su bcl au ses 5. 4. 4, 5. 5. an d 6. 8.

4. 20 Stati sti cal tech n i q u es

4.20.1 Identification of need

Th e suppli er sh all i dentify the need for statistical tech niques required for establish ing, controll ing
and verifying process capability and produ ct ch aracteristics.

4.20.2 Procedures

The suppl ier sh al l establish and m ai ntai n docum ented procedu res to i mplement and control th e
appli cation of th e stati sti cal tech niques identi fi ed in 4. 20. 1 .

Stati sti cal tech ni qu es m ay be used to anal yse measu rements of process capabi li ty and produ ct characteristics, wi th the
objective of produ cing data that can be u sed to eval uate produ ct quali ty and process capabi li ty. The data may be used
to assess conformance wi th qu al ity requi rements, when they are expressed qu anti tati vel y.

Exam pl es of product ch aracteristics to whi ch stati sti cal tech ni qu es m ay be appl ied are:

— testabili ty;
— u sabi li ty;
— reliability;
— maintainability;
— availability.

Exam pl es of software process capabil ity ch aracteristi cs to wh ich stati sti cal tech ni qu es m ay be appl ied are:

— process m aturity;
— num ber and type of defects in process outpu ts;
— defect removal efficiency;
— m il estone sl ippage.

The term “metric” means a measu rable ch aracteristi c.

M etrics shoul d com pl y with the fol lowi ng principl es:

a) th e metric sh ou ld bring valu e to th e process or product;

b) th e metric i s clearly defined;
c) th e meaning of the m etric in relati on to software product qu al ity or devel opment process qu al ity i s u nderstood;
d) th e way i n whi ch th e metric m ay be infl uenced (su ch as by ch anges i n desi gn and devel opment tech ni qu es) is
identi fi ed;
e) th e di rection of change in th e m etric, i ndicati ve of im proved quali ty, i s u nderstood.

I ndependent of th e metrics u sed, i t is im portant that level s are known and used for process control and i mprovem ent
rather than wh ich specifi c metrics are u sed.

Different process m etrics may be appropriate for di fferent software products produced by the same su ppl ier.

N OTE — Fu rth er g u i d an ce m ay be fou n d i n I SO/I EC 91 26.

30
© I SO I SO 9000-3: 1 997(E)

An n ex A
(n orm ati ve)

Bi bl i og raph y

[1 ] I SO 9000-2:1 997, Qu ality management and quali ty assu rance standards — Part 2: G eneri c gui deli nes for the
appli cation of I SO 9001 , I SO 9002 and I SO 9003.

[2] I SO 1 0005:1 995, Quali ty management — G u idelines for quali ty plans.

1)
[3] I SO 1 0006:— , Quali ty management — G u idelines to quali ty in project management.

[4] I SO 1 0007:1 995, Quali ty management — G u idelines for confi guration management.

[5] I SO 1 001 1 -1 :1 990, G uidelines for auditing qu ality systems — Part 1 : Au diting.

[6] I SO 1 001 1 -2:1 991 , Gu idelines for au diting qu ality system s — Part 2: Qu alification criteria for qu ality systems
auditors.

[7] I SO 1 001 1 -3:1 991 , G uidelines for auditing qu ality systems — Part 3: Management of au dit programmes.

[8] I SO 1 001 2-1 :1 992, Quali ty assu rance requi rements for measu ring equi pment — Part 1 : Metrological confi rmati on
system for m easu ring equ ipment.

[9] I SO 1 001 3:1 995, G u idelines for developi ng qu ality manuals.

[1 0] I SO/I EC 91 26:1 991 , I nformation technology — Software produ ct evaluation — Quali ty characteristics and
gu idelines for their u se.

[1 1 ] I SO/I EC 1 2207:1 995, I nformation technology — Software life cycle processes.

_____________________
1) To be pu bl i sh ed.

31
I SO 9000-3: 1 997(E) © I SO

An n ex B
(i n form ati ve)

Cross-referen ces to I SO/I EC 1 2207

Thi s cross-reference tabl e:

• identifies I SO/I EC 1 2207 su bclauses th at m ay assist in th e constru ction of a qu ality system th at conform s to
I SO 9001 ;
• sum mari zes th e notes to be found with in th e body of thi s part of I SO 9000.

• is not i ntended to be a complete description of th e rel ation between I SO/I EC 1 2207 and I SO 9001 , i n
parti cu lar h ow I SO/I EC 1 2207 covers th e requi rements of I SO 9001 and vice versa.

I SO 9000-3 I SO/I EC 1 2207

4. 1 . 2 7. 2, 6. 3. 1 . 6

4. 1 . 3 7. 1 . 4

4. 2. 3 6. 2, 6. 3, 6. 4, 6. 5

4. 3. 2 5. 2. 1 , 5. 2. 6, 6. 4. 2. 1

4. 3. 3 5. 1 . 3. 5, 5. 2. 3. 2

4. 4. 2 5. 2. 4

4. 4. 3 5. 2. 6. 1 , 6. 6. 2

4. 4. 4 5. 3. 2, 5. 3. 3, 5. 3. 4

4. 4. 5 5. 3. 5, 5. 3. 6, 5. 3. 7

4. 4. 6 5. 3. 4. 2, 5. 3. 5. 6, 5. 3. 6. 7, 6. 6. 3

4. 4. 7 5. 3. 4. 2, 5. 3. 5. 6, 5. 3. 5. 7, 5. 3. 7. 5, 5. 3. 9, 6. 4

4. 4. 8 5. 3. 1 , 6. 5

4. 4. 9 5. 5. 2, 5. 5. 3, 6. 2. 3

4. 5. 1 6. 1

4. 6. 1 5. 1

4. 7 6. 1

4. 8 6. 1 , 6. 2

4. 9 5. 3. 1 2, 6. 3. 3

4. 1 0. 1 5. 1 . 5, 5. 3. 5. 5, 5. 3. 6. 5, 5. 3. 6. 6, 5. 3. 7, 5. 3. 8, 5. 3. 9, 5. 3. 1 0, 5. 3. 1 1 , 5. 3. 1 3

4. 1 1 . 1 7. 2

4. 1 2 6. 2

4. 1 3. 1 6. 2, 6. 8

4. 1 4. 1 6. 2, 6. 8, 7. 3

4. 1 5. 1 5. 2. 7. 1 , 5. 3. 1 3. 2, 6. 2. 6

4. 1 6 6. 1 . 6. 2

4. 1 7 6. 7, 6. 8, 7. 3. 2

4. 1 8 7. 4

4. 1 9 5. 4. 4, 5. 5, 6. 8

32
I SO 9000-3: 1 997(E) © I SO

I CS 03. 1 20. 1 0

Descri ptors: qu al i ty m an ag em en t, qu al i ty assu ran ce, qu al i ty assu ran ce prog ram m e, q u al i ty assu ran ce system s, com pu ter software,
stan d ard s, i n tern ati on al stan d ard s, i m pl em en tati on , ru l es (i n stru cti on s) .

Pri ce based on 32 pag es