Systematic process improvement using ISO 9001:2000 and CMMI

7.4 Third phase: Establishing 221
nitely advantageous to implement CM in its entirety as soon as practical.
Many configuration management tools are currently available to support
implementation. CM SG 2 is invoked in step 12.
This step addresses two of the six documented procedures required by
the ISO standard, although they are not necessarily required by the CMMI ® .
These are a procedure for controlling records (4.2.3) and a procedure for
controlling storage, protection, retrieval, retention time, and disposition of
records (4.2.4).
Although the spirit of those procedures may be adequately covered in
the corresponding process descriptions and plans, organizations that aspire
to ISO registration may be advised to explicitly write those procedures. This
will satisfy the letter of the ISO standard and avoid potential misunderstandings.
Step 6: Although ISO does not explicitly require a QA function, we recommend
establishing such a function by implementing the PPQA PA generic
practices. PPQA specific practices will be implemented and executed in step
12. The CMMI ® PPQA PA encompasses not only the audits required by ISO
8.2.2, but also provides visibility into, and feedback on, processes and products
throughout the life of the project. Here again, ISO requires organizations
to define a procedure addressing responsibilities and requirements for
planning and conducting audits, and for reporting results and maintaining
records (8.2.2). If such a procedure is not developed during PPQA implementation,
it will have to be specifically written to satisfy this ISO requirement.
Some of the ISO 8.2.2 requirements, such as internal process audits, were
already addressed when implementing OPF. In this step, the organization
may also establish the verification and validation environment and evaluation
criteria.
Step 7: Next, an organization has to establish a measurement and analysis
function by implementing the MA PA to support all of its management
information needs. By implementing this PA, the organization will satisfy a
majority of the ISO Section 8 requirements. [Control of nonconforming
product (8.3) and improvement (8.5) are addressed in steps 6 and 1, respectively.]
SG 2 of this PA will be invoked in step 12.
To address the statistical techniques indicated by ISO (8.1), an organization
may establish some aspects of QPM. However, the QPM PA is more
demanding than many organizations are able to sustain. Therefore, we suggest
using QPM for guidance only (as opposed to fully implementing its
specific and generic practices). Similarly, to analyze results to prevent problems
from recurring, some aspects of the CAR PA may be implemented.
Because CAR is a maturity level 5 PA (in the staged representation), it too
should be used as a guideline only.