ISO/IEC 21827

ISO/IEC 21827:2002(E)
A.4.1
Capability Level Common Features
A.4.1.1 Common Feature Generic Practices
A.4.1.1.1
Summary Description
Base practices are performed according to a well-defined process using approved, tailored versions of standard,
documented processes. The primary distinction from Level 2, Planned and Tracked, is that the process is planned and
managed using an organization-wide standard process.
A.4.1.1.2
Common Features List
This capability level comprises the following common features:
• Common Feature 3.1 - Defining a Standard Process;
• Common Feature 3.2 - Perform the Defined Process;
• Common Feature 3.3 - Coordinate Security Practices.
A.4.2
Common Feature 3.1 - Defining a Standard Process
A.4.2.1 Common Feature Generic Practices
A.4.2.1.1
Summary Description
The Generic Practices of this common feature focus on the institutionalization of a standard process for the
organization. The origin or basis of the institutionalized process may be one or more similar processes used
successfully on specific projects. An organization standard process is likely to need tailoring to specific situational usage
so the development of tailoring needs is also considered. Thus documentation of a standard process for the
organization, and tailoring of the standard process to specific uses are addressed. These Generic Processes form an
essential foundation to the performance of defined processes.
A.4.2.1.2
Generic Practices List
This common feature comprises the following generic practices:
• GP 3.1.1 - Standardize the Process;
• GP 3.1.2 - Tailor the Standard Process.
A.4.2.2 GP 3.1.1 - Standardize the Process
A.4.2.2.1
Description
Document a standard process or family of processes for the organization, that describes how to implement the base
practices of the process area.
A.4.2.2.2
Notes
The critical distinction between generic practices 2.1.3 and 3.1.1, the Level 2 and Level 3 process descriptions, is the
scope of application of the policies, standards, and procedures. In 2.1.3, the standards and procedures may be in use in
only a specific instance of the process, e.g., on a particular project. In 3.1.1, policies, standards, and procedures are
being established at an organizational level for common use, and are termed the "standard process definition."
More than one standard process description may be defined to cover a process area, as the processes in an
organization need not correspond one to one with the process areas in this capability maturity model. Also, a defined
process may span multiple process areas. The SSE-CMM® does not dictate the organization or structure of process
descriptions. Therefore, more than one standard process may be defined to address the differences among application
domains, customer constraints, etc. These are termed a "standard process family."
64 © ISO/IEC 2002 – All rights reserved