CMM in the Context of

ISO 9001:2000

Dr. Elif Demirors

General Manager
The Bilgi Group Ltd.

1 Bilgi Grubu Ltd., 2000

Issues To Be Discussed
Whats new with ISO 9001:2000 ?
How will ISO 9001:2000 affect software
development companies ?
How can CMM be integrated with ISO
9001:2000?

2 Bilgi Grubu Ltd., 2000

 ISO 9000:2000
The year 2000 revisions of the ISO 9000
series of quality management standards are
released on 15. December 2000
Major structural and conceptual changes
Users will need to upgrade their quality
management systems by 2003

3 Bilgi Grubu Ltd., 2000

ISO 9000:2000 Series

ISO 9000 : Quality Management Systems-
Fundamentals and Vocabulary
ISO 9001: Quality Management Systems-
Requirements
Quality management system requirements
ISO 9004: Quality Management Systems-
Guidelines for Performance Improvements
A guide for improving the quality system beyond and
above ISO 9001

ISO 9002, 9003 are discontinued

4 Bilgi Grubu Ltd., 2000

 ISO 9001:2000
Whats New At-a-Glance
More logical structure
process-oriented organization
Explicit requirements for achieving customer
satisfaction and continual improvement
Updated terminology
Easier to be used by service-sector organizations
and small businesses
More management involvement
New requirements
Less prescriptive documentation
5 Bilgi Grubu Ltd., 2000

New Structure
4.1. Management Responsibility
4.2. Quality System 5. Management Responsibility
4.3. Contract Review 5.1. Management Commitment
4.4. Design Control 5.2. Customer Focus
4.5. Document and Data Control 5.3. Quality Policy
4.6. Purchasing 5.4, Planning
4.7. Control of Customer-supplied Product 5.5. Administration
4.8. Product Identification and Traceability 5.6. Management Review
4.9. Process Control 6. Resource Management
4.10. Inspection and Testing 6.1. Provisions of resources
4.11. Control of Inspection, Measuring and 6.2. Human resources
Test Equipment 6.3. Facilities
4.12. Inspection and Test Status 6.4. Work environment
4.13. Control of Nonconforming Product 7. Product Realization
4.14. Corrective and Preventive Action 7.1. Planning of realization processes
4.15. Handling, Storage, Packing, 7.2. Customer-related processes
Preservation, and Delivery 7.3. Design and/or development
4.16. Control of Quality Records 7.4. Purchasing
4.17. Internal Quality Audits 7.5. Production and service operations
4.18. Training 7.6. Control of measuring and monitoring devices
4.19. Servicing 8. Measurement, Analysis and Improvement
4.20. Statistical Techniques 8.1. Planning
8.2. Measurement and monitoring
8.3. Control of nonconformity
ISO 9001:1994 8.4. Analysis of data
8.5. Improvement
ISO 9001:2000
6 Bilgi Grubu Ltd., 2000
 Simplified Terminology
ISO 9001:1994 ISO 9001:2000
Subcontractor Supplier
Supplier Organization
Quality system Process
element
Inspection and Product verification
testing and validation

1. Quality system consists of interrelated processes

2. Product is defined as hardware, software, services,
processed materials, or any combinations
7 Bilgi Grubu Ltd., 2000

The Eight Principles

Customer focused organization
Leadership
Involvement of people
Process approach
System approach to management
Continual improvement
Factual approach to decision making
Mutually beneficial supplier relationship

8 Bilgi Grubu Ltd., 2000

 Two Major Themes
Customer focus
Ensuring that customer needs and expectations
are determined and converted into specific
requirements
management representative promotes
awareness of customer requirements throughout
the organization.
Determine customer requirements
Define and implement measures for obtaining
and using information on customer satisfaction
and dissatisfaction

9 Bilgi Grubu Ltd., 2000

Two Major Themes

Continual improvement
Demonstrate top management commitment to
the development and improvement of the quality
system.
Plan and manage for continual improvement
of the quality system, including the use of
quality policy and objectives and quality
performance data.
Collect and analyze data to determine the
effectiveness of the quality system and for
identifying where improvements can be made.

10 Bilgi Grubu Ltd., 2000

 Clause 5: Management
Responsibility
More emphasis on demonstrating top management
commitment
Major requirements
Communicating the importance of meeting customer
requirements and continual improvement
Establishing quality policy and quality objectives
Ensuring availability of adequate resources
Planning for continual improvement
Ensuring effective communication within the
organization
Ensuring effective operation of the quality system with
management reviews

11 Bilgi Grubu Ltd., 2000

Clause 6: Resource
Management
Requirements for determining and providing
necessary resources are still valid, however
completely rewritten as a new clause
Emphasis on improvement and customer
satisfaction
New requirements
Evaluating the effectiveness of training
Ensuring that employees are aware of their role
and contributions within the quality system

12 Bilgi Grubu Ltd., 2000

 Clause 7: Product Realization
Requirements related to the design and/or
development activities are basically unchanged
New requirements
Quality plans should be established for product
realization processes and product validation activities
Customer requirements should be identified including
those that are not specified by the customer but
necessary for intended or specified use
Arrangements for effective customer communication
should be defined and implemented
Design and development plans should include plans for
review, verification and validation activities

13 Bilgi Grubu Ltd., 2000

Clause 8: Measurement,
Analysis and Improvement
All activities related to measurement and
monitoring are gathered under this clause
Requirements related to corrective and preventive
actions, measuring product and processes remain
unchanged
New requirements
Measurement and monitoring activities should be
planned
Customer satisfaction/dissatisfaction should be
measured
Data should be analyzed for identifying improvement
opportunities

14 Bilgi Grubu Ltd., 2000

 ISO 9001 in Software
Organizations
ISO 9001:1994 has been widely used
internationally for the certification of software
development companies
For the interpretation of the ISO 9001:1994
requirements ISO 9000-3 was published
A guidance on how to satisfy requirements of ISO
9001:1994 in software development context
Other references are also available to guide
software development companies through ISO
9001:1994
15 Bilgi Grubu Ltd., 2000

Problems with ISO 9001:1994

CMM-based software process improvement
program is difficult to integrate with ISO
9001-based quality management system
No mapping between CMM key process areas
and ISO 9001:1994 structure
Development life cycle and procedures for
various development activities are defined at
Level 3
No information on how to integrate software
processes with other organizational processes
16 Bilgi Grubu Ltd., 2000
 ISO 9001:2000 and Software
Development
New structure is consistent with the plan-
do-check-act cycle
ISO 12207 (IEEE 12207) is based on the same
model
ISO 12207 can be used as a basis to Clause 7
(Product Realization) and will provide guidance
on supportive processes, and organizational
processes as well
Emerging standard ISO 15504 is also based on
the same model

17 Bilgi Grubu Ltd., 2000

ISO 9001:2000 and Software

Development
The new structure is process-based
Software community has been living in a
process-oriented world for the last two decades
Process-based terminology is quite consistent
with the terminology of software organizations

18 Bilgi Grubu Ltd., 2000

 ISO 9001:2000 and Software
Development
ISO 9001:2000 expects an organization
To identify processes required for production of
high quality product
To determine sequence and interaction of these
processes
Design and document each process
Check and analyze implementation of each
process, and continually improve effectiveness
of the system

19 Bilgi Grubu Ltd., 2000

ISO 9001:2000 and Software

Development
The new standard emphasizes continual
improvement
Consistent with the CMM approach to
continuous process improvement
The requirements of the standard regarding to
improvement is similar to those of CMM and
other process improvement models
CMM can be used for planning and implementing
the improvement program
CMM-based assessment can be used for internal
audits required by ISO 9001:2000

20 Bilgi Grubu Ltd., 2000

 ISO 9001:2000 and Software
Development
New standard requires a solid measurement
program
Quality objectives should be measurable
Measurement and monitoring activities should be
defined and planned
Customer satisfaction, processes and product should be
monitored and measured
Data collected from the measurements should be used
towards improvement
Measurement programs are not easy to install in
software organizations

21 Bilgi Grubu Ltd., 2000

CMM and ISO 9001:2000

ISO 9001:2000 will provide the organizational
framework within which CMM can be applied
Management commitment will be crucial for a
CMM-based improvement program
Quality policies and objectives will help planning
CMM-based improvement activities
The quality system itself will support continuous
improvement by all means
Monitoring customer satisfaction will provide an
effective feedback to improvement activities
22 Bilgi Grubu Ltd., 2000
 CMM and ISO 9001:2000
CMM will provide guidance for software
companies in building ISO 9001:2000 compliant
quality system
CMM identifies the processes required for quality
software production, and defines the activities to be
performed
CMM-based assessment models help organizations
perform internal audits and measure the effectiveness of
the improvement
CMM provides a basis for defining measurable quality
objectives (in terms of maturity levels) and planning
improvement activities

23 Bilgi Grubu Ltd., 2000

CMM Maturity Levels vs.

ISO 9001:2000 Requirements
Clause 5: Management Responsibility
Level 3-Organization process focus
Level 3-Organization process definition
Level 3-Intergroup coordination
Clause 6: Resource Management
Within each key process area (as an ability)
Level 3-Training program
Issues related to the work environment are not
addressed by CMM

24 Bilgi Grubu Ltd., 2000

 CMM Maturity Levels vs.
ISO 9001:2000 Requirements
Clause 7: Product Realization
All Level 2 key process areas
Level 3- Peer Reviews
Level 3-Integrated software management
Level 3-Software product engineering
Clause 8: Measurement, Analysis and
Improvement
Within each key process area (as measurement and
analysis)
Level 4- Software quality management
Level 4- Quantitative process measurement

25 Bilgi Grubu Ltd., 2000

Final Remarks
Do we need to be a Level 4 company for ISO
9001:2000 certification ?
Probably not, interpretation of requirements related to
measurement will be important for software development
companies
ISO 9001:2000 is consistent with the practices of
software development companies engaged in
process improvement
ISO 9001:2000 certification will require considerably less
effort, and no major changes in software quality system
that exist in a Level 3 company

26 Bilgi Grubu Ltd., 2000

 Contact Information
Dr. Elif Demirors
General Manager

The Bilgi Group Ltd.

Software Education, Research and Consultancy
Ataturk Bulvari No:169/47 Bakanliklar
Ankara Turkey
Phone : +90 312 417 2105 Fax: +90 312 417 2107
demirors@bg.com.tr

www.bg.com.tr

27 Bilgi Grubu Ltd., 2000