This document provides information and guidance to personnel involved in SCM of computer software. This document assumes that each project performs the tasks listed below.
The activities in the SCM process outlined in this document are not sequential. More than one activity may be accomplished at the same time; an activity begins when the entry criteria are met, controls are imposed on the activity, inputs are provided so that action(s) can be taken, and an identified individual(s) or groups clearly understand their roles and responsibilities for accomplishing the process activity and/or generating an output.
The purpose of this document is to describe the process activities common to all organizations required to Provide SCM Support. The title of each process appears in boldface throughout this document to aid in identification of the process activity. This document identifies and describes an SCM process to achieve a repeatable level of SCM maturity. Repeatability requires that: "Basic project management processes are established to track cost, schedule, and functionality. The necessary process discipline is in place to repeat earlier successes on projects with similar applications." [1]
To further assist in a repeatable SCM process, two additional documents have been developed based on the information contained within this document: (1) a Generic SCMP used to generate an SCMP that is project specific and (2) a Sample DTP describing a configuration control task. The sample DTP includes information to guide an author through the development of task-specific DTP.
This document is intended to provide an overview of a repeatable process(es) that SCM personnel can use in providing SCM support to a project. It describes the SCM process down to project-specific activities. This document describes the responsibilities of SCM personnel and the tasks associated with each SCM activity.
Figure X1 is a sample control activity diagram. Control to an activity is indicated by an arrow entering the top of the box. Input to an activity is indicated by an arrow entering the left-side of the box. Output from an activity is indicated by an arrow exiting from the right side of the box.
Figure X1: Sample Control Activity Diagram
Figure X2 identifies SCM interfaces. It shows (1) identified external sources that interface with SCM, (2) inputs provided to the process activity that Provide SCM Support , and (3) outputs generated by SCM as a result of Provide SCM Support . The external sources shown in Figure X2 will be updated as other interfaces are identified.
Figure X2: Identified SCM Interfaces
Figure X3 is a diagram of the SCM Process Definition. Each box in the diagram represents a process activity and is identified by a title of the activity and a label identifier (the letter A followed by a numeric identifier). The first-level activity is titled Provide SCM Support and labeled A0 (Figure X3a). The second level of Provide SCM Support is comprised of two activities: Manage SCM (labeled A1; Figure X3b) and Perform SCM (labeled A2; Figure X3b). Third-level activities, derived from A1, are Create and Maintain Project SCMP (labeled A11; Figure X3c), Manage Implementation of SCMP (labeled A12; Figure X3c), and Provide SCM Training (labeled A13; Figure X3c). Third-level activities, derived from A2, are Perform Configuration Identification (labeled A21; Figure X3d), Perform Configuration Control (labeled A22; Figure X3d), Perform Configuration Status Accounting (labeled A23; Figure X3d), and Perform Configuration Audits and Reviews (labeled A24; Figure X3d). Fourth-level activities, derived from A12, are Manage SCM Tasks (labeled A121; Figure X3e), Create and Maintain DTP (labeled A122; Figure X3e), and Manage Resources and Personnel to Perform SCM (labeled A123; Figure X3e).
Figure X3a: SCM Process Definition Diagram ” Level 0 ” SCM Process
Figure X3b: SCM Process Definition Diagram ” Level 1 ” Provide SCM Support
Figure X3c: SCM Process Definition Diagram ” Level 2 ” Manage SCM
Figure X3d: SCM Process Definition Diagram ” Level 2 ” Perform SCM (Cont'd)
Figure X3e: SCM Process Definition Diagram ” Level 3 ” Manage Implementation of SCMP
This document is organized into the sections listed below.
[1] Key Practices of the Capability Maturity Model, Version 1.1, February 1993.
The terms and definitions listed below are provided as an aid to understanding and applying the SCM principles and processes used to manage software development and testing efforts.
Audit
An independent examination of a work product or set of work products to assess compliance with specifications, standards, contractual agreements, or criteria.
Audit reports
Independent group findings that are the results of reviewing compliance with specifications, standards, contractual agreements, or other specified criteria.
Baseline
A configuration identification document or set of such documents formally designated and fixed at a specific time during the configuration item's (CI's) life cycle. Baselines, plus approved changes from those baselines, constitute the current configuration identification.
Capability Maturity Model (CMM)
A Software Engineering Institute document that describes the stages that software organizations evolve as they define, implement, measure, control, and improve their software processes. The model is a guide for selecting the process improvement strategies by facilitating the determination of current process capabilities and identification of the issues most critical to software quality and process improvement.
Change Request (CR)
Reports of deficiencies or enhancements generated against product Computer Software Configuration Items (CSCIs) or technical data; a document that requests a correction or change to the baselined documentation or software. Examples are Software Change Proposals, Software Trouble Reports, Software Problem Reports, Engineering Change Proposals, and other local forms that communicate problems in a product. A CR becomes "controlled" when the master copy of the CR is received, processed , and maintained by the SCM organization (e.g., SCM assigns a tracking number or identifier, enters the information into the configuration status accounting [CSA] system, distributes copies, files, ensures updates to master copy by authorized personnel, etc.).
Configuration Audit
A formal examination of a CSCI. Two types of configuration audits exist: the Functional Configuration Audit (FCA) and the Physical Configuration Audit (PCA). (See Appendices V and W.)
Configuration Control
The systematic proposal, justification, evaluation, coordination, and approval or disapproval of proposed changes, and the implementation of all approved changes in the configuration of a CI after establishment of the baseline(s) for the CI.
Configuration Identification
The selection of CIs; the determination of the types of configuration documentation required for each CI; the issuance of numbers and other identifiers affixed to the CIs and to the technical documentation that defines the CI's configuration, including internal and external interfaces; the release of CIs and associated configuration documentation; and the establishment of configuration baselines for CIs.
Controlled CR
Maintenance of the master copy of the CR.
Computer Software Configuration Item (CSCI)
A CI that is software.
Configuration Status Accounting (CSA)
The recording and reporting of information needed to manage CIs effectively, including:
CSA Reports
Formatted output of the CSA system database.
Desktop Procedure (DTP)
Step-by-step instructions describing a course of action to be taken to perform a given process.
End Product
The authorized and approved complete set, or any of the authorized and approved individual items of the set, of computer programs, procedures, and associated documentation and data designated for delivery to a customer or end user .
Field Activity
A designated government agency that performs a task in accordance with a contractual agreement with a sponsoring government organization.
Identified CR
A CR to which a tracking number has been assigned.
Life Cycle
A generic term covering all phases of acquisition, operation, and logistics support of an item beginning with concept definition and continuing through disposal of an item.
Nondevelopmental Software (NDS)
Deliverable software that is not delivered under the contract but is provided by the contractor, the government, or a third party. NDS may be referred to as reusable software, government-furnished software, or commercially available software, depending on its source.
Personnel
A pool of potential workers available to perform SCM tasks. "Defined personnel" are individuals who have been selected to staff or support SCM tasks . "Trained personnel" are individuals having the knowledge, skills, and abilities required to perform SCM tasks.
Program Management
The government organization sponsoring the field activity project office.
Project Management
The designated government organization from the field activity project office responsible for the overall management of specific projects.
Repeatable
Basic project management processes are established to track cost, schedule, and functionality. The necessary process discipline is in place to repeat earlier successes on projects with similar applications.
Requirements
Direction provided by standards, specifications, instructions, etc.; by data item descriptions; and by program management or field activity.
Resources
Funding, facilities, tools, and nondevelopmental software as determined on a project-by-project basis. Personnel have been separated from resources to highlight the training aspects related to personnel. "Defined resources" are identified resources such as funding, facilities, tools, and nondevelopmental software allocated to perform any given SCM task.
Review Reports
Findings of an internal SCM or independent group that result from informal checks of SCM procedures or of formal reviews by Software Quality Assurance (SQA).
Retired
The removal of support from an operational system or component.
Software Configuration Control Board (SCCB)
A group of individuals responsible for and empowered by project management to evaluate and make decisions that affect software baselines.
Software Configuration Management (SCM)
A discipline that applies technical and administrative direction and surveillance to perform the functions listed below:
SCM Deficiency Reports
Problems or enhancements that are written against SCM tools, processes, procedures, and CSA reports. The SCM manager remains cognizant of these reports until resolution.
SCM Plan (SCMP)
The document defining how SCM will be implemented (including policies and procedures) for a particular acquisition or program.
Software Product
The complete set, or any of the individual items of the set, of computer programs, procedures, and associated documentation and data designated for delivery to a customer or end user.
Software-Related Group
Project members responsible for generating requirements, design, development, validation, verification, documentation, maintenance, and logistics of software.
Software Release
An end product delivered to a customer, including end-user documentation.
Software Unit
An element in the design of a software item; for example, a major subdivision of a software item, a component of that subdivision, a class, object, module, function, routine, or database. Software units may occur at different levels of a hierarchy and may consist of other software units. Software units in the design may or may not have a one-to-one relationship with the code and data entities (routines, procedures, databases, data files, etc.) that implement them or with the computer files containing those entities.
Tasks
Well-defined units of work that provides configuration management guidelines to accomplish given requirements.
Technical Data
Recorded information (regardless of the form or method of recording) of a scientific or technical nature (including computer software documentation) relating to supplies procured by an agency. Technical data does not include computer software, financial data, administrative data, cost data, pricing data, management data, or other information incidental to contract administration.
The purpose of this process activity (A0) is to establish and maintain a product's integrity throughout its life cycle. SCM support will be provided through implementation of the process included in the tasks listed below.
The following are responsible for Provide SCM Support :
Role |
Responsibility |
---|---|
Program Management |
Provide technical data and requirements to SCM. Provide resources for SCM. |
Project Management |
Provide technical data and requirements to SCM. Provide resources for SCM. Establish (project level) SCCB, appoint chairperson. Review SCM activity status and aid in problem resolution for audit findings. Assign SCM manager with specific SCM responsibilities. |
SCM Manager |
Manage SCM Establish SCM organization to perform SCM. |
SCM Organization |
Implement and perform SCM throughout the life cycle of the software product. |
SCM support is initiated upon project authorization.
Controls for this activity are listed below.
Inputs to this activity are listed below.
The process activities for Provide SCM Support are as follows :
Outputs of this activity are listed below.
Retiring a software product satisfies the exit criteria.
3.1 Manage SCM (A1)
3.1a Purpose
The purpose of this process activity (A1) is to manage SCM support. SCM is managed through the functions listed below.
3.1b Role and Responsibility
The following is responsible for Manage SCM :
Role |
Responsibility |
---|---|
SCM Manager |
Create and maintain the project SCMP. Identify tasks to be accomplished. Oversee generation, implementation, and maintenance of DTP in accordance with the project SCMP. Provide SCM training. Evaluate and use measurements gathered against the SCM procedures to improve the processes. Periodically review and provide status on SCM activities with field activity management. Respond to audit and review findings on SCM activities. Interface with appropriate internal and external agencies. |
3.1c Entry Criteria
An individual is assigned the responsibilities of SCM Manager to provide SCM support to the project.
3.1d Control
Controls for this activity are listed below.
3.1e Input
Inputs to this activity are listed below.
3.1f Process Activities
The process activities for Manage SCM are as follows:
3.1g Output
Outputs from this activity are listed below.
3.1h Exit Criteria
Retiring a software product satisfies the exit criteria.
3.1.1 Create and Maintain Project SCMP (A11)
3.1.1a Purpose
The purpose of this process activity (A11) is to document the plan that defines how configuration management will be implemented for a project, submit the plan for program management and SCCB approval, and update the plan to reflect current project requirements, processes, and practices.
3.1.1b Roles and Responsibilities
The following are responsible for Create and Maintain Project SCMP :
Role |
Responsibility |
---|---|
Program Management |
Provide overall approval to the project SCMP as approved by the SCCB. |
SCCB |
Approve the project SCMP and changes to the baselined project SCMP. |
SCM Manager |
Oversee creation, implementation, and maintenance of the project SCMP throughout the product's life cycle. Place the approved project SCMP under configuration control. |
Software- Related Groups |
Review project SCMP and updates. |
3.1.1c Entry Criteria
The SCM Manager has the following sources available:
3.1.1d Control
Controls of this activity are listed below.
3.1.1e Input
Inputs to this activity are listed below.
3.1.1f Process Activities
The process activities for Create and Maintain Project SCMP are as follows:
3.1.1g Output
3.1.1h Exit Criteria
Approval of the SCMP and subsequent updates throughout the product's life cycle satisfy the exit criteria.
3.1.2 Manage Implementation of SCMP (A12)
3.1.2a Purpose
The purpose of this process activity (A12) is to ensure implementation of SCM tasks and DTP in accordance with the project SCMP and to use resources and personnel in accomplishing SCM activities.
3.1.2b Role and Responsibility
The following is responsible for Manage Implementation of SCMP :
Role |
Responsibility |
---|---|
SCM Manager |
Identify, delegate, and monitor the SCM tasks. Create, implement, and maintain DTP. Manage SCM resources and personnel. |
3.1.2c Entry Criteria
An approved SCMP exists.
3.1.2d Control
The controls for Manage Implementation of SCMP are listed below.
3.1.2e Input
Inputs to this activity are listed below.
3.1.2f Process Activities
The process activities for Manage Implementation of Project SCMP are as follows:
3.1.2g Output
Outputs from this activity are listed below.
3.1.2h Exit Criteria
Retiring a software product satisfies the exit criteria.
3.1.2.1Manage SCM Tasks (A121)
3.1.2.1a Purpose The purpose of this process activity (A121) is to ensure that the tasks stated in the project SCMP are implemented in a consistent, correct, complete, and compliant manner.
3.1.2.1b Role and Responsibility The following is responsible for Manage SCM Tasks:
Role |
Responsibility |
---|---|
SCM Manager |
Decompose the tasks stated in the project SCMP into manageable components (e.g., work breakdown structure). Monitor the accomplishment of the identified task. Review the identified tasks for compliance with the approved project SCMP. |
3.1.2.1c Entry Criteria An approved project SCMP exists.
3.1.2.1d Control The approved project SCMP provides control.
3.1.2.1e Input Inputs to this activity are listed below.
3.1.2.1f Process Activities The process activities for Manage SCM Tasks are as follows:
3.1.2.1g Output Output from this activity is composed of identified tasks.
3.1.2.1h Exit Criteria Identified tasks that reflect the current project SCMP satisfy the exit criteria.
3.1.2.2 Create and Maintain DTP (A122)
3.1.2.2a Purpose The purpose of this process activity (A122) is to document the procedures that describe how SCM is performed for a project and update the DTP to reflect the current project SCMP.
3.1.2.2b Role and Responsibility The following are responsible for Create and Maintain DTP:
Role |
Responsibility |
---|---|
SCM Manager |
Direct the development of DTP, and oversee the implementation and maintenance of DTP. Identify the functions within the software-related groups, e.g., system engineering, software development, system testing, etc., that the SCM organization must interface with to accomplish a task. |
Software-Related Groups |
Review DTP. |
SCM Organization |
Create, implement, and maintain DTP. |
3.1.2.2c Entry Criteria This project SCMP and the Sample DTP satisfy the entry criteria.
3.1.2.2d Control The controls for Create and Maintain DTP are listed below.
3.1.2.2e Input Inputs to this activity are listed below.
3.1.2.2f Process Activities The process activities for Create and Maintain DTP are as follows:
3.1.2.2g Output Output of this activity is the accomplishment of written DTP.
3.1.2.2h Exit Criteria Written DTP and subsequent updates throughout the product's life cycle satisfy the exit criteria.
3.1.2.3 Manage Resources and Personnel to Perform SCM (A123)
3.1.2.3a Purpose The purpose of this process activity (A123) is to use appropriate resources and personnel to accomplish the SCM task(s) in accordance with the project SCMP and DTP.
3.1.2.3b Role and Responsibility The following is responsible for Manage Resources and Personnel to Perform SCM.
Role |
Responsibility |
---|---|
SCM Manager |
Identify and manage the resources and personnel needed to accomplish tasks identified in the project SCMP. |
3.1.2.3c Entry Criteria DTP satisfy the entry criteria.
3.1.2.3d Control The controls for Manage Resources and Personnel to Perform SCM are listed below.
3.1.2.3e Input Inputs to this activity are listed below.
3.1.2.3f Process Activities The process activities for Manage Resources and Personnel to Perform SCM are as follows:
3.1.2.3g Output Outputs of this activity are listed below.
3.1.2.3h Exit Criteria The exit criteria for this process activity are defined resources and defined personnel necessary to support the SCMP and DTP.
3.1.3 Provide SCM Training (A13)
3.1.3a Purpose
The purpose of this process activity (A13) is to train the SCM organization and software-related groups on processes as described in the project SCMP, DTP, and SCM tools to accomplish tasks stated in the project SCMP.
3.1.3b Role and Responsibility
The following is responsible for Provide SCM Training :
Role |
Responsibility |
---|---|
SCM Manager |
Identify, establish, coordinate, and maintain training as required to ensure effective performance of SCM activity by the SCM organization and software-related groups. |
3.1.3c Entry Criteria
DTP satisfy the entry criteria.
3.1.3d Control
The control for Provide SCM Training is listed below.
3.1.3e Input
Inputs to this activity are listed below.
3.1.3f Process Activities
The process activity for Provide SCM Training is to use defined personnel and resources to produce personnel trained in SCM processes as described in the project SCMP, DTP, and SCM tools. Defined personnel include both those providing training and those receiving the training.
3.1.3g Output
The output of this activity is trained personnel.
3.1.3h Exit Criteria
Trained personnel satisfy the exit criteria.
3.2 Perform SCM (A2)
3.2a Purpose
The purpose of this process activity (A2) is to apply configuration identification, control, status accounting, and audits and reviews throughout the life cycle of a product in order to ensure the integrity of the software release and associated documentation.
3.2b Role and Responsibility
The following is responsible for Perform SCM :
Role |
Responsibility |
---|---|
SCM Organization |
Perform configuration identification, control, status accounting, and internal SCM reviews. Assist in performing the configuration audit(s). Assist in the independent audit of SCM activities. |
3.2c Entry Criteria
The SCM Manager has identified and trained personnel and current DTP exist.
3.2d Control
The current DTP provide control of this activity.
3.2e Input
Inputs to this activity are listed below.
3.2f Process Activities
The process activities for Perform SCM are as follows:
3.2g Output
Outputs from this activity are listed below.
3.2h Exit Criteria
Retiring a software product satisfies the exit criteria.
3.2.1 Perform Configuration Identification (A21)
3.2.1a Purpose
The purpose of this process activity (A21) is to issue unique identifiers to each CSCI and related technical data and assign tracking numbers to CRs so that they may be tracked through each baseline release. Throughout the following sections, any reference to CSCI includes Software Units.
3.2.1b Role and Responsibility
The following are responsible for Perform Configuration Identification :
Role |
Responsibility |
---|---|
SCM Manager |
Oversee the establishment of the configuration management libraries. |
SCM Organization |
Issue the configuration identifier to the CSCI and related technical data. Verify that the correct project identifier has been used. Identify and assign a tracking number to the CR. Establish the CM libraries. |
SCCB |
Support the project manager recommending approval or disapproval of proposed engineering changes to a CSCI's current approved configuration and its documentation. |
3.2.1c Entry Criteria
CSCI, technical data, or CRs have been submitted to the SCM organization.
3.2.1d Control
Control is provided by the DTP for configuration identification.
3.2.1e Input
Inputs to this activity are listed below.
3.2.1f Process Activities
The process activities for Perform Configuration Identification are as follows:
3.2.1g Output
Outputs from this activity are listed below.
3.2.1h Exit Criteria
Each CSCI and associated documentation have been formally identified. All required data has been collected, recorded, processed, and maintained for producing CSA reports. The CM libraries have been established.
3.2.2 Perform Configuration Control (A22)
3.2.2a Purpose
The purpose of this process activity (A22) is to maintain the integrity of the product's technical data and CSCI throughout its life cycle.
3.2.2b Role and Responsibility
The following are responsible for providing Perform Configuration Control :
Role |
Responsibility |
---|---|
SCM Manager |
Manage expeditious processing of proposed changes against approved baselines. Manage processing of authorized changes into approved baselines. |
SCM Organization |
Prevent incorporation of unauthorized changes into the baselines. Ensure integrity of baseline releases (e.g., of executable software, source code). Perform library functions of CSCI and technical data. Perform the administrative functions to support the software boards (e.g., SCCB, SCRB, OAG). |
SCCB |
Represent the interests of the project management and all project groups who may be affected by changes to the software baselines. Authorize the establishment of software baselines, review and approve the changes, and authorize the creation of software baseline products. |
3.2.2c Entry Criteria
One of the following criteria must be met to initiate this activity.
3.2.2d Control
The DTP provide control of this activity.
3.2.2e Input
Inputs to this activity are listed below.
3.2.2f Process Activities
The process activities for Perform Configuration Control are as follows:
3.2.2g Output
Outputs from this activity are listed below.
3.2.2h Exit Criteria
Retiring a software product satisfies the exit criteria.
3.2.3 Perform Configuration Status Accounting (A23)
3.2.3a Purpose
The purpose of this process activity (A23) is to ensure reporting of accurate identification of each CSCI and associated technical data so that the necessary logistics support elements can be correctly programmed and made available in time to support the CSCI and its technical data. A well-designed and proven CSA will enhance management's capability to identify, produce, inspect, deliver, operate , and maintain CSCIs and associated technical data in a timely , efficient, economical manner.
3.2.3b Role and Responsibility
The following is responsible for Perform CSA :
Role |
Responsibility |
---|---|
SCM Organization |
Maintain and verify the data entered into the CSA system. |
3.2.3c Entry Criteria
Entry criteria for this activity is the receipt of information on CSCIs, technical data, board decisions (e.g., CCB, SCCB, SCRB, or OAG), and CRs.
3.2.3d Control
Control of this activity is provided by the DTP.
3.2.3e Input
Inputs to this activity are listed below.
3.2.3f Process Activities
The process activities for Perform CSA are as follows:
3.2.3g Output
Outputs from this activity are listed below.
3.2.3h Exit Criteria
Retiring a software product satisfies the exit criteria.
3.2.4 Perform Configuration Audits and Reviews (A24)
3.2.4a Purpose
The purposes of this process activity (A24) are to:
3.2.4b Role and Responsibility
The following are responsible for Perform Configuration Audits and Reviews :
Role |
Responsibility |
---|---|
SCM Manager |
Provide resolution to reported deficiencies against SCM activities or products as part of process improvement efforts. |
SCM Organization |
Support the configuration audits (FCA and PCA) of CSCIs and their technical data, including tracking resolution of reported deficiencies. Provide the auditing activity or independent auditor (e.g., SQA) with the requested data to perform an audit of SCM activities. Perform informal review of SCM tasks and products to ensure conformance of SCM procedures. |
SQA or Independent Auditor |
Perform configuration audits (FCA and PCA) of CSCI and associated technical data. Perform audit of SCM activities. Report audit findings. |
3.2.4c Entry Criteria
Configuration audits and independent audits of CSCI and associated technical data and SCM activities are scheduled. Informal reviews of SCM activities and products are planned.
3.2.4d Control
The DTP provides control for this activity.
3.2.4e Input
Inputs to this activity are listed below.
3.2.4f Process Activities
The process activities for Perform Configuration Audits and Reviews are as follows:
3.2.4g Output
Outputs from this activity are listed below.
3.2.4h Exit Criteria
The configuration audit and review is completed, results are documented, and deficiencies have been resolved.
The audit and review of SCM activities and products is completed, results are documented, and deficiencies have been resolved.
1. Key Practices of the Capability Maturity Model, Version 1.1, February 1993.
This document is adapted from the Navy's Software Process Definition, http://sepo.spawar.navy.mil/sepo/SCMProc.doc. April 1998 .
CCB |
Configuration Control Board |
CM |
Configuration Management |
CMM |
Capability Maturity Model |
CRG |
Computer Resources Group |
CSA |
Configuration Status Accounting |
CSC |
Computer Software Component |
CSCI |
Computer Software Configuration Item |
CSU |
Computer Software Unit |
DCR |
Document Change Request |
DoD |
Department of Defense |
DTP |
Desktop Procedure |
FCA |
Functional Configuration Audit |
FCD |
Functional Configuration Documentation |
NAVAIRSYSCOM |
Naval Air Systems Command |
NDS |
Nondevelopmental Software |
OAG |
Operational Advisory Group |
PCA |
Physical Configuration Audit |
SCCB |
Software Configuration Control Board |
SCM |
Software Configuration Management |
SCMP |
Software Configuration Management Plan |
SCRB |
Software Change Review Board |
SEI |
Software Engineering Institute |
SQA |
Software Quality Assurance |
SRR |
Software Requirements Review |
STD |
Standard |
Key Practice and Sub-practices |
Yes |
No |
Ex |
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
|
|||
Notes: |
|||
Yes Evidence exists that this sub-practice is in place and followed in a formal manner. |
|||
No There was weak or no evidence that this sub-practice is documented, in place or followed in any manner. |
|||
Ex Indications of exceptionally strong implementation of this sub-practice which could serve as a template for other SSA. |
|||
Source: CMU/SEI-93-TR-25 (L2-72-L2-83) |
Preface