3.5 ISO 9001:1994, ISO 9000-3, AND ISO 9001:2000

ISO 9001:1994

ISO 9001:1994 is a standard for quality systems with a relatively broad field of application. ISO 9001 is based on the definition of quality as "The degree to which a system, component, or process meets customer or user needs or expectations." The standard covers development, production, and delivery of products and/or services.

ISO 9001 is a general standard, not particularly aimed at software. The words "configuration management" do not appear in the standard, and the concept is therefore not defined. It is, however, possible to find implicit requirements for configuration management. The references in parentheses are to sections in ISO 9001:1994:

• Design and development changes shall be identified, records maintained , reviewed, and approved (4.4). This implies that the basis for the changes shall be known and controlled.

• Relevant documents and data (4.5) shallin practicebe placed under configuration management.

• Products shall, if it is required, be identified in order to enable traceability (4.8).

• Records of the review and test status for products shall be maintained (4.12).

• Nonconforming products shall be controlled (4.13).

The standard also contains requirements concerning the handling of error and change reports for the quality system itself. ISO 9001:1994 is now officially replaced by ISO 9001:2000 (see the section later in this chapter), though many companies still use ISO 9001:1994.

ISO 9000-3

ISO 9000-3 is a guideline for using ISO 9001:1994 for software development. After the release of ISO 9001:2000, ISO 9000-3 is no longer valid but is still of interest to many companies. It contains a description of configuration management in section 6.1.1:

Configuration management provides a mechanism for identifying, controlling and tracking the versions of each software item. In many cases earlier versions still in use must also be maintained and controlled.

The configuration management system should

1. identify uniquely the versions of each software item;

2. identify the versions of each software item which together constitute a specific version of a complete product;

3. identify the build status of software products in development or delivered and installed;

4. control simultaneous updating of a given software item by more than one person;

5. provide coordination for the updating of multiple products in one or more locations as required;

6. identify and track all actions and changes resulting from a change request, from initiation through release.

Subsequent sections in the guideline contain a description of the contents of a configuration management plan (organizational aspects, activities, tools, methods , and discussion on when objects should be placed under configuration management), along with a description of the basic configuration management activities (identification, traceability, change control, and status reporting).

ISO 9001:2000

ISO 9001:2000 is an updated version of ISO 9001:1994. It does include the words "configuration management" in a note, but no definition of the concept. As in ISO 9001:1994, however, a number of requirements imply performance of configuration management. The references in parentheses are for sections in ISO 9001:2000:

• Relevant documents shallin practicebe placed under configuration management (4.2.3). The same applies for quality records (4.2.4).

• Design and development changes shall be identified, records maintained, reviewed, and approved (7.3.7), and records of the results of the reviews, and so forth, shall be maintained.

• Products shall, if it is required, be identified in order to enable traceability and status reporting (7.5.3). The note for this section reads: "In some industry sectors, configuration management is a means by which identification and traceability are maintained."

• Nonconforming products shall be controlled (8.3)

The standard also contains requirements concerning the handling of error and change reports for the quality system itself.

Table 3-2. Mapping from ISO 9001:2000 Sections

ISO 9001:2000 Section	Mapping to This Book
4.2.3 and 4.2.4	Chapter 5Scoping the Configuration Management Task Part VImproving Configuration Management
7.3.7	Chapter 1Change Control Chapter 8Event Registration Chapter 8Change Request
7.5.3	Chapter 1Identification
8.3	Chapter 1Change Control