IS Quality-Management Strategies and Policies
| Per ISACA, quality assurance usually performs two distinct tasks:
An example of a standard quality-assurance model is the Software Capability Maturity Model (CMM) developed by Carnegie Melon's Software Engineering Institute. The CMM model provides a framework for improving software life cycle processes and specific metrics to improve the software process. CMM has maturity levels that are designed with continuous process improvement in mind, to increase product and service quality through the implementation of best practices.
ISACA refers to CMM in both its study material and the exam, even though the CMM model was upgraded to CMMI (Capability Maturity Model Integration) in 2000. Per the CMM model documentation, software process maturity is the extent to which a specific process is explicitly defined, managed, measured, controlled, and effective. The more mature an organization's software process is, the higher the productivity and quality of the software products produced are. As software process maturity increases, the organization institutionalizes its software process via policies, standards, and organizational structures. This institutionalization entails building an infrastructure and a corporate culture that supports the methods, practices, and procedures of the business so that they endure after those who originally defined them have gone. The CMM maturity levels are shown in Figure 2.2. Figure 2.2. CMM maturity levels. IT management can use assessment methods to provide a mechanism to determine whether the activities of the organization have deviated from the planned or expected levels. These methods include IS budgets, capacity and growth planning, industry standards/benchmarking, financial management practices, and goal accomplishment. Quality management is the means by which the IS department processes are controlled, measured, and improved. Management principles focus on areas such as people, change, processes, and security. Industry standards/benchmarking provide a means of determining the level of performance provided by similar information-processing facility environments.
The quality assurance group ensures that the programs and program changes and documentation adhere to established standards. The International Organization for Standardization (ISO) has created the ISO 9000 series, which is implemented by 634,000 organizations in 152 countries. ISO 9000 has become an international reference for quality management requirements in business-to-business dealings. Per ISO, the ISO 9000 family is primarily concerned with "quality management" or what the organization does to fulfill the following:
ISO 9001/9002/9003 contains guidelines about design, development, production, installation servicing, and final inspection/testing. Per ISO, ISO 9001:2000, "Quality Management Systems," specifies requirements for a quality-management system. Adherence to these requirements demonstrates that the organization has the capability to consistently provide products that do the following:
All requirements of this international standard are generic and are intended to apply to all organizations, regardless of type, size, and product provided.
The 1994 versions of ISO 9001/9002/9003 were combined into a single revised document represented by ISO 9001:2000 (see www.iso.org/iso/en/iso9000-14000/iso9000/faqs.html). ISO 9126 focuses on the end result of good software processes, such as the quality of the actual software product. ISO 9126 provides definitions of the characteristics and associated quality-evaluation process to be used when specifying the requirements for and evaluating the quality of software products throughout the software life cycle. The following are specific definitions associated with the ISO standards.
In conjunction with these standards, organizations can perform certification and accreditation activities. These activities are commonly performed within the U.S. federal government and are defined as follows:
Certification activities include testing systems and their controls to ensure that the systems meet the control objectives. When the certification is complete, any deficiencies are noted and forwarded to the appropriate authority for accreditation. During the accreditation process, the approving authority reviews the results of controls testing and determines the level of risk associated with the deficiencies. If the approving authority determines that the risk associated with the deficiencies is acceptable, the system is allowed to process in an operational environment with a plan to correct the deficiencies (remediation). If the level of risk is beyond an acceptable level, the deficiencies must be corrected before the system can go into operation. The IS auditor must review quality assurance activities to ensure that quality assurance personnel are creating and reviewing prescribed quality processes. The auditor also must make sure that a standard quality-control process is in place for conducting tests or reviews, to verify and ensure that software and systems are free from defects and that they meet user expectations.
Quality assurance could be an additional responsibility of the security administrator. Although making the security administrator responsible for application programming, systems programming, or data entry would not provide an adequate segregation of duties, working in quality assurance does not constitute improper segregation of duties. |
