It’s not always the case that software development companies worry about quality assurance to such a degree that they consider it a matter of compliance. And yet, enterprises building critical software in heavily regulated environments or industries understand very well that quality assurance is part of the business. This is why the International Organization for Standardization (ISO) published the 9000 series, including ISO 90003, for quality assurance in software. 

Here, we break down some of the basic principles of Quality Management Systems and why you might consider compliance for your software development projects. 

What Is a Quality Management System?

A Quality Management System, or QMS, is a formal set of processes, procedures, and technologies used to ensure policies around quality in the provision of products or services. Companies use QMSs to ensure that what they are developing has a process of assuring the highest standards of quality at all points of production and that they can refer back to that system for improvements of both the products and the QMS itself. 

ISO 9001, “Quality Management Systems – Requirements,” outlines what the International Organization for Standardization considers a functional and transferable approach to creating organizational QMSs across different industries. 

At the heart of this document, and the prime engine of a QSM, is a cycle of steps for organizations that need to “demonstrate its ability to provide products and services that meet customer and applicable statutory and regulatory requirements.”

These steps are:

• Plan: Establish the objectives of the QMS and the process for which it is assuring quality. This can include any specific requirements, both internal and external, alongside regulatory requirements, logistical specifications, and other business objectives. 
• Do: Simple put–take the plan and implement it with the parameters outlined in the planning stage. 
• Check: Continuously monitor and manage the QMS and its process to ensure it meets the expected standards discussed in the Plan. 
• Act: Taking information from the Check stage, integrate performance and activities into an ongoing plan to improve performance and operations if seen fit. 

Additionally, the ISO foregrounds the concept of risk as part of quality management. The risk is often seen as a financial or security concern. In the ISO 9000 series, however, an organization must measure and understand the risk related to the quality and performance of the system managed. 

How Does ISO 90003 Model a Quality Management System for Software?

ISO 90003, “Software Engineering – Guidelines for the Application of ISO 9001:2015 to Computer Software,” outlines how to translate the QMS guidelines to apply QMS structure to the “acquisition, supply, development, operation, and maintenance of computer software.”

To accomplish this, ISO 90003 maps the Plan-Do-Check-Act cycle onto a more specific development cycle of activity associated with software. This means that the QMS process integrates with the interactive processes integral to creating and maintaining almost every piece of software.  

The key components of the ISO 90003 cycle include:

Leadership

In terms of this cycle, every action is anchored by leadership. In this particular context, organizational leadership has a responsibility to take responsibility and accountability for some or all of the processes, promote quality- and risk-based thinking, managing the integration of QMS into software development projects, and supporting continuous improvement to those processes. 

Planning

Like the Plan portion of the ISO 9001 cycle, Planning references the ongoing ability to plan for the production of the software securely and effectively. At this stage, some of the primary concerns for the organization include:

• Assessing and mapping risks associated with the development process and how much they may impact the quality of the software across relevant categories. 
• Creating approaches to address those risks and integrating those into the software development plan. 
• Devising objectives for software development that are consistent with the organization’s expected quality standards. This includes defining consistent, observable, and measurable metrics for those objectives and methods for implementing measures to ensure the success of those objects. 
• Planning any changes to the QMS to promote improvements based on new information gained during the process. 

Several different sources of information will feed into the planning process, including organizational goals and objectives, customer requirements, and stakeholder input. 

Support

How will the organization provide expertise and resources to make the plan work? This can include the financial and technical resources, the people employed (or hired) by the company to fill key positions, and the infrastructure (tools, technology, competencies, communication hierarchies, documentation and knowledge management, etc.) to ensure the expected security and quality of the software, and more.

Operation

Now it is time to implement the plan, begin the software development, and kick off the parallel QSM operations. At this point, operational Planning will take the plans conceived from the Planning stage. This also includes implementing “quality planning,” or the specific plans on how products and services (in this case, the software) will be produced to meet quality standards. 

At this stage, your organization should have capabilities to test the process directly for conformity to quality standards, document those results, audit results for immediate changes, and create internal and customer-facing documentation like manuals and troubleshooting guides. 

Performance Evaluation

Once the processes are in motion, it’s crucial that your organization has controls in place to monitor the production system and measure quality based on metrics devised during the Planning and Operations phases. 

Additionally, your organization should be able to launch internal audits to measure those results against established quality metrics, maintain records of those audits, and perform management reviews of those audits (especially for any aspect that exhibits nonconformity with that quality cycle).

Improvement

Take all the information from operations, tests, and audits results, and implement corrective actions to improve the processes in the next planning phase. 

Across these different factors, we see the movement of the ISO 9001 QMS cycle:

1. The move from the Planning phase to the Support and Operations phases maps to the Plan component of the QMS cycle.
2. The move from the Support and Operations phases to the Performance phase maps onto the Do component of the QMS cycle
3. The move from the Performance phase to the Improvement phase maps onto the Check component of the QMS cycle.
4. The move from the Improvement phase back to the Planning phase maps onto the Act component of the QMS cycle. 

Work With Continuum GRC for ISO 90003 Compliance

Measuring the quality of a software product isn’t simply a practice of ensuring something is “good enough.” Quality assurance is a critical and necessary component of building software–software guaranteed to be secure, operational, and compliant with industry standards must be backed up with a solid Quality Management System. That’s why the ISO released ISO 90003 so that companies can demonstrate that quality. 

Continuum GRC is cloud-based, always available and plugged into our team of experts. We provide risk management and compliance support for every major regulation and compliance framework on the market, including:

• FedRAMP
• StateRAMP
• NIST 800-53
• FARS NIST 800-171
• CMMC
• SOC 1, SOC 2, SOC 3
• HIPAA
• PCI DSS
• IRS 1075
• COSO SOX
• ISO 27000 Series
• ISO 9000 Series

And more. We are also the only FedRAMP and StateRAMP authorized compliance and risk management solution in the world.

Continuum GRC is a proactive cyber security®, and the only FedRAMP and StateRAMP Authorized cybersecurity audit platform in the world. Call 1-888-896-6207 to discuss your organization’s cybersecurity needs and find out how we can help your organization protect its systems and ensure compliance.