Technical Report CMU/SEI-94-TR-12 ESC-TR-94-12 A Comparison of ISO 9001 and the Capability Maturity Model for Software Mark C. Paulk July 1994 Technical Report CMU/SEI-94-TR-12 ESC-TR-94-12 July 1994 Software Engineering Institute Carnegie Mellon University Pittsburgh, Pennsylvania15213 A Comparison of ISO 9001 and the Capability Maturity Model for Software ____________________________________________________________________________________________________________________________________________________________________________________________________________ ________________________________________________________________________________________________________________________________________ Mark C. Paulk Software Capability Maturity Model Project Unlimited distribution subject to the copyright. (Draft) /Helvetica /B -52 /UL .8 /gray exch def /start exch def /rotval exch def /mode exch def ndfont /infont exch def /printme exch def This report was prepared for the SEI Joint Program Office HQ ESC/AXS 5 Eglin Street Hanscom AFB, MA 01731-2116 The ideas and findings in this report should not be construed as an official DoD position. It is published in the interest of scientific and technical information exchange. FOR THE COMMANDER (signature on file) Thomas R. Miller, Lt Col, USAF SEI Joint Program Office This work is sponsored by the U.S. Department of Defense. Copyright1996 by Carnegie Mellon University. Permission to reproduce this document and to prepare derivative works from this document for internal use is granted, provided the copyright and “No Warranty” statements are included with all reproductions and derivative works. Requests for permission to reproduce this document or to prepare derivative works of this document for external and commercial use should be addressed to the SEI Licensing Agent. NO WARRANTY THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL IS FURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRAN- TIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTIBILITY, EXCLUSIVITY, OR RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT, TRADEMARK, OR COPYRIGHT INFRINGEMENT. This work was created in the performance of Federal Government Contract Number F19628-95-C-0003 with Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research and development center. The Government of the United States has a royalty-free government-purpose license to use, duplicate, or disclose the work, in whole or in part and in any manner, and to have or permit others to do so, for government purposes pursuant to the copyright license under the clause at 52.227-7013. This document is available through Research Access, Inc., 800 Vinial Street, Pittsburgh, PA 15212. Phone: 1-800-685-6510. FAX: (412) 321-2994. RAI also maintains a World Wide Web home page. The URL is http://www.rai Copies of this document are available through the National Technical Information Service (NTIS). For informa- tion on ordering, please contact NTIS directly: National Technical Information Service, U.S. Department of Commerce, Springfield, VA 22161. Phone: (703) 487-4600. This document is also available through the Defense Technical Information Center (DTIC). DTIC provides access to and transfer of scientific and technical information for DoD personnel, DoD contractors and potential contrac- tors, and other U.S. Government agency personnel and their contractors. To obtain a copy, please contact DTIC directly: Defense Technical Information Center / 8725 John J. Kingman Road / Suite 0944 / Ft. Belvoir, VA 22060-6218.Phone:(703) 767-8222 or 1-800 225-3842.] Use of any trademarks in this report is not intended in any way to infringe on the rights of the trademark holder. CMU/SEI-94-TR-12i Table of Contents Acknowledgmentsiii 1Introduction1 2The Capability Maturity Model for Software3 2.1The Five Maturity Levels3 2.2Key Process Areas3 2.3Common Features6 2.4Key Practices7 3The ISO 9000 Series of Standards for Quality Management Systems9 4Mapping ISO 9001 to the CMM11 4.1Management Responsibility11 4.2Quality System12 4.3Contract Review12 4.4Design Control13 4.5Document Control13 4.6Purchasing13 4.7Purchaser-Supplied Product14 4.8Product Identification and Traceability14 4.9Process Control14 4.10Inspection and Testing15 4.11Inspection, Measuring, and Test Equipment15 4.12Inspection and Test Status15 4.13Control of Nonconforming Product15 4.14Corrective Action16 4.15Handling, Storage, Packaging, and Delivery16 4.16Quality Records17 4.17Internal Quality Audits17 4.18Training17 4.19Servicing17 4.20Statistical Techniques18 5Contrasting ISO 9001 and the CMM19 5.1The Need for Judgment20 5.2The Key Process Area Profile of an ISO 9001-Compliant Organization20 6Conclusion23 7References25 Appendix A.A Detailed Map Between ISO 9001 and the CMM27 Appendix B.A Detailed Map Between ISO 9000-3 and the CMM41 Appendix C.A Clause-Level Map Between ISO 9001, ISO 9000-3, and the CMM59 Appendix D.Coverage of CMM Key Practices in ISO 900165