ISO/IEC JTC 1/SC 7/WG 24 - Systems and software standards for Very Small Entities

This document provides a profile specification for the organizational management profile. The organizational management profile applies to VSEs involved in systems engineering and/or software engineering development. This document provides links to the subset of ISO/IEC/IEEE 12207 and ISO 9001 organizational, resources, processes and project portfolio process elements from the organizational perspective.

This document defines the process assessment guidelines needed to meet the purpose of defined VSE profiles. It is applicable to all VSE profiles and is compatible with ISO/IEC 33002. The possible uses of this document are as follows. a) Assessment to evaluate the process capabilities. Use when an organization wants an assessment of profile conformance (basic, etc.) of the implemented processes. b) Supplier's capability assessment. Use when a customer asks for a third party to conduct an assessment in order to obtain a profile (basic, etc.) of the implemented process by the system or software development and maintenance supplier.

1.1 Fields of application This document provides management and engineering guidance within the Intermediate profile for the Business Management, Project Management, System Definition and Realisation and Acquisition Management processes. This document is applicable to Very Small Entities (VSEs). VSEs are enterprises, organisations, departments or projects having up to 25 people. The lifecycle processes described in the ISO/IEC 29110 series are not intended to preclude or discourage their use by organisations bigger than VSEs. This document has been developed using the management and engineering guide from the systems engineering Basic profile. Elements were added or modified (e.g. process, task, work product, role) to support VSEs involved in the development of more than one project in parallel with more than one work team. This guide is oriented towards the management of more than one project in parallel with more than one work team. This document applies for the development of non-critical systems. Using this document, a VSE can obtain benefits in the following aspects: — An agreed set of project requirements (technical part of contract) and expected work products are agreed by the Acquirer. — A disciplined management process, that provides project visibility and corrective actions of project problems and deviations, is performed. — A systematic System Definition and Realisation process, that satisfies Acquirer needs and helps ensure quality work products, is followed. Once the system, developed by a VSE, has been accepted by their customers, the VSE that wants to provide after delivery services can refer to ISO/IEC TR 29110-5-3. In the context of systems engineering, that is the System Definition and Realisation (SR) process, the group that is part of the VSE responsible for developing software elements that are part of the system are encouraged to use the management and engineering guide of the software engineering Intermediate profile (ISO/IEC TR 29110-5-1-3). 1.2 Target audience This document is targeted at VSEs that do not develop critical systems and have little or no experience with systems engineering (SE) process planning and implementation using ISO/IEC/IEEE 15288. This document is also targeted to VSEs which are familiar with management and engineering guide of the systems engineering Basic profile (ISO/IEC TR 29110 5-6-2) for their system development projects and are involved in the development of more than one project in parallel with more than one work team. This document is intended to be used with any processes, techniques and methods that enhance the VSE's Stakeholder satisfaction and productivity.

This document is applicable to Very Small Entities (VSEs). A VSE is an enterprise, an organization, a department or a project having up to 25 people. The purpose of this document is to provide a set of auditable requirements based on multiple standards (i.e., ISO/IEC/IEEE 15288, ISO/IEC/IEEE 15289, ISO 9000, ISO 9001, ISO 31000, ISO/IEC 38500, ISO 10004, ISO 10007, ISO/IEC 20000, ISO/IEC 27035) that supports the delivery of services by a VSE. Services can be delivered to internal or external customers. This document is not a Management System Standard (MSS), nor does it provide guidance on fulfilling the requirements of an MSS. ISO/IEC 20000-1:2011 is the MSS for service management (see Annex D for information). This document does not promote uniformity in the approach across all organizations, as specific objectives and initiatives are tailored to suit an individual organization's needs.

This document is applicable to Very Small Entities (VSEs). VSEs are enterprises, organisations, departments or projects having up to 25 people. The life cycle processes described in the set of International Standards (IS) and Technical Reports (TR) are not intended to preclude or discourage their use by organisations bigger than VSEs. The Advanced profile is the fourth profile of a four-profile software engineering roadmap (i.e. Entry, Basic, Intermediate and Advanced). This document describes processes targeted at VSEs that want to sustain and grow as an independent competitive software development business. ISO/IEC 29110-4-1 identifies the requirements applicable to the tasks and work products described in this document. These guidelines apply to VSEs that develop non-critical software. Using these guidelines, VSEs can obtain the following benefits: - management and monitoring of more than one project in parallel with more than one work team; - reuse of existing software components (e.g. code and document) in new projects; - continuous measurement and evaluation of projects; - continuous evaluation and improvement processes; - continuous sustainability and growth; and - support to customers in the disposal of software and installation of new software. Once the software, developed by a VSE, has been accepted by their customer, the VSE that wants to provide after-delivery services can refer to ISO/IEC TR 29110-5-3.

This document: - defines the rules applicable for certification of the implementation of systems engineering, software engineering and service delivery processes complying with the requirements given in ISO/IEC 29110‑4-m, Profile specifications; and - provides the necessary information and confidence to customers about the way certification of their suppliers has been granted. Certification of the implementation of systems and software engineering processes (named "certification" in this document) is a third-party conformity assessment activity (see ISO/IEC 17000:2004, 5.5). Bodies performing this activity are therefore third-party conformity assessment bodies (named "certification body/bodies" in this document). NOTE This document is primarily intended to be used as a criteria document for the accreditation or peer assessment of certification bodies which seek to be recognized as being competent to certify that a Very Small Entity (VSE) complies with ISO/IEC 29110‑4-m, Profile Specifications. Some of its requirements could also be found useful by any other parties involved in the conformity assessment of such certification bodies. Systems and software engineering processes certification does not attest the fitness of the systems and or software products offered by a VSE. It is important to note that certification of the implementation of systems and software engineering processes according to ISO/IEC 29110‑4-m, Profile Specifications, is a process certification and not a management systems certification neither a product certification. Certification of the implementation of systems and software engineering processes (SEP) of a very small entity (VSE) is one means of providing assurance that the VSE has implemented systems and software engineering processes to the development or maintenance of systems and or software. Requirements for the implementation of SEP can originate from a number of sources, and this International Standard has been developed to assist in the certification of SEP that fulfil the requirements of ISO/IEC 29110‑4-m, Profile Specifications. The contents of this document can also be used to support certification of SEP that are based on other sets of specified SEP requirements. This document is intended for use by bodies that carry out audit and certification of SEP for VSEs. It gives generic requirements for such certification bodies performing audit and certification in the field of SEP for VSEs. Such bodies are referred to as certification bodies. This wording is not intended to be an obstacle to the use of this document by bodies with other designations that undertake activities covered by the scope of this document. Indeed, this document is intended to be usable by anyone involved in the assessment of SEP for VSEs. Certification activities involve the audit of a VSE's SEP. The form of attestation of conformity of a VSE's SEP to a specific lifecycle profile standard setting the applicable SEP (for example ISO/IEC 29110‑4-1 or ISO/IEC 29110‑4-3) or other specified requirements are normally a certification document or a certificate. This certification is outside the scope of ISO/IEC 29169 to the assessment to process quality characteristics and organizational maturity, and does not cover the results of process assessment. ISO/IEC 29110-3-3 describes such a scheme. It is for the VSE being certified to develop its own processes (including ISO/IEC 29110‑4-m SEP), other sets of specified SEP requirements, other processes and it is for the VSE to decide how the various components of these will be arranged. It is therefore for certification bodies that operate in accordance with this document to take into account the culture and practices of their clients with respect to the implementation of SEP, including, if applicable, within the wider organization.

ISO/IEC 29110-4-1:2018 series is applicable to Very Small Entities (VSEs). VSEs are enterprises, organizations, departments or projects having up to 25 people. The lifecycle processes described in the ISO/IEC 29110 series are not intended to preclude or discourage their use by larger organizations than VSEs. The lifecycle processes defined in the ISO/IEC 29110 series can be used by VSEs when using, as well as when creating and supplying, a software system. They can be applied at any level in a software system's structure and at any stage in the lifecycle. The processes described in the ISO/IEC 29110 series are not intended to preclude or discourage the use of additional processes that VSEs find useful. This document is not intended to preclude the use of different life cycles such as: waterfall, iterative, incremental, evolutionary or agile. ISO/IEC 29110-4-1:2018 provides a profile specification for the Basic profile. The Basic profile applies to VSEs involved in software development. It selects ISO/IEC/IEEE 12207 project management and software implementation process elements from the single project perspective. ISO/IEC 29110-4-1:2018 provides the normative and informative links to the subset of ISO/IEC/IEEE 12207.

1.1 Fields of application These Service Delivery guidelines are applicable to Very Small Entities (VSEs). A VSE is an enterprise, an organization, a department or a project having up to 25 people. ISO/IEC TR 29110-5-3:2018 provides guidance to manage a set of services delivered to customers. The VSE can act as an internal service provider (providing services internal to the VSE) or as an external service provider (providing services commercially to external customers). These lifecycle processes (Governance, Service Control, Service Relationship and Service Incident) support and enhance the activities of software and system operations (further to development and installation) to create effective and efficient products and services. ISO/IEC TR 29110-5-3:2018 provides guidance for Service Delivery. This document, when implemented, will assist and guide the VSE in the delivery of services which can benefit customers. This document does not promote uniformity in approach across all organizations as specific objectives and initiatives are tailored to suit an individual organization's needs. Tasks described in this guideline document (and therefore activities and processes) are related by input/output relationships which imply a logical execution sequence. The order of presentation of the processes or the associated numbering scheme is for identification purposes only, NOT to indicate implementation or execution order. As every VSE is different; tasks can be implemented in an order that is suitable for the organization, while respecting the relationships between tasks. 1.2 Target audience ISO/IEC TR 29110-5-3:2018 is intended to be used by VSEs to establish processes to implement effective and efficient service delivery. This service delivery guidelines document can be used by VSEs that are offering only services to its customers or it can be combined with the information from ISO/IEC 29110 systems and/or software management and engineering guidelines.

ISO/IEC TR 29110-5-1-3:2017 provides management and engineering guide to the intermediate profile described in terms of business management, project management, software implementation and acquisition processes. ISO/IEC TR 29110-5-1-3:2017 is applicable to Very Small Entities (VSEs). VSEs are enterprises, organizations, departments or projects having up to 25 people. The life cycle processes described in the ISO/IEC 29110 series are not intended to preclude or discourage their use by organizations bigger than VSEs. ISO/IEC 29110?4-1 identifies the requirements applicable to the tasks and work products described in this document. ISO/IEC TR 29110-5-1-3:2017 has been developed using the management and engineering guide of the Basic profile and by modifying and adding elements (e.g. process, task, work product, role) for VSEs involved in the development of more than one project in parallel with more than one work team. ISO/IEC TR 29110-5-1-3:2017 applies for VSEs developing non-critical software. Using this document, VSEs can obtain the following benefits: - the management and monitoring of more than one project in parallel with more than one work team; - reuse existing software components (e.g. code and document) in new projects; - continuously measure projects and improve processes. Once the software, developed by a VSE, has been accepted by their customers, the VSE that wants to provide after delivery services can refer to ISO/IEC TR 29110-5-3.[1] ISO/IEC TR 29110-5-1-3:2017 is targeted to VSEs which are familiar with ISO/IEC TR 29110‑5-1-2 for their software development projects and are involved in the development of more than one project in parallel with more than one work team. ISO/IEC TR 29110-5-1-3:2017 is intended to be used with any lifecycles, processes, techniques and methods that enhance the VSEs customer satisfaction and productivity. [1] To be published.

ISO/IEC 29110-3-3:2016 contains the requirements for certification bodies performing conformity assessments, of the requirements contained in VSE profile specifications (e.g. ISO/IEC 29110‑4-1 for VSE software basic profile), using process assessments and maturity models. This document is based on published ISO/IEC standards and guides for a) certification bodies (see ISO/IEC 17065) b) the process assessment and organizational process maturity performed according to the requirements of the ISO/IEC 33001 to ISO/IEC 33099 family of process assessment standards, and c) based on ISO/IEC 29169 to support an environment which encourages worldwide recognition of VSE profiles conformity assessment results. The overall framework for conformity assessment follows the approach defined in ISO/IEC 17065:2012. This document has been developed following practical use and in consultation with key stakeholders, national accreditation bodies, and ISO's policy committee for conformity assessment (CASCO). ISO/IEC 29110-3-3:2016 is addressed to people and certification bodies who have a direct relationship with the assessment process based on the VSE profiles. It is intended that ISO/IEC/TR 29110‑1, ISO/IEC 29110‑2-1 and ISO/IEC 29110‑4-1 (containing VSE profile specifications) be read first when investigating the possibility of conducting VSE profile certification. NOTE Any clause with requirements directly copied from other standards has those copied requirements marked up in a box. Other requirements which are also copied but for which information is added are not marked up in a box but their source is clearly referenced in the text.

ISO/IEC TR 29110-1:2016 introduces the major concepts required to understand and use the ISO/IEC 29110 series. It introduces the characteristics and requirements of a VSE and clarifies the rationale for VSE-specific profiles, documents, standards and guides. It also introduces process, lifecycle, standardization concepts and defines the organizational terms common to the VSE Profile Set of Documents. It is applicable to a VSE. A VSE is an entity (enterprise, organization, department or project) having up to 25 people. The lifecycle processes described in the ISO/IEC 29110 series, Standardized Profiles and Technical Reports are not intended to preclude nor discourage their use by an entity that is larger than a VSE. It is targeted both at the general audience wishing to understand the series of documents and, more specifically, at users of the ISO/IEC 29110 series. It should be read first when initially exploring VSE Profile documents. While there is no specific prerequisite to read this part of ISO/IEC 29110, it will be helpful to the user in understanding the other parts. The lifecycle processes defined in the set of Standardized Profiles and Technical Reports can be used by a VSE when developing, acquiring and using, as well as when creating and supplying systems having hardware and software elements and software. They can be applied at any level in a systems development, software system's structure and at any stage in the lifecycle. They are not intended to preclude or discourage the use of additional processes that a VSE finds useful.

ISO/IEC 29110-5-2-1:2016 is applicable to Very Small Entities (VSEs). VSEs are enterprises, organizations, departments or projects having up to 25 people. The lifecycle processes described in the ISO/IEC 29110:2016 series are not intended to preclude or discourage their use by organizations bigger than VSEs. ISO/IEC 29110-5-2-1:2016 is the Organizational management guidance for profiles described in ISO/IEC 29110-4-1 through Organizational Management, Project Portfolio Management, Resource Management and Process Management Processes. It is not intended for a VSE to use the standardized profile to implement ISO/IEC 29110-5-2-1:2016. Using ISO/IEC 29110-5-2-1:2016, a VSE can obtain benefits in the following aspects: ? multiple project execution and supervision of its performance, making sure all processes are executed according to the organizational strategy; ? continuous monitoring of the customer satisfaction; ? deployment and improvement of the organizational standard processes in all projects; ? controlled provision of required resources.

ISO/IEC TR 29110-2-2:2016 provides a guide for developing a profile which is domain-specific for VSEs (Very Small Entities) business situation. It may be used by technical advisers, including consultants, to help VSEs on software process problems. It also provides a conceptual framework for standardized profile developers using the ISO/IEC 29110 series concept.

1.1 Fields of application ISO/IEC 29110-2-1:2015 is applicable to Very Small Entities (VSEs). The lifecycle processes described in ISO/IEC 29110 are not intended to preclude or discourage their use by organizations bigger than VSEs. However, certain issues faced by large organizations might not be covered by ISO/IEC 29110. The lifecycle processes defined in ISO/IEC 29110 can be used by VSEs when acquiring and using, as well as when creating and supplying, a software, and systems. They can be applied at any level in a software and systems structure and at any stage in the lifecycle. The processes described in ISO/IEC 29110 are not intended to preclude or discourage the use of additional processes that VSEs find useful. ISO/IEC 29110-2-1:2015 introduces the major concepts for software and systems engineering profiles for VSEs, and defines the terms common to the set of documents associated with VSE profiles. It establishes the logic behind the definition and application of profiles. It specifies the elements common to all standardized profiles (structure, conformance, assessment). ISO/IEC 29110-2-1:2015 is applicable to all profiles. 1.2 Target audience ISO/IEC 29110-2-1:2015 is targeted at authors and reviewers of standardized profiles, authors of other parts, and authors of other VSE profiles.

ISO/IEC TR 29110-3-4:2015 provides a guide for an autonomy-based improvement method for Very Small Entities (VSEs) developing systems or software products.

ISO/IEC 29110 is applicable to Very Small Entities (VSEs). VSEs are enterprises, organizations, departments or projects having up to 25 people. The lifecycle processes described in the set of International Standards (IS) and Technical Reports (TR) are not intended to preclude or discourage their use by organizations bigger than VSEs. ISO/IEC 29110-5-6-2:2014 provides the management and engineering guide to the Basic Profile described in ISO/IEC 29110-4-6 through Project Management and System Definition and realization processes. It is a standalone guide; it is not intended for a VSE to use the standardized profile to implement ISO/IEC 29110-5-6-2:2014. ISO/IEC 29110-5-6-2:2014 applies for non-critical systems development projects. The system development should fulfil the project requirements and the system description. ISO/IEC 29110-5-6-2:2014, a VSE can obtain benefits in the following aspects: An agreed set of project requirements (technical part of contract) and expected products are agreed by the Acquirer. A disciplined management process, that provides project visibility and corrective actions of project problems and deviations, is performed. A systematic System Definition and Realization process, that satisfies Acquirer needs and ensures quality products, is followed. VSEs developing software that is part of a larger system, and for stand-alone software products and services, are encouraged to use the management and engineering guide of the Basic Profile (ISO/IEC 29110 5 1-2).

ISO/IEC TR 29110-5-1-1:2012 is applicable to Very Small Entities (VSEs). VSEs are enterprises, organizations, departments or projects up to 25 people. The life cycle processes described in the set of International Standards (IS) Profiles and Technical Reports (TR) are not intended to preclude or discourage their use by organizations bigger than VSEs. ISO/IEC TR 29110-5-1-1:2012 provides the management and engineering guide to the entry profile described in ISO/IEC 29110-4-1 through project management and software implementation processes. ISO/IEC TR 29110‑5‑1‑1:2012 is a stand-alone guide. It is not intended for a VSE to use the standardized profile to implement ISO/IEC TR 29110-5-1-1:2012. ISO/IEC TR 29110-5-1-1:2012 applies for software development project. The project may be to fulfil an external or internal contract. The internal contract need not be explicit between the project team and their customer. Using ISO/IEC TR 29110-5-1-1:2012, a VSE can obtain the following benefits: 1) an agreed set of project requirements and expected products is delivered to the customer; 2) a disciplined management process, that provides project visibility and corrective actions of project problems and deviations, is performed; 3) a systematic software implementation process, that satisfies customer needs and ensures quality products, is followed. ISO/IEC TR 29110-5-1-1:2012 is targeted at VSEs (a start-up VSE that started the operation less than 3 years ago and/or with a project size less than 6 person-months). It is intended to be used with any processes, techniques and methods that enhance the VSE's customer satisfaction and productivity.

ISO/IEC TR 29110-5-1-2:2011 is applicable to Very Small Entities (VSEs). A VSE is defined as an enterprise, organization, department or project having up to 25 people. A set of standards and guides have been developed according to a set of VSEs' characteristics and needs. The guides are based on subsets of appropriate standards elements, referred to as VSE Profiles. The purpose of a VSE Profile is to define a subset of ISO/IEC International Standards relevant to the VSEs' context. The ISO/IEC 29110 series is targeted by audience. ISO/IEC TR 29110-5 is targeted to VSEs. ISO/IEC TR 29110-5-1-2:2011 provides the management and engineering guide to the Basic VSE Profile specifed in ISO/IEC 29110-4-1 through project management and software implementation processes. The Basic Profile is one profile of the Generic profile group. The Generic profile group is applicable to VSEs that do not develop critical software. The Generic profile group does not imply any specific application domain.

ISO/IEC TR 29110-3-1:2015 defines the process assessment guidelines needed to meet the purpose of defined Very Small Entity (VSE) profiles. It is applicable to all VSE profiles and is compatible with ISO/IEC 33002.

ISO/IEC TR 29110-3:2011 defines the process assessment guidelines and conformance requirements needed to meet the purpose of defined VSE Profiles. It is applicable to all VSE Profiles and is compatible with ISO/IEC 15504-2. The possible uses of ISO/IEC TR 29110-3:2011 are as follows. Assessment to evaluate the process capabilities. This is when an organization wants an assessment execution in order to obtain a process profile of the implemented processes. Provider's capability assessment. This is when a customer asks for a third party to conduct an assessment in order to obtain a process profile of the implemented process by the software development and maintenance provider. The customer chooses the processes to be assessed depending on the services to be contracted. The target audience of ISO/IEC TR 29110-3:2011 is primarily those who perform process assessments for VSEs. ISO/IEC TR 29110-3:2011 also contains information that can be useful to developers of assessment methods and assessment tools. ISO/IEC TR 29110-3:2011 is addressed to people who have a direct relation with the assessment process based on the VSE Profiles, e.g. the assessor and the sponsor of the assessment, who need guidance on ensuring that the requirements for performing an assessment have been met.

ISO/IEC TR 29110-1:2011 introduces the major concepts required to understand and use the ISO/IEC 29110 series. It introduces the characteristics and requirements of a Very Small Entity (VSE), and clarifies the rationale for VSE-specific profiles, documents, standards and guides. It also introduces process, lifecycle and standardization concepts and defines the business terms common to the ISO/IEC 29110 series. ISO/IEC TR 29110-1:2011 is applicable to VSEs. The lifecycle processes described in ISO/IEC 29110 are not intended to preclude or discourage their use by an entity that is larger than a VSE.

ISO/IEC 29110-4-1:2011 is applicable to Very Small Entities (VSEs). A Very Small Entity (VSE) is defined as an enterprise, organization, department or project having up to 25 people. A set of standards and guides have been developed according to a set of VSEs' characteristics and needs. The guides are based on subsets of appropriate standards elements, referred to as VSE profiles. The purpose of a VSE profile is to define a subset of International Standards relevant to the VSE context. ISO/IEC 29110 is targeted by audience. ISO/IEC 29110-4 is targeted for standards producers, tool vendors and methodology vendors. It is not intended for VSEs. ISO/IEC 29110-4-m provides the specification for all the profiles in a profile group that are based on subsets of appropriate standards elements. If a new profile is needed, a Part 4-m can be developed without impacting existing documents. ISO/IEC 29110-4-1:2011 provides a profile specification for the Basic VSE profile within the Generic profile group. The Generic profile group is applicable to VSEs that do not develop critical software. The Generic profile group does not imply any specific application domain. The Basic VSE profile selects ISO/IEC 12207 project management and software implementation process elements and ISO/IEC 15289 products from the single project perspective. Its purpose is to provide the normative and informative links to the subset of ISO/IEC 12207 and ISO/IEC 15289.

A Very Small Entity (VSE) is defined as an enterprise, organization, department or project having up to 25 people. A set of standards and guides have been developed according to a set of VSEs' characteristics and needs. The guides are based on subsets of appropriate standards elements, referred to as VSE profiles. The purpose of a VSE profile is to define a subset of International Standards relevant to the VSE context. ISO/IEC 29110 is targeted by audience. ISO/IEC 29110-2:2011 is targeted for standards producers, tool vendors and methodology vendors. It is not intended for VSEs. It introduces the concepts for software engineering International Standardized Profiles for VSEs, and defines the terms common to ISO/IEC 29110. It establishes the logic behind the definition and application of standardized profiles. It specifies the elements common to all standardized profiles (structure, conformance, assessment) and introduces the taxonomy (catalogue) of ISO/IEC 29110 profiles.