Managing standards compliance

TLDR

Software engineering standards prescribe constraints on documents such as requirements, reviews, and reports, and compliance is assessed by checking these documents, but enforcing compliance throughout development is impractical, so it must be managed. The authors propose a model of standards and compliance and demonstrate it with examples. They present notations and a method to support the model, and describe a constructed support environment. Their work identifies the compliance issue, introduces a standards model and support system, formalizes product state notation, offers a policy scheme that triggers checks, and provides a flexible, scalable compliance management view.

Abstract

Software engineering standards determine practices that "compliant" software processes shall follow. Standards generally define practices in terms of constraints that must hold for documents. The document types identified by standards include typical development products, such as user requirements, and also process-oriented documents, such as progress reviews and management reports. The degree of standards compliance can be established by checking these documents against the constraints. It is neither practical nor desirable to enforce compliance at all points in the development process. Thus, compliance must be managed rather than imposed. We outline a model of standards and compliance and illustrate it with some examples. We give a brief account of the notations and method we have developed to support the use of the model and describe a support environment we have constructed. The principal contributions of our work are: the identification of the issue of standards compliance; the development of a model of standards and support for compliance management; the development of a formal model of product state with associated notation; a powerful policy scheme that triggers checks; and a flexible and scalable compliance management view.