ISO-16085-2006.pdf

Reference number ISO/IEC 16085:2006(E) IEEE Std 16085-2006 INTERNATIONAL STANDARD ISO/IEC 16085 IEEE Std 16085-2006 Second edition 2006-12-15 Systems and software engineering Life cycle processes Risk management Ingénierie des systèmes et du logiciel Processus du cycle de vie Gestion des risques ISO/IEC 16085:2006(E) IEEE Std 16085-2006 PDF disclaimer This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may be printed or viewed but shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Secretariat accepts no liability in this area. Adobe is a trademark of Adobe Systems Incorporated. Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below. ISO Case postale 56 CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.org Web www.iso.org ii ISO/IEC 16085:2006(E) (Revision of IEEE Std 1540-2001) Systems and software engineering Life cycle processes Risk management Sponsor Software +1 978 750 8400. Permission to photocopy portions of any individual standard for educational classroom use can also be obtained through the Copyright Clearance Center. NOTE?Attention is called to the possibility that implementation of this standard may require use of subject matter covered by patent rights. By publication of this standard, no position is taken with respect to the existence or validity of any patent rights in connection therewith. The IEEE shall not be responsible for identifying patents for which a license may be required by an IEEE standard or for conducting inquiries into the legal validity or scope of those patents that are brought to its attention. ivCopyright © 2006 IEEE. All rights reserved IEEE Introduction Risk management is a key discipline for making effective decisions and communicating the results within organizations. The purpose of risk management is to identify potential managerial and technical problems before they occur so that actions can be taken that reduce or eliminate the probability and/or impact of these problems should they occur. It is a critical tool for continuously determining the feasibility of project plans, for improving the search for and identification of potential problems that can affect life cycle activities and the quality and performance of products, and for improving the active management of projects. This standard can be applied equally to systems and software. Annex D is specific to software and the ISO/ IEC 12207 series of life cycle standards, in order to summarize where risk management is mentioned, in lieu of a specific risk management process. Notice to users Errata Errata, if any, for this and all other standards can be accessed at the following URL: http:/ standards.ieee.org/reading/ieee/updates/errata/index.html. Users are encouraged to check this URL for errata periodically. Interpretations Current interpretations can be accessed at the following URL: http:/standards.ieee.org/reading/ieee/interp/ index.html. Patents Attention is called to the possibility that implementation of this standard may require use of subject matter covered by patent rights. By publication of this standard, no position is taken with respect to the existence or validity of any patent rights in connection therewith. The IEEE shall not be responsible for identifying patents or patent applications for which a license may be required to implement an IEEE standard or for conducting inquiries into the legal validity or scope of those patents that are brought to its attention. This introduction is not part of ISO/IEC/IEEE 16085:2006, Systems and software engineering Life cycle processes Risk management. Copyright © 2006 IEEE. All rights reservedv Participants The following individuals participated in the development of this standard. Robert N. Charette, Chair Paul R. Croll Cheryl Jones Garry J. Roedler James W. Moore When the IEEE-SA Standards Board approved this standard, it had the following membership: Steve M. Mills, Chair Richard H. Hulett, Vice Chair Don Wright, Past Chair Judith Gorman, Secretary *Member Emeritus Also included are the following nonvoting IEEE-SA Standards Board liaisons: Satish K. Aggarwal, NRC Representative Richard DeBlasio, DOE Representative Alan H. Cookson, NIST Representative Michael D. Fisher IEEE Standards Project Editor Mark D. Bowman Dennis B. Brophy Joseph Bruder Richard Cox Bob Davis Julian Forster* Joanna N. Guenin Mark S. Halpin Raymond Hapeman William B. Hopf Lowell G. Johnson Herman Koch Joseph L. Koepfinger* David J. Law Daleep C. Mohla Paul Nikolich T. W. Olsen Glenn Parsons Ronald C. Petersen Gary S. Robinson Frank Stone Malcolm V. Thaden Richard L. Townsend Joe D. Watson Howard L. Wolfman viCopyright © 2006 IEEE. All rights reserved Contents 1.Overview 1 1.1 Scope 1 1.2 Purpose. 1 1.3 Field of application 2 1.4 Conformance 2 1.5 Disclaimer 3 2.Normative references. 3 3.Definitions . 3 4.Application of this standard. 6 5.Risk management in the life cycle. 6 5.1 Risk management process 6 5.2 Null Clause 15 Annex A (informative) Risk management plan. 16 Annex B (informative) Risk action request. 19 Annex C (informative) Risk treatment plan 21 Annex D (informative) Application of risk management in the software life cycle . 23 Annex E (informative) Annotated bibliography 30 Copyright © 2006 IEEE. All rights reserved 1 Systems and software engineering Life cycle processes Risk management 1. Overview This standard prescribes a continuous process for risk management. Clause 1 provides an overview and describes the purpose, scope, and field of application, as well as prescribing the conformance criteria. Clause 2 lists the normative references; informative references are provided in Annex E. Clause 3 provides definitions. Clause 4 describes how risk management is applied to the life cycle. Clause 5 prescribes the requirements for a risk management process. There are several informative annexes. Annex A, Annex B, and Annex C recommend content of three docu- ments: Risk Management Plan, Risk Action Request, and Risk Treatment Plan. Annex D summarizes where risk management is mentioned in the ISO/IEC 12207 series of software life cycle process standards. An equivalent annex is not included for ISO/IEC 15288, the system life cycle process standard, since it includes a risk management process. Annex E, as previously mentioned, is an annotated bibliography of standards and other documents related to the material covered in this standard. 1.1 Scope This standard describes a process for the management of risk during systems or software acquisition, supply, development, operations, and maintenance. 1.2 Purpose The purpose of this standard is to provide suppliers, acquirers, developers, and managers with a single set of process requirements suitable for the management of a broad variety of risks. This standard does not provide detailed risk management techniques, but instead focuses on defining a process for risk management in which any of several techniques may be applied. 1.3 Field of application This standard defines a process for the management of risk throughout the life cycle. This standard is suit- able for adoption by an organization for application to all appropriate projects. This standard is useful for managing the risks associated with organizations dealing with system or software issues. FINAL DRAFT / PROJET FINAL ISO/IEC 16085:2006(E)SYSTEMS AND SOFTWARE ENGINEERING 2Copyright © 2006 IEEE. All rights reserved This standard may be applied in conjunction with the ISO/IEC 12207:1995 series of standards, ISO/IEC 15288, or applied independently. 1.3.1 Application with ISO/IEC 12207:1995 series ISO/IEC 12207:1995 is currently the ISO's “ umbrella” standard describing standard processes for the acqui- sition, supply, development, operations, and maintenance of software. The standard recognizes that actively managing risk is a key success factor in the management of a software project. ISO/IEC 12207:1995 men- tions risk and risk management in several places, but did not provide a process for risk management (see Annex D). This risk management standard provides that process in a manner aligned with the risk manage- ment process definition provided by subsequent amendments to ISO/IEC 12207. This standard may be used for managing organizational-level risk or project-level risk, in any domain or life cycle phase, to support the perspectives of managers, participants, and other stakeholders. In the life cycle process framework provided by ISO/IEC 12207:1995, risk management is an “ organiza- tional life cycle process.” The activities and tasks in an organizational process are the responsibility of the organization using that process. The organization therefore ensures that this process has been established. When used with ISO/IEC 12207:1995, this standard assumes that the other management and technical pro- cesses of ISO/IEC 12207 perform the treatment of risk. Appropriate relationships to those processes are described. 1.3.2 Application with ISO/IEC 15288:2002 series ISO/IEC 15288:2002 includes a risk management process and mentions risk and risk management in several places. This standard may be used for managing organizational-level risk, enterprise-level risk, or project- level risk, in any domain or life cycle stage, to support the perspectives of managers, participants, and other stakeholders. 16085 is broadly compatible with the risk management process documented in ISO/IEC 15288:2002 and provides additional process information to aid planning and execution of risk management. When used with ISO/IEC 15288:2002, this standard assumes that the other management and technical processes of ISO/IEC 15288 perform the treatment of risk. The scope, purpose, field of application, and conformance requirements in Clause 1 can be interpreted for system life cycle application. The definitions (Clause 3), process informa- tion (Clause 5) and outlines for the risk management plan (Annex A), risk action request (Annex B), and risk treatment plan (Annex C) can be directly applied to the system life cycle. 1.3.3 Application independent of ISO/IEC series This standard may be used independently of any particular systems or software life cycle process standard. When used in this manner, the standard applies additional provisions for the treatment of risk. 1.4 Conformance An organization or project may claim conformance to this standard by implementing a process, demonstrat- ing through plans and performance all of the requirements (specified as mandatory by the word shall) in the activities and tasks described in Clause 5. Note that in those instances where this standard is applied independently of ISO/IEC 12207:1995 or ISO/ IEC 15288:2002, an additional set of requirements for risk treatment is provided in 5.1.4.2. IEEE Std 16085-2006 LIFE CYCLE PROCESSES RISK MANAGEMENT Copyright © 2006 IEEE. All rights reserved 3 1.5 Disclaimer This standard establishes minimum requirements for a risk management process, activities and tasks. Imple- menting these requirements or the preparation of risk management plans or risk action requests according to this standard does not ensure an absence of risks. Conformance with this standard does not absolve any party from any social, moral, financial, or legal obligation. 2. Normative references The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments or corrigenda) applies. ISO/IEC 12207:1995, Information Technology Software Life Cycle Processes.1 ISO/IEC 12207:1995/AMD.1:2002, Information Technology Software Life Cycle Processes Amendment 1. ISO/IEC 12207:1995/AMD.2:2003, Information Technology Software Life Cycle Processes Amendment 2. ISO/IEC 15026:1998, Information Technology System and Software Integrity Levels. ISO/IEC 15288: 2002, Systems Engineering System life cycle processes NOTES 1ISO/IEC 12207:1995 is not needed if this standard is being applied independently of ISO/IEC 12207. 2IEEE/EIA 12207.0-1996 may be used as a replacement for ISO/IEC 12207:1995.2 3ISO/IEC 15288:2002 is not needed if this standard is being applied independently of ISO/IEC 15288. 3. Definitions For the purposes of this document, the following terms and definitions apply. The Authoritative Dictionary of IEEE Standard Terms B19 should be referenced for terms not defined in this clause. 3.1 consequence: An outcome of an event. NOTES 1There can be more than one consequence from one event. 2Consequences can range from positive to negative. However, consequences are always negative for safety aspects. 3Consequences can be expressed qualitatively or quantitatively. ISO Guide 73:2002, definition 3.1.2 3.2 event: The occurrence of a particular set of circumstances. 1ISO/IEC publications are available from the ISO Central Secretariat, Case Postale 56, 1 rue de Varembé, CH-1211, Genève 20, Swit- zerland/Suisse (http:/www.iso.ch/). ISO/IEC publications are also available in the United States from Global Engineering Documents, 15 Inverness Way East, Englewood, Colorado 80112, USA (http:/global.ihs.com/). Electronic copies are available in the United States from the American National Standards Institute, 11 West 42nd Street, 13th Floor, New York, NY 10036, USA (http:/www.ansi.org/). 2 IEEE publications are available from the Institute of Electrical and Electronics Engineers, 445 Hoes Lane, P.O. Box 1331, Piscat- away, NJ 08855-1331, USA (http:/standards.ieee.org/). ISO/IEC 16085:2006(E) IEEE Std 16085-2006 SYSTEMS AND SOFTWARE ENGINEERING 4Copyright © 2006 IEEE. All rights reserved NOTES 1The event can be certain or uncertain. 2The event can be a single occurrence or a series of occurrences. 3The probability associated with the event can be estimated for a given period of time. ISO Guide 73:2002, definition 3.1.4 3.3 probability: The extent to which an event (3.1.4) is likely to occur NOTES 1ISO 3534-1:1993, definition 1.1, gives the mathematical definition of probability as “ a real number in the scale 0 to 1 attached to a random event. It can be related to a long-run relative frequency of occurrence or to a degree of belief that an event will occur. For a high degree of belief, the probability is near 1.” 2Frequency rather than probability may