Requirements Elaboration

Transcription

1 Requirements Elaboration ProPath Office of Information and Technology

2 Table of Contents Requirements Elaboration Process Maps... 1 Process: Requirements Elaboration... 4 Requirements Elaboration and Goals Goals... 5 Requirements Elaboration RACI Information... 6 Requirements Elaboration Process... 8 Process Activity Name: RQE-1 Evaluate Mandated Requirements... 8 Process Activity Name: RQE-2 Evaluate Mandated Security and Privacy Requirements... 9 Process Activity Name: RQE-2-DEC01 Agile Related? Process Activity Name: RQE-3 Document Use Case Scenarios Process Activity Name: RQE-3.1 Document Mandated Requirements Use Case Scenarios Process Activity Name: RQE-3.2 Document Security Use Case Scenarios Process Activity Name: RQE-4 Document Nonfunctional Requirements Process Activity Name: RQE-5 Conduct Agile Story Management Process Activity Name: RQE-5.1 Manage Epic Stories Process Activity Name: RQE-5.2 Manage User Stories Process Activity Name: RQE-6 Create Requirements Traceability Matrix i

3 Requirements Elaboration Process Maps Requirements Elaboration home overview raci help Requirements Management Repository Analyst RQE-1 Evaluate Mandated Requirements RQE-2 Evaluate Mandated Security and Privacy Requirements Agile Related? No RQE-3 Document Use Case Scenarios Yes RQE-5 Conduct Agile Story Management RQE-4 Document Nonfunctional Requirements RQE-6 Create Requirements Traceability Matrix The links in this process map are inactive. Please scroll to view activity data. 1

4 Requirements Elaboration: RQE-3 Document Use Case Scenarios home process overview raci help RQE-3.1 Document Mandated Requirements Use Case Scenarios RQE-3.2 Document Security Use Case Scenarios The links in this process map are inactive. Please scroll to view activity data. 2

5 Requirements Elaboration: RQE-5 Conduct Agile Story Management home proc ess overview raci help RQE-5.1 Manage Epic Stories RQE-5.2 Manage User Stories The links in this process map are inactive. Please scroll to view activity data. 3

6 Process: Requirements Elaboration Overview: The process map for Requirements Elaboration cycles through the following process and review activities: RQE-1 Evaluate Mandated Requirements RQE-2 Evaluate Mandated Security and Privacy Requirements RQE-2-DEC01 Agile Related? RQE-3 Document Use Case Scenarios RQE-3.1 Document Mandated Requirements Use Case Scenarios RQE-3.2 Document Security Use Case Scenarios RQE-4 Document Nonfunctional Requirements RQE-5 Conduct Agile Story Management RQE-5.1 Manage Epic Stories RQE-5.2 Manage User Stories RQE-6 Create Requirements Traceability Matrix 4

7 Requirements Elaboration and Goals The Requirements Elaboration process addresses the evaluation and incorporation of applicable mandated cross-cutting functional and non-functional requirements (and meta-data) provided to OIT development projects with the support and consultation of the Product Development Requirements Management Repository Team. One of the outcomes of this process is the development of the Requirements Traceability Matrix. Furthermore, this process addresses the development of Use Case Scenarios and Models which specify the actors and the sequence of activities performed by the actors interacting with the project to be developed. Finally, for the projects which have adopted the Agile project development/management methodology, the Requirements Elaboration process addresses the creation of Epic and User Stories. Goals Evaluate cross-cutting requirements for implementation Document use case scenarios Document nonfunctional requirements Ensure requirements traceability 5

8 Requirements Elaboration RACI Information The following describes the RACI information for this process: RQE-1 Evaluate Mandated Requirements Responsible Role: Requirements Management Repository Analyst Accountable Role: Director, Product Assessment Consulted Role: RQE-2 Evaluate Mandated Security and Privacy Requirements Responsible Role: Requirements Management Repository Analyst Accountable Role: Director, Product Assessment Consulted Role:, Health Care Security Requirements (HCSR) Security Specialist, Information Security Officer, Information System Security Officer, Privacy Officer, Stakeholder(s) Informed Role: Integrated Project Team, Program Manager, Project Manager RQE-2-DEC01 Agile Related? Responsible Role: Accountable Role: Project Manager RQE-3.1 Document Mandated Requirements Use Case Scenarios Responsible Role: Accountable Role: Director, Product Assessment RQE-3.2 Document Security Use Case Scenarios Responsible Role: Accountable Role: Director, Product Assessment Consulted Role: Health Care Security Requirements (HCSR) Security Specialist, Stakeholder(s), Subject Matter Expert(s) Informed Role: Integrated Project Team, Project Manager 6

9 RQE-4 Document Nonfunctional Requirements Responsible Role: Accountable Role: Project Manager RQE-5.1 Manage Epic Stories Responsible Role: Accountable Role: Project Manager RQE-5.2 Manage User Stories Responsible Role: Accountable Role: Project Manager RQE-6 Create Requirements Traceability Matrix Responsible Role: Accountable Role: Project Manager 7

10 Requirements Elaboration Process Process Activity Name: RQE-1 Evaluate Mandated Requirements None RQE-1-DEC01 Agile Related? The Requirements Management (RM) Repository is managed by the Product Development (PD) RM Repository Team. The repository contains cross-cutting requirements submitted by many VA Office of Information Technology (OIT) and Veterans Health Administration (VHA) Office of Health Information (OHI) organizational entities. These cross-cutting requirements are provisioned to OIT development projects through an allocation process that is initiated with an information sharing presentation followed by a Project Allocation Questionnaire (PAQ) that a project populates and submits to the RM Repository Team. Based on the project s completed PAQ, the RM Repository Team generates an initial Project Allocation Report (PAR) and provides the report to the project. The report contains a set of cross-cutting requirements and associated metadata that are determined through the allocation process, to be applicable to a particular project increment. The PAR is negotiated and a final set of cross-cutting requirements is allocated to the project through a final PAR. The development project is expected to incorporate cross-cutting requirements as deemed applicable to their product into their requirements artifacts and subsequently implement them in the identified project increment. The distribution list for development projects to contact the RM Repository is: 'OIT PD PAC Requirements Repository Team'. Artifacts Used Business Requirements Document Business Use Case (if applicable) Enterprise RM Project Allocation Questionnaire Project Charter Project Management Plan Requirements Elaboration Document (if applicable) Artifacts Created Project Allocation Report Responsible Role Requirements Management Repository Analyst Tools and Websites IBM Rational RequisitePro 8

11 Requirements Management Repository Program Standards VA EA Enterprise Technical Architecture (ETA) Compliance Criteria More Info All community generated Open Source products (products developed by anyone outside the VA national development resources) that are identified as viable candidates to be used within VA need to be reviewed by the business community to assure that stakeholders approve all of the functionality that is provided in any such product. For VHA, contact should be made with Health Systems staff, who ensures the proper Program Offices are engaged. The VA EA Enterprise Technical Architecture (ETA) Compliance Criteria document establishes minimum compliance criteria for a product or product release. Process Activity Name: RQE-2 Evaluate Mandated Security and Privacy Requirements RQE-1 Evaluate Mandated Requirements RQE-2-DEC01 Agile Related? The incorporates enterprise security and privacy requirements as deemed applicable to their product into their requirements artifacts and subsequently implements them in the identified project increment. The Security Requirements Steering Committee (SRSC) manages and maintains a bank of comprehensive, authoritative, cross-cutting, enterprise security and privacy requirements located in SRSC_OIS_BusReqs repository contained in IBM Rational Requisite Requirements Composer (RRC). Enterprise security requirements leverage stakeholder involvement including line of business cross-cutting authoritative security and privacy requirements. Enterprise security requirements are reviewed and negotiated between Security Subject Matter Experts (SMEs), Security Stakeholders, and the development project team. For Security SME and Stakeholder support contact OIS.Communications@va.gov. For Healthcare Security SME and Stakeholder support contact VHA Health Care Security Requirements (HCSR) VHA 10P2 OIA HCSR REQUESTS mail group. Artifacts Used Business Requirements Document Business Use Case (if applicable) Enterprise RM Project Allocation Questionnaire Project Charter Project Management Plan Requirements Elaboration Document (if applicable) 9

12 Artifacts Created Project Allocation Report Responsible Role Requirements Management Repository Analyst Tools and Websites Requirements Management Repository Program Security Requirements Steering Committee SharePoint Standards VA Handbook 6500, Risk Management Framework for VA Information Systems - Tier 3: VA Information Security Program More Info None Listed Process Activity Name: RQE-2-DEC01 Agile Related? RQE-2 Evaluate Mandated Security Requirements If No, RQE-3 Document Use Case Scenarios Or If Yes, RQE-5 Conduct Agile Story Management There is a decision dependency that determines the next activity to complete: If the project is using an Agile development methodology, the next activity is RQE-5 Conduct Agile Story Management. If the project is not using an Agile development methodology, the next step is RQE-3 Document Use Case Scenarios. Responsible Role 10

13 Process Activity Name: RQE-3 Document Use Case Scenarios RQE-2 Evaluate Mandated Security and Privacy Requirements RQE-4 Document Nonfunctional Requirements The process map for RQE-3 Document Use Case Scenarios cycles through the following dependent activities: RQE-3.1 Document Mandated Requirements Use Case Scenarios RQE-3.2 Document Security Use Case Scenarios Process Activity Name: RQE-3.1 Document Mandated Requirements Use Case Scenarios RQE-2-DEC01 Agile Related? RQE-3.2 Document PAQ Use Case Scenarios The creates the Use Case Model and associated Use Cases, taking the Project Allocation Report into consideration. The Use Case Model, a high-level requirements document, (1) models the system's intended functions and its environment and (2) serves as a contract between the customer and the developers. Each Use Case specifies the actors and the sequence of activities performed by the actors interacting with the system. The Use Case Model and Use Cases serve as input for the analysis, design, and testing activities. Use Case Specification data are documented in the Requirements Specification Document. Artifacts Used Business Requirements Document Project Allocation Report Requirements Specification Document Artifacts Created Updated Requirements Specification Document 11

14 Responsible Role Tools and Websites IBM Rational RequisitePro ProPath Archived Artifacts Library Standards None Listed More Info None Listed Process Activity Name: RQE-3.2 Document Security Use Case Scenarios RQE-3.1 Document Mandated Security Requirements Use Case Scenarios RQE-4 Document Nonfunctional Requirements The creates the Use Case Model and associated Use Cases, taking the enterprise security requirements into consideration. The Use Case Model, a high-level requirements document, (1) models the system's intended functions and its environment and (2) serves as a contract between the customer and the developers. Each Use Case specifies the actors and the sequence of activities performed by the actors interacting with the system. The Use Case Model and Use Cases serve as input for the analysis, design, and testing activities. Defining the system-specific security baseline may require input from the Information System Owner, Security SME, or Security Stakeholder. Use Case Specification data are documented in the Requirements Specification Document. 12

15 Artifacts Used Business Requirements Document Project Allocation Report Requirements Specification Document Artifacts Created Updated Requirements Specification Document Use Case Model Use Cases Responsible Role Tools and Websites IBM Rational RequisitePro Standards None Listed More Info None Listed Process Activity Name: RQE-4 Document Nonfunctional Requirements RQE-4 Document Use Case Scenarios Or RQE-6.2 Manage User Stories RQE-5 Create Requirements Traceability Matrix The updates the Requirements Specification Document with any additional nonfunctional requirements that have been identified while creating use cases. Artifacts Used Requirements Specification Document Use Case Model 13

16 Artifacts Created Updated Requirements Specification Document Responsible Role Tools and Websites IBM Rational RequisitePro Standards VA EA Enterprise Technical Architecture (ETA) Compliance Criteria More Info The VA EA Enterprise Technical Architecture (ETA) Compliance Criteria document establishes minimum compliance criteria for a product or product release. Process Activity Name: RQE-5 Conduct Agile Story Management RQE-1-DEC01 Agile Related? RQE-6 Create Requirements Traceability Matrix The process map for RQE-5 Conduct Agile Story Management cycles through the following dependent activities: RQE-5.1 Manage Epic Stories RQE-5.2 Manage User Stories Process Activity Name: RQE-5.1 Manage Epic Stories RQE-1-DEC01 Agile Related? RQE-5.2 Manage User Stories The manages Epic stories which are user stories whose scope is so large as to make them difficult to complete in a single iteration or accurately estimate the level of effort to deliver. Epic stories are decomposed into smaller user stories where the requirements of the story are defined much more narrowly in scope. 14

17 Artifacts Used Business Requirements Document Requirements Specification Document Stakeholder Feedback Artifacts Created Agile Epic Story log Responsible Role Tools and Websites IBM Rational Team Concert/Change and Configuration Management (RTC/CCM) VA Agile/Lean Community of Practice (ALCP) Web Site Standards Agile Methodology and ProPath guidance paper More Info Process Activity Name: RQE-5.2 Manage User Stories RQE-6.1 Manage Epic Stories RQE-6 Create Requirements Traceability Matrix The manages User Stories. User Stories are simple, brief and concise statements which describe requirements from a user's perspective to capture and communicate customer requirements. User stories could be defined by decomposing an Epic, requirements from Business Requirements Document or Requirements Specification Document, or feedback from the project s stakeholders. A user story should be Independent, Negotiable, Valuable, Estimable, Small, and Testable (INVEST). A recommended format for a user story is: As a (user role), I would like (statement of need), so that I can (desired benefit) User stories are associated with Tasks which become the work items to accomplish a user story (i.e., a user story may be associated with several tasks.) Artifacts Used Agile Epic Story Log Business Requirements Document Requirements Specification Document 15

18 Stakeholder Feedback Artifacts Created Agile Task Item Log Agile User Story Log Responsible Role Tools and Websites IBM Rational Team Concert/Change and Configuration Management (RTC/CCM) VA Agile/Lean Community of Practice (ALCP) Web Site Standards Agile Methodology and ProPath guidance paper More Info Process Activity Name: RQE-6 Create Requirements Traceability Matrix RQE-4 Document Nonfunctional Requirements Or RQE-5.2 Manage User Stories None The generates the Requirements Traceability Matrix in the project's IBM Rational RequisitePro project. Development teams that do not have access to automated tools should use the Requirements Traceability Matrix template. Artifacts Used Business Requirements Document Requirements Specification Document Artifacts Created Requirements Traceability Matrix 16

19 Responsible Role Tools and Websites IBM Rational RequisitePro Standards Section 508 Standards Checklists, and Document Applications Checklists More Info None Listed END OF PROCESS 17