A unified model for the implementation of both ISO 9001:2000 and CMMI by ISO-certified organizations

Transcription

1 The Journal of Systems and Software 79 (2006) A unified model for the implementation of both ISO 9001:2000 and CMMI by ISO-certified organizations Chanwoo Yoo a, *, Junho Yoon a, Byungjeong Lee b, Chongwon Lee a, Jinyoung Lee a, Seunghun Hyun a, Chisu Wu a a SE Lab, School of Computer Science and Engineering, Seoul National University, Seoul , South Korea b School of Computer Science, University of Seoul, Seoul , South Korea Received 6 December 2004; accepted 20 June 2005 Available online 24 January 2006 Abstract ISO 9001 is a standard for quality management systems and CMMI is a model for process improvement. If an ISO-certified organization wishes to improve its processes continuously, implementing CMMI would be a good choice, as it provides more detailed practices for process improvement than the ISO standards. However, there are two issues that need to be resolved when an ISO-certified organization implements CMMI. First, it is not easy to identify any reusable parts of the ISO standards, and it would be advantageous to be able to reuse selected portions of the ISO standards during CMMI adoption in order to use existing resources to their best advantage. Second, it is difficult for an ISO-certified organization to implement CMMI in a straightforward, easy manner because of the differences in the language, structure, and details of the two sets of documents. In this paper, we present our unified model for ISO 9001:2000 and CMMI that resolves these two issues. Our model would be an extremely useful tool for ISO-certified organizations that plan to implement CMMI. Ó 2005 Elsevier Inc. All rights reserved. Keywords: ISO 9001:2000; CMMI; Mapping; Unified model 1. Introduction ISO 9001:2000 requires that an organization s processes undergo continuous improvement even after ISO certification has been achieved. CMMI provides an organization with a means to accomplish further process improvement. CMMI is a very detailed set of documents that contain many more of the basic concepts for process improvement than can be found in ISO 9001:2000. In the past, several ISO 9001:2000-certified organizations have * Corresponding author. Tel.: ; fax: addresses: chanwoo@selab.snu.ac.kr (C. Yoo), Junoyoon@ selab.snu.ac.kr (J. Yoon), bjlee@venus.uos.ac.kr (B. Lee), ljw@selab. snu.ac.kr (C. Lee), jylee@selab.snu.ac.kr (J. Lee), shhyun@selab.snu. ac.kr (S. Hyun), wuchisu@selab.snu.ac.kr (C. Wu). attempted to embrace CMMI concepts by implementing SW-CMM, which is only one part of the CMMI set of documents (Mutafelija and Stromberg, 2003b; Paulk et al., 1995). To implement CMMI in an ISO-certified organization efficiently and effectively, both the common and different parts of the ISO standards and CMMI documents must be identified. ISO 9001:2000 requirements can be mapped to CMMI practices (Mutafelija and Stromberg, 2003a,b). However, the following limits have been identified in this mapping process: First, a requirement of ISO 9001:2000 can be mapped to many CMMI practices. Conversely, a CMMI practice can be mapped to many ISO 9001:2000 requirements. These mappings are useful for comparing these two frameworks, but they may cause confusion during the decision-making process /$ - see front matter Ó 2005 Elsevier Inc. All rights reserved. doi: /j.jss

2 C. Yoo et al. / The Journal of Systems and Software 79 (2006) Second, it is difficult for organizations to understand and apply these mappings during CMMI implementation because they only describe the degree of the correlation between ISO and CMMI without providing any explanation of these mappings. Third, the mappings do not describe CMMI from an ISO viewpoint. The structure and words that are used by CMMI are not familiar to ISO-certified organizations, which makes it more complicated for an ISO-certified organization to implement CMMI. This paper proposes a model in which the contents of ISO and CMMI are unified. Our unified model provides a solution that allows us to deal with the limitations noted above. The remainder of this paper is organized as follows: Section 2 gives a brief explanation of ISO 9001:2000 and CMMI. Section 3 discusses related works. Section 4 presents our unified model of ISO 9001:2000 and CMMI. Section 5 compares our model with related works. Finally, Section 6 provides our conclusions. 2. ISO 9001:2000 and CMMI 2.1. ISO 9001:2000 ISO 9001:2000 is a necessary requirement for a quality management system. It is a part of the ISO 9000 family that consists of ISO 9000 (Fundamentals and Vocabulary) (ISO, 2000a; Ketola and Roberts, 2000), ISO 9001 (Requirements) (ISO, 2000c), ISO 9004 (Guidelines for Performance Improvements) (ISO, 2000b), and ISO (Guidelines for Quality and Environmental Management Systems Auditing). ISO 9001:2000 is an abstract and is a sparse document that can be applied to any category of business. When it is to be applied to organizations in the software industry, ISO 9001 can be further interpreted by using either ISO (ISO, 1997) or TickIT (British Standards Institute, 2001). To achieve an ISO certification, organizations must be compliant with every clause of ISO 9001:2000 (Cianfrani et al., 2001). Compared with ISO 9001:2000, ISO 9004:2000 is not a requirements document. Rather, it is a document that provides guidance for further process improvement. ISO 9001:2000 and ISO 9004:2000 are similar in terms of both the structure and terminology that they use in order to facilitate their application as a consistent pair (ISO, 2000b; ISO, 2000c) of standards CMMI Capability Maturity Model Integration (CMMI) is an integrated model of many Capability Maturity Models that consist of best process practices (Chrissis et al., 2003). CMMI has 25 process areas (PA). A process area is a set of practices in specific areas which, when implemented collectively, satisfy a set of goals, resulting in a considerable improvement in that area. (CMMI Product Team, 2001a,b). Goals are classified as generic and specific goals. A generic goal (GG) describes the characteristics that must be implemented to adopt the processes that will satisfy a process area. A specific goal (SG) describes the characteristics that must be implemented to satisfy the process area. Practices are expected components for achieving goals. Practices are classified as generic and specific practices. A generic practice (GP) is an essential activity for achieving the associated generic goal. A specific practice (SP) is an essential activity for achieving the associated specific goal. 3. Related works Only a few studies have compared ISO 9001:2000 and CMMI (Mutafelija, 2001; Mutafelija and Stromberg, 2003a,b; Stromberg and Mutafelija, 2002) compared with the number of studies comparing ISO 9001:1994 and SW- CMM (Bamford and Deibler, 1993; Jalote, 1999; Paulk, 1993, 1994, 1995). Since the latter set of studies provides strong hints that are useful for understanding the relationships between ISO 9001:2000 and CMMI, we present some of these related studies below. Paulk (1993, 1994, 1995) compared ISO 9001:1994 with SW-CMM to answer the following questions: What is an appropriate CMM level for an ISO 9001-compliant organization? Can a CMM level 2 (or 3) organization be considered compliant with ISO 9001? Should software quality management and process improvement efforts be based on ISO 9001 or CMM? This study showed that SW-CMM has more requirements than ISO 9001:1994 when ISO 9001:1994 is mapped to SW-CMM. It further stated that an ISO 9001:1994-compliant organization would satisfy most of the level 2 and many of the level 3 goals of SW-CMM. Jalote (1999) proposed a way for transitioning from ISO 9001:1994 to SW-CMM level 4, based on an actual organization s transitioning experience. He pointed out that a simple mapping between ISO 9001:1994 and SW-CMM is not helpful to field staff. Furthermore, it is useful to describe what additional actions must be accomplished for a typical ISO 9001-compliant organization that is transitioning to SW-CMM. Studies have examined simultaneous implementations of ISO and CMMI with a view to achieving a synergy between them (Mutafelija, 2001; Mutafelija and Stromberg, 2003a,b; Stromberg and Mutafelija, 2002). These studies stated that organizations at CMMI level 3 will be ready for ISO 9001:2000 certification with only minor adjustments. Consequently they proposed a method to implement both frameworks by initially implementing CMMI and adding further requirements for ISO 9001:2000. Since they used CMMI to interpret ISO, this method is better suited to a CMMI organization that is adopting ISO 9001:2000 than it is to an ISO-certified organization that is adopting CMMI.

3 956 C. Yoo et al. / The Journal of Systems and Software 79 (2006) Table 1 Mapping ISO 9001:2000 to CMMI (Mutafelija and Stromberg, 2003a) ISO 9001:2000 CMMI PA CMMI practice Strength Comments 7.0 Product realization 7.1 Planning product realization Develop needed processes OPD SP 1.1, 1.2, 1.2 S Planning is consistent with other processes OPD ALL SP 1.1 GP 2.2, 3.1 S Address objectives and verification QPM PP SP 1.1 SP 1.1, 1.2, 1.3, 1.4, 2.1, 2.2, 2.3, 2.4, 2.5, 2.6, 2.7 S SP are not specifically required Plans in appropriate format PP IPM SP 2.7 SP 1.1, 1.3, 1.4 S S strong match; M medium match; W weak match. Table 2 Mapping CMMI to ISO 9001:2000 (Mutafelija and Stromberg, 2003a) Goal Specific practice Description ISO 9001:2000 Organizational process focus SG 1 Determine process-improvement opportunities SP Establish organizational process needs 5.3, 5.4.1, 5.5.3, 5.6.1, 8.2.2, SP Appraise the organization s processes 5.6.1, SP Identify the organization s process improvements 8.4, Requirements development SG 1 Develop customer requirements SP Collect stakeholder needs 5.2, 7.2.1, 7.3.2, 8.4 SP Elicit needs 5.2, 7.2.1, 7.2.2, 7.3.2, 8.4 They have also developed a mapping between ISO 9001:2000 and CMMI (Mutafelija and Stromberg, 2003a,b). Table 1 shows a mapping from each ISO 9001:2000 section to CMMI. The mapping is done at the shall-level. All in the PA column means that the identified GPs in every PA correspond to that ISO statement. A judgment of the strength of the correspondence is shown as: S, M, and W in the Strength column of Table 1 represent strong, medium and weak matches, respectively. Table 2 shows the per-pa mapping from CMMI to individual ISO sections. The mapping from CMMI to ISO was built simply from an ISO to CMMI mapping rather than from an independent analysis. 4. Unified model Our model unifies ISO requirements and CMMI content. Our unification is accomplished by adding CMMI practices to ISO requirements or by adjusting ISO requirements so that they better represent the contents of CMMI practices. Our unified model overcomes the following limits of existing mappings: (1) The confusion that is caused by many-to-many mappings. The mapping shown in Table 2 shows that one practice corresponds to many examples of ISO contents. Our proposed model aims to make this correspondence clear and concise. Our model determines the one requirement among the many ISO requirements that is most related to a specific CMMI practice. Then, we adjust the mapping table (Mutafelija and Stromberg, 2003a) of the existing research to define the mapping of our unified model. Moreover, the many practices of a CMMI process area are dispersed and they correspond to many of the ISO requirements in Table 2. However, the CMMI practices must be mapped to these requirements in order, since dependencies exist between them. If we do not acknowledge these dependencies that exist among CMMI practices, it might be difficult to interpret and apply our model. Therefore, all of the dependent practices have been mapped to the most closely related part of the ISO requirements. The dependencies among practices were identified using the SEI CMMI tutorial (Phillips, 2003). After developing the correspondence types for our unified model, CMMI practices were unified to ISO 9001:2000 shall statements in accordance with Table 3. (2) There is no explanation. The explanation of how to associate ISO and CMMI statements is useful for organizations to be able to understand and apply our model in a practical manner. It is impossible to prove that the mapping is perfect because it is likely to be subjective according to individual s interpretations of the ISO and CMMI documents. However, if the mapping is accompanied by an explanation of how the contents of ISO and CMMI documents were interpreted and related, it can be rationalized.

4 C. Yoo et al. / The Journal of Systems and Software 79 (2006) Table 3 Method for unifying classifications according to their correspondence type Correspondence types Method for unification If ISO 9001:2000 shall-statements (requirements) ISO 9001:2000 shall-statements are maintained. fully satisfy a CMMI practice The relationships between the ISO requirement and CMMI are recorded If ISO 9001:2000 shall-statements (requirements) partially satisfy a CMMI practice If there are no ISO 9001:2000 shall-statements (requirements) that satisfy a CMMI practice ISO shall-statements are modified. The modified parts are represented by square brackets ([ ]). The relationships between the ISO requirement and CMMI are recorded CMMI practices are inserted into the appropriate position in the model. The relationships between the ISO requirement and CMMI are recorded (3) There are structural differences. Since the words and structures that are used in CMMI documents are different from those that are used in ISO documents, they will be unfamiliar to organizations that are used to using ISO documents. Conversely, it is straightforward to apply ISO 9004:2000 to improve a quality system because ISO 9004:2000 uses the same words and structures as ISO 9001:2000 ISO (2000b), ISO (2000c). Therefore, if CMMI is interpreted to be an expanded form of ISO 9001:2000, it would be easier for ISO-certified organizations to implement CMMI. We cannot show our complete unified model here due to the limited amount of space available. However, Table 4 does present a summary by giving an approximation of the structure of our unified model. Our model follows the same structure as ISO 9001:2000. The granularity of the model The granularity of our unified model is another issue. CMMI states that a process area is satisfied only when all the goals in the process area are satisfied. However, goals are generally satisfied when each corresponding practice is implemented (CMMI Product Team, 2001c). Besides, if the goals in CMMI are selected for the granularity of the unified model, then the relationship between ISO 9001:2000 and CMMI would All Match (Mutafelija and Stromberg, 2003b). Therefore, unification is conducted practice level of CMMI and the shall statements level of ISO. The form of the model The unified model is organized as shown in Table 5. The Unified Model column in Table 5 shows the contents of the model, a combination of CMMI practices and ISO shall statements. The ISO and CMMI columns indicate whether the content of the Unified Model column has any correspondence to ISO or CMMI. The Explanation column describes the relationship between ISO shall statements and CMMI practices. Advice for adopting CMMI is also added. The shading in the CMMI column indicates that ISO has a correspondence to OPD SP 1.5-1, IPM SP 1.5-1, and GP 3.2, and has no correspondence to ISO. We can see is inserted as practices from CMMI. As shown in Table 5, ISO has a correspondence to both ISO and CMMI RD SPs. The square brackets indicate a modification to reflect CMMI practices. Tips for applying the model ISO-certified organizations might implement more requirements than ISO 9001:2000 demands. Therefore, an organization should accurately evaluate the process status of its organization first. Our unified model includes CMMI practices that are inserted into an appropriate position. However, because of the differences between ISO 9001:2000 and CMMI, the following will need to be considered. The primary goal of a process area of a technical solution is to identify and implement solutions about the product and the product components. However, it can also be applied to selecting and applying processes that are related to products. The practices of the process area of a technical solution are inserted into the design and development clauses in ISO 9001:2000 as its primary goal. For an organizational training process area, the ISO 9001:2000 view differs from the CMMI view. While ISO 9001:2000 focuses on the competencies of people related to products, CMMI focuses on how to provide education at an organizational level. Organizations should consider these differences. The expected effect The unified model should be useful to ISO-certified organizations that plan to implement CMMI in two ways. First, it should be useful for completing the necessary gap analysis during the implementation of CMMI. Since the model has the same structure as ISO, ISO-certified organizations should have no difficulty in perceiving the gap between the status of the organization according to ISO 9001:2000 and CMMI as demonstrated by our unified model. Second, it will help in the writing of complete quality manuals. A quality manual contains the contents of the quality management system that is used within an organization (Hoyle, 2001). When CMMI is adopted by an organization, process changes will need to be reflected in the organization s quality documentation. As the structure of

5 958 C. Yoo et al. / The Journal of Systems and Software 79 (2006) Table 4 Structure of the unified model Unified model s contents CMMI Unified model s contents CMMI 4 Quality management system Establishing design and development plan GP 3.1, PP, IPM 4.1 General requirements GP2.1, 2.2, 2.3, 2.4, 2.5, Team composition and operation IPM, IT, OEI 2.6, 2.8, 2.9, 2.10, 3.1, Documentation requirements Risk management RSKM General OPD Design and development inputs Quality manual OPD 7.3.A. Design and development process Organization s set of standard process OPD, GP A.1 Design and development IPM, REQM process management Organization s set of standard process OPD, GP A.2 Technical solution TS tailoring criteria and guidelines Control of documents IPM, GP A.3 Product integration PI Control of records Design and development review PMC, RSKM, IPM Process assets management OPD, IPM, GP Design and development verification VER Measurement management OPD Design and development validation VAL 4.3 Decision analysis and resolution DAR Control of design and CM development changes 5 Management responsibility 7.4 Purchasing 5.1 Management commitment GP 2.10, OEI Purchasing process SAM, ISM 5.2 Customer focus Purchasing information 5.3 Quality policy GP Verification of purchased product SAM, ISM 5.4 Planning 7.5 Production and service provision Quality objectives OPF Control of production and service provision Quality management system planning Validation of processes for production the service provision 5.5 Responsibility, authority Identification and traceability CM, GP 2.6 and communication Responsibility and authority GP Customer property Management representative Preservation and delivery of product PI Internal communication 7.6 Control of monitoring and measuring devices 5.6 Management review 8 Measurement, analysis and improvement General GP General Review input GP Monitoring and measurement MA Review output GP Customer satisfaction 6 Resource management Internal audit OPF, GP 2.9, PPQA 6.1 Provision of resources GP Quantitative project management QPM 6.2 Human resources Monitoring and measurement MA, GP 2.8, QPM of processes General GP Monitoring and measurement MA, QPM of product Competence, awareness OT, OEI, GP Control of nonconforming product and training 6.3 Infrastructure GP Analysis of data MA, OPP 6.4 Work environment OEI 8.4.A Measurement management OPF, MA 7 Product realization 8.5 Improvement 7.1 Planning of product realization GP Continual improvement OPF 7.2 Customer-related processes Selecting improvements OID Determination of requirements RD Deploying improvements OID related to the product Review of requirements to the product RD, REQM Casual Analysis and Resolution CAR Customer communication GP Corrective action OPF, CAR 7.3 Design and development Preventive action CAR Design and development planning GG 2, PP, GP 2.4, OEI the quality manual is generally the same as ISO 9001:2000, it will be easy to reflect these changes in an organization s quality manual by using our unified model, which is written using the same structure as ISO 9001:2000. Therefore, organizations should easily be able to distinguish what is in our unified model, but not in their quality manual. An example of writing a complete quality manual using our unified model can be described as follows. Table 6 shows clause 4.3 in our unified model. This clause contains the contents of the DAR process area in CMMI. It is not contained in ISO 9001:2000. Organizations can add this clause next to clause 4.2 in their quality manual, as shown in Table 7.

6 C. Yoo et al. / The Journal of Systems and Software 79 (2006) Table 5 Partial example of the unified model Unified model ISO CMMI Explanation Process assets management Organizations shall establish and maintain process asset libraries that contain a quality management system, measurements, documents, and records Organizations shall make work products, measurements, improvement instruction, and documented experiences derived from organizational activities to be contained in process asset libraries for continuous contribution to process assets Determination of requirements related to the product The organization shall [elicit] and determine (a) [needs] and requirements specified by the customer, including the requirement for delivery and post-delivery activities, (b) [needs] and requirements not stated by the customer but necessary for specified or intended use, where known, (c) statutory and regulatory requirements related to the product, and (d) any additional requirements determined by the organization OPD SP Organizations shall add data derived from projects or organizational process execution to process assets continuously IPM SP GP 3.2 This satisfies IPM SP and GP 3.2 RD SG1 RD SP RD SP RD SP and of ISO have the same objective of RD PA. ISO certified organizations generally satisfy RD SG1. However, RD SG 2 can be a difference between ISO and CMMI. The organization shall ensure that RD SG 2 is satisfied Table 6 Clause 4.3 of our unified model 4.3 Decision analysis and resolution An organization shall perform decision analysis and resolution for critical decision items Selecting decision items shall conform to documented guidelines Selected decision items shall be evaluated using evaluation criteria; appropriate alternatives shall be selected by evaluation results Decision analysis and resolution shall contain next activities (a) Establishing and maintaining criteria for evaluating alternatives and the relative importance of criteria (b) Identifying alternative solutions treating problems (c) Selecting evaluation methods (d) Evaluating alternative solutions using established criteria and methods (e) Selecting a solution from alternatives based on evaluation criteria Table 7 Example of a quality manual corresponding to Clause 4.3 in our unified model 4.3 Decision analysis and resolution Each chief of department guarantees that formal decision analysis is performed for every important decision item Each chief of department guarantees that selected decision items are evaluated using evaluation criteria; appropriate alternatives are selected by evaluation results Selecting decision items conforms to guidelines for selecting decision items Decision analysis and resolution conform to decision analysis and resolution guidelines Related documents (1) Decision analysis and resolution procedure documents (2) Guidelines for selecting decision items 5. Comparisons In this section, we compare our model with other models with respect to reliability, resource efficiency, and mapping complexity. There are two types of error in the mappings between ISO 9001:2000 and CMMI. Type-I error: an error that regards a true correspondence as invalid (including an error that regards common parts as new parts). Type-II error: an error that regards a false correspondence as valid (including an error that regards new parts as common parts). If the number of type-i errors increases, the number of ISO assets available for reuse by an organization decreases. In other words, an increase in type-i errors results in a decrease in the cost savings that could be realized by reusing resources. By contrast, a type-ii error affects the reliability of the mapping. While an increase in type-i errors demands

7 960 C. Yoo et al. / The Journal of Systems and Software 79 (2006) Table 8 The number of links according to each correspondence type of our unified model (UM) Set A B C Total The number of links % Table 9 The number of links according to each correspondence type of an existing mapping (EM) (Mutafelija and Stromberg, 2003a) Set D E Total The number of links % additional organizational effort, type-ii errors cause organizations to omit items that should have been implemented. The reliability of the mapping is in inverse proportion to the probability of a type II error. A correspondence between ISO 9001:2000 and CMMI can be represented as a link between them. Let us assume that there is a set of links from CMMI practices to ISO 9001:2000 requirements. Since one CMMI practice can be mapped to many requirements in ISO 9001:2000, one practice can have many links. The number of links for each set is shown in Tables 8 and 9. A: A set of correspondence links from a CMMI practice to ISO requirements that fully satisfy the CMMI practice. B: A set of correspondence links from a CMMI practice to ISO requirements that partially satisfy the CMMI practice. C and E: A set of CMMI practices that have no correspondence links to ISO requirements. D: A set of correspondence links from a CMMI practice to ISO requirements that either fully or partially satisfy a CMMI practice. As mentioned before, our model only defines mappings with a strong correlation between ISO 9001:2000 and CMMI from the mappings of existing studies. This can be represented as the union of A and B. Otherwise; the mappings are not suitable for reuse. This can be represented as C. We can now state that the union of A and B is a subset of D and C is a superset of E. Therefore, the probability that the union of A and B contains any link that is not contained in D is zero. Since the probability of a type-ii error in UM is less than or equal to that of EM, the reliability of UM is greater than or equal to that of EM. Now, it can be assumed that EM is reliable, since EM has been determined separately and independently by several colleagues with a great deal of experience in process improvement. Having said that, we can now state with reasonable certainty that UM is also reliable. We noted that 161 practices in UM and 48 practices in EM include new parts. Consequently, one might assume that the reusability of UM might seem to be less than that of EM. However, because set D contains more links than the union of A and B, D might cause confusion. Considering the costs involved in a decision making process, it is difficult to say which is better. In the previous section, we have tried to reduce the complexity of the mapping by making the correspondence clear and concise, which should help in the decision-making process. Comparing the union of A and B with D, it can be seen that the mapping complexity of UM is much less than that of EM. 6. Conclusion This paper has presented our unified model of ISO 9001:2000 and CMMI. Our model has the potential to help ISO-certified organizations implement CMMI. Our model describes the correspondence that exists between CMMI and ISO 9001:2000, which can be useful in the decisionmaking process. Furthermore, it gives explanations to help elucidate the application of our model in the implementation of CMMI by an ISO-certified organization. It also uses a structure that is familiar to ISO-certified organizations. It assists organizations to perform the necessary gap analysis and to maintain their quality documentation without any further difficulty when they adopt CMMI. Finally, an organization will be able to implement ISO 9001:2000 and CMMI simultaneously by applying our model, even if the organization does not have an ISO certification. In the future, we will evaluate this model empirically to confirm its efficiency in the implementation process. References Bamford, R.C., Deibler II, W.J., Comparing, contrasting ISO 9001 and the SEI capability maturity model. IEEE Computer 26 (10), British Standards Institute, Department of Trade and Industry, The TickIT Guide Issue 5, London-DISC TickIT Office. Chrissis, M.B., Konrad, M., Shrum, S., CMMI Guidelines for Process Integration and Product Improvement. Addison-Wesley. Cianfrani, C.A., Tsiakals, J.J., West, J.E., ISO 9001:2000 Explained, second ed. ASQ Quality Press, Milwaukee, WI. CMMI Product Team, 2001a. Capability Maturity Model Integration (CMMI), v1.1, Staged Representation, CMU/SEI-2002-TR-004, Software Engineering Institute, Pittsburgh, PA. CMMI Product Team, 2001b. Capability Maturity Model Integration (CMMI), v1.1, Continuous Representation, CMU/SEI-2002-TR-003, Software Engineering Institute, Pittsburgh, PA. CMMI Product Team, 2001c. Standard CMMI Appraisal Method for Process Improvement (SCAMPI), Version 1.1: Method Definition Document, CMU/SEI-2001-HB-001, Software Engineering Institute. Hoyle, D., ISO 9000, Quality Systems Handbook, fourth ed. Butterworth-Heineman, Woburn, MA. ISO, Quality management and quality assurance standards. Part 3: Guidelines for the application of ISO 9001:1994 to the development, supply, installation and maintenance of computer software, ISO/IEC ISO, 2000a. Quality Management Systems Fundamentals and Vocabulary, ISO 9000:2000. ISO, 2000b. Quality Management Systems Guidelines for Performance Improvements, ISO 9004:2000.

8 C. Yoo et al. / The Journal of Systems and Software 79 (2006) ISO, 2000c. Quality Management Systems Requirements, ISO 9001: Jalote, P., CMM in Practice: Processes for Executing Software Projects at Infosys. The SEI Series in Software Engineering. Addison- Wesley. Ketola, J., Roberts, K., ISO 9000:2000 in a Nutshell. Patton Press, Chico, CA. Mutafelija, B., Software Process Improvement: Synergy Between ISO 9001:2000 and CMMI, SERG Conference, New Orleans, LA. Mutafelija, B., Stromberg, H., 2003a. Mappings of ISO 9001:2000 and CMMI Version 1.1. Available from: < adoption>. Mutafelija, B., Stromberg, H., 2003b. Systematic Process Improvement Using ISO 9001:2000 and CMMI, Artech House. Paulk, M.C., Comparing ISO 9001 and the capability maturity model for software. Software Quality Journal 2 (4), Paulk, M.C., A Comparison of ISO 9001 and the capability maturity model for software, Software Engineering Institute, CMU/SEI-94-TR- 12. Paulk, M.C., How ISO 9001 compares with the CMM. IEEE Software 12 (1), Paulk, M.C., Weber, C.V., Curtis, B., The Capability Maturity Model for Software. Addison-Wesley. Phillips, M., CMMI V 1.1 Tutorial, CMU, SEI. Stromberg, H., Mutafelija, B., Using the CMMI When Implementing ISO 9001:2000 for Software, SERG Conference, Phoenix, AZ. Chanwoo Yoo received his B.S. degrees in Computer Science and Engineering from Seoul National University in He also received the B.S. degrees in Business Administration from Seoul National University in the same year. He is currently under a combined master s-doctoral program. His current research interests include software process improvement and software cost estimation. Junho Yoon received his B.S. degrees in Computer Science and Engineering from Chung-Ang University in 2001 and his M.S. degrees in Computer Science and Engineering from Seoul National University in Currently, he is in Samsung Electronics Software Center. His current interests include software architecture and embedded software. Byungjeong Lee received his B.S., M.S., and Ph.D. degrees in Computer Science from Seoul National University, Korea in 1990, 1998, and 2002, respectively. He was a research member at the Software Lab. of Hyundai Electronics Corp. from 1990 to Currently, he is an assistant professor of Computer Science at the University of Seoul, Korea. His current research interests include software restructuring, software metrics, and software reuse. Chongwon Lee received his B.S. in Information and Industrial Engineering from Yonsei University in 2001 and his M.S. in Computer Science and Engineering from Seoul National University in He is currently a PhD candidate in the School of Computer Science and Engineering at Seoul National University. His current research interests include software testing and software certification. Jinyoung Lee received his B.S., M.S. degrees in Computer Science from Seoul National University in 1991 and 1996, respectively. He is currently a public servant in ministry of information and communication republic of Korea and a PhD candidate in the School of Computer Science and Engineering at Seoul National University. His current interests include software process improvement and software cost estimation. Seunghun Hyun received his B.S., M.S. degrees in Computer Science and Engineering from Seoul National University in 2003 and His current interests include software testing and software certification. Chisu Wu received his B.E. degree in applied mathematics from Seoul National University, Korea in 1972 and his M.S. and Ph.D. degrees in Computer Science from Seoul National University in 1977 and 1982, respectively. He served as a researcher at the Loughborough University, UK in From 1975 to 1982, he was an associate professor of Computer Science at Ulsan University, Korea. Currently, he is a professor of Computer Science and Engineering at Seoul National University, Korea. His current research interests include software engineering and programming languages.