Nederlandse praktijkrichtlijn

Transcription

1 Dit document mag slechts op een stand-alone PC worden geinstalleerd. Gebruik op een netwerk is alleen. toestaan als een aanvullende licentieovereenkomst voor netwerkgebruik met NEN is afgesloten. This document may only be used on a stand-alone PC. Use in a network is only permitted when a supplementary license agreement for us in a network with NEN has been concluded. Nederlandse praktijkrichtlijn NPR-ISO/IEC TR (en) Systems engineering - Guidelines for the application of ISO 9001 to system life cycle processes (ISO/IEC TR 90005:2008,IDT) ICS ; augustus 2008

2 NPR-ISO/IEC TR Als Nederlandse praktijkrichtlijn is aanvaard: - ISO/IEC TR 90005:2008,IDT Normcommissie "Programmatuurtechniek" Apart from exceptions provided by the law, nothing from this publication may be duplicated and/or published by means of photocopy, microfilm, storage in computer files or otherwise, which also applies to full or partial processing, without the written consent of the Netherlands Standardization Institute. The Netherlands Standardization Institute shall, with the exclusion of any other beneficiary, collect payments owed by third parties for duplication and/or act in and out of law, where this authority is not transferred or falls by right to the Reproduction Rights Foundation. Auteursrecht voorbehouden. Behoudens uitzondering door de wet gesteld mag zonder schriftelijke toestemming van het Nederlands Normalisatie-instituut niets uit deze uitgave worden verveelvoudigd en/of openbaar gemaakt door middel van fotokopie, microfilm, opslag in computerbestanden of anderszins, hetgeen ook van toepassing is op gehele of gedeeltelijke bewerking. Het Nederlands Normalisatie-instituut is met uitsluiting van ieder ander gerechtigd de door derden verschuldigde vergoedingen voor verveelvoudiging te innen en/of daartoe in en buiten rechte op te treden, voor zover deze bevoegdheid niet is overgedragen c.q. rechtens toekomt aan de Stichting Reprorecht. Although the utmost care has been taken with this publication, errors and omissions cannot be entirely excluded. The Netherlands Standardization Institute and/or the members of the committees therefore accept no liability, not even for direct or indirect damage, occurring due to or in relation with the application of publications issued by the Netherlands Standardization Institute. Hoewel bij deze uitgave de uiterste zorg is nagestreefd, kunnen fouten en onvolledigheden niet geheel worden uitgesloten. Het Nederlands Normalisatie-instituut en/of de leden van de commissies aanvaarden derhalve geen enkele aansprakelijkheid, ook niet voor directe of indirecte schade, ontstaan door of verband houdend met toepassing van door het Nederlands Normalisatie-instituut gepubliceerde uitgaven Nederlands Normalisatie-instituut Postbus 5059, 2600 GB Delft Telefoon (015) , Fax (015)

3 TECHNICAL REPORT ISO/IEC TR First edition Systems engineering Guidelines for the application of ISO 9001 to system life cycle processes Ingénierie des systèmes Lignes directrices pour l'application de l'iso 9001 aux processus de cycle de vie des systèmes Reference number ISO/IEC TR 90005:2008(E) ISO/IEC 2008

4 ISO/IEC TR 90005:2008(E) NPR-ISO/IEC TR 90005:2008 PDF disclaimer This PDF file may contain embedded typefaces. In accordance with Adobe's licensing policy, this file may be printed or viewed but shall not be edited unless the typefaces which are embedded are licensed to and installed on the computer performing the editing. In downloading this file, parties accept therein the responsibility of not infringing Adobe's licensing policy. The ISO Central Secretariat accepts no liability in this area. Adobe is a trademark of Adobe Systems Incorporated. Details of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below. COPYRIGHT PROTECTED DOCUMENT ISO/IEC 2008 All rights reserved. Unless otherwise specified, no part of this publication may be reproduced or utilized in any form or by any means, electronic or mechanical, including photocopying and microfilm, without permission in writing from either ISO at the address below or ISO's member body in the country of the requester. ISO copyright office Case postale 56 CH-1211 Geneva 20 Tel Fax copyright@iso.org Web Published in Switzerland ii ISO/IEC 2008 All rights reserved

5 ISO/IEC TR 90005:2008(E) Contents Foreword...iv Introduction...v 1 Scope Purpose Field of Application Limitations Terms and definitions System Life Cycle Guidelines ISO 9001 Sections not yet invoked in Table Bibliography Page ISO/IEC 2008 All rights reserved iii

6 ISO/IEC TR 90005:2008(E) NPR-ISO/IEC TR 90005:2008 Foreword ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work. In the field of information technology, ISO and IEC have established a joint technical committee, ISO/IEC JTC 1. International Standards are drafted in accordance with the rules given in the ISO/IEC Directives, Part 2. The main task of the joint technical committee is to prepare International Standards. Draft International Standards adopted by the joint technical committee are circulated to national bodies for voting. Publication as an International Standard requires approval by at least 75 % of the national bodies casting a vote. In exceptional circumstances, the joint technical committee may propose the publication of a Technical Report of one of the following types: type 1, when the required support cannot be obtained for the publication of an International Standard, despite repeated efforts; type 2, when the subject is still under technical development or where for any other reason there is the future but not immediate possibility of an agreement on an International Standard; type 3, when the joint technical committee has collected data of a different kind from that which is normally published as an International Standard ( state of the art, for example). Technical Reports of types 1 and 2 are subject to review within three years of publication, to decide whether they can be transformed into International Standards. Technical Reports of type 3 do not necessarily have to be reviewed until the data they provide are considered to be no longer valid or useful. Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO and IEC shall not be held responsible for identifying any or all such patent rights. ISO/IEC TR 90005, which is a Technical Report of type 3, was prepared by Joint Technical Committee ISO/IEC JTC 1, Information technology, Subcommittee SC 7, Software and systems engineering. iv ISO/IEC 2008 All rights reserved

7 ISO/IEC TR 90005:2008(E) Introduction This Technical Report has been prepared based on a number of concepts. 1. Enterprise versus Project ISO/IEC uses the term Enterprise to represent the organization within which projects are conducted using the system life cycle processes defined. It mainly considers the processes that provide support and resources to projects rather than an exhaustive set of processes that cover all aspects of the organization's business. ISO 9001:2000 does not use the term project but focuses on what an organization needs to do to satisfy customer requirements through product realization. It is possible to interpret a project in ISO 9001:2000 as either instantiated through the management processes or as an instance of product realization. This Technical Report therefore includes references to Clause 5 (Management in ISO 9001:2000) and Clause 7 (Product realization) in many cases as alternative ways to interpret ISO 9001: Rationale & Explanation Each activity in ISO/IEC is discussed in terms of how it relates to sections of ISO 9001:2000. In many cases there is not a single section of ISO 9001 but a combination of sections that cover this relationship. Where possible only the sentence or sentences that deal with the relationship are stated rather than the complete section or clause from ISO 9001:2000. However, the reference to an ISO 9001:2000 clause number is normally to a complete clause unless a precise bullet or subclause covers the requirement explicitly. 3. Outcomes Since for the most part ISO 9001:2000 does not cover outcomes, these are not discussed in this Technical Report and are omitted from the ISO/IEC text column. In any case the outcomes are the results of the activities specified, so this treatment does not miss any requirements. 4. Other missing sections of ISO/IEC The purpose of each process is included in the Rationale/explanation section rather than in the ISO/IEC text section for ease of referencing. Notes in ISO/IEC are excluded because they contain no activities (requirements). The sections describing the contents of ISO/IEC and those discussing systems are omitted since there is no similar content in ISO 9001: Quality management system General requirements This section in ISO 9001:2000 is not generally used as a reference relationship to ISO/IEC because it is a summary of the requirements specified in 4.2 and Clauses 5 to 8 of ISO 9001:2000. To include it would have meant many crossreferences to 4.1 and duplication of the specific sections where the precise requirement is specified. However in f) of ISO/IEC 15288:2002, 4.1 of ISO 9001:2000 is used to cover outsourced processes since this is the only part of ISO 9001:2000 that describes outsourced processes. 6. Other items in ISO 9001:2000 not referenced There are a few items in ISO 9001 where no relationship to ISO/IEC could be found. These are listed in a separate table at the back of this Technical Report for completeness. 7. Intended use of this Technical Report This Technical Report has been prepared to enable a reader who is interested in comparing or contrasting the different treatment of systems in ISO/IEC and ISO 9001:2000 to quickly find the relationship and understand why a particular relationship is cited by way of the rationale and explanation text. It does not try to explain why a particular requirement exists in either International Standard. It identifies the issues that should be addressed and is independent of the technology, life cycle models, development processes, sequence of activities and organizational structure used by an organization. The guidance and identified issues are intended to be comprehensive but not exhaustive. Where the scope of an organization's activities includes areas other than system development, the relationship between the computer system elements of that organization's quality management system and the remaining aspects should be clearly documented within the quality management system as a whole. ISO/IEC 2008 All rights reserved v

8 ISO/IEC TR 90005:2008(E) NPR-ISO/IEC TR 90005:2008 Clauses 4, 5 and 6 and parts of Clause 8 of ISO 9001:2000 are applied mainly at the global level in the organization, although they do have some effect at the project/product level. Each project or product development may tailor the associated parts of the organization's quality management system to suit project/product-specific requirements. Throughout ISO/IEC 15288, shall is used to express a provision that is binding between two or more parties, should to express a recommendation among possibilities and may to indicate a course of action permissible within the limits of ISO 9001:2000. On the other hand, ISO 9001:2000 uses only shall to express a provision that is binding between two or more parties. In this Technical Report, should and may have the same meaning as stated above, i.e. should" to express a recommendation among possibilities and may to indicate a course of action permissible within the limits of ISO 9001:2000 and ISO/IEC Organizations with quality management systems for developing, operating or maintaining systems based on this Technical Report may choose to use processes from ISO/IEC and ISO/IEC to support or complement the ISO 9001:2000 process model. vi ISO/IEC 2008 All rights reserved

9 TECHNICAL REPORT ISO/IEC TR 90005:2008(E) Systems engineering Guidelines for the application of ISO 9001 to system life cycle processes 1 Scope This Technical Report provides guidance for organizations in the application of ISO 9001:2000 to the acquisition, supply, development, operation and maintenance of systems and related support services. It does not add to or otherwise change the requirements of ISO 9001:2000. The guidelines provided in this Technical Report are not intended to be used as assessment criteria in quality management system registration or certification. 1.1 Purpose This Technical Report adopts ISO/IEC systems life cycle processes as a starting point for system development, operation or maintenance and identifies those equivalent requirements in ISO 9001:2000 that have a bearing on the implementation of ISO/IEC Field of Application The application of this Technical Report is appropriate to systems that are part of a commercial contract with another organization, a product available for a market sector, used to support the processes of an organization, embedded in a hardware product, or related to software services. Some organizations may be involved in all of the above activities; others may specialize in one area. Whatever the situation, the organization's quality management system should cover all aspects (system related and non-system related) of the business. 1.3 Limitations This Technical Report provides guidance for software intensive systems. For guidance in software development, operation and maintenance see the companion document ISO/IEC

10 ISO/IEC TR 90005:2008(E) NPR-ISO/IEC TR 90005: Terms and definitions For the purposes of this document, the following terms and definitions apply. 2.1 system (1) combination of interacting elements organized to achieve one or more stated purposes NOTE 1 A system may be considered as a product or as the services it provides. NOTE 2 In practice, the interpretation of its meaning is frequently clarified by the use of an associative noun, e.g. aircraft system. Alternatively the word system may be substituted simply by a context dependent synonym, e.g. aircraft, though this may then obscure a system principles perspective. [ISO/IEC 15288:2002] NOTE 3 This is the definition used in the ISO/IEC column of Clause system (2) set of interrelated or interacting elements [ISO 9000:2005] NOTE This is the definition used in the ISO 9001 column of Clause 3.

11 3 System Life Cycle Guidelines ISO/IEC text Rationale / Explanation ISO 9001 para. ISO 9001 text 5 System Life Cycle Processes 5.1 Introduction This clause describes the requirements for the life cycle processes. It defines their purposes and outcomes, and the activities required to achieve them. An organization conducts the life cycle processes selectively to fulfil the purpose and outcomes of life cycle stages. The life cycle processes are described in four process groups as follows: Agreement processes; Enterprise processes; Project processes; Technical processes. 5.2 Agreement Processes Introduction This subclause specifies the requirements for the establishment of agreements with organizational entities external and internal to the organization. The Agreement Processes consist of the following: a) Acquisition Process used by organizations for acquiring products or services; b) Supply Process used by organizations for supplying products or services. These processes define the activities necessary to establish an agreement between two organizations. If the Acquisition Process is invoked, it provides the means for conducting business with a supplier of products that are supplied for use as an operational system, of services in support of an operational system, or of elements of a system being developed by a project. If the Supply Process is invoked, it provides the means for conducting a project in which the result is a product or service that is delivered to the acquirer. No Comment N/A N/A No Comment N/A N/A

12 5.2.2 Acquisition Process ISO/IEC text Rationale / Explanation ISO 9001 para. ISO 9001 text Purpose of the Acquisition Process The purpose of the Acquisition Process is to obtain a product or service in accordance with the acquirer's requirements Acquisition Process Activities The acquirer shall implement the following activities in accordance with applicable organizational policies and procedures with respect to the Acquisition Process. a) Establish a plan for how the acquisition will be conducted. b) Prepare a request for the supply of a product or service. N/A N/A No Comment N/A N/A Conceptually, in ISO 9001, this requirement relates to purchasing. However, the establishment of the plan for acquisition can be recognized as a part of quality planning of a product. Once an organization has decided to acquire something from others, concerns may include the evaluation and selection of suppliers. This requirement refers to the selection of suppliers. To implement this requirement means the identification of the requirements of the product to be purchased. The requirement of purchasing may include the criteria of the approval of receipt The organization shall plan and develop the processes needed for product realization. The organization shall evaluate and select suppliers based on their ability to supply product in accordance with the organization's requirements. The organization shall evaluate and select suppliers based on their ability to supply product in accordance with the organization's requirements. Purchasing information shall describe the product to be purchased, including where appropriate a) requirements for approval of product, procedures, processes and equipment, b) requirements for qualification of personnel, and c) quality management system requirements.

13 ISO/IEC text Rationale / Explanation ISO 9001 para. ISO 9001 text c) Communicate the request for the supply of a product or service to identified suppliers. This requirement is partly equivalent to of ISO 9001 This requirement is partly equivalent to of ISO 9001 d) Select a supplier. From the view point of ISO 9001, this requirement is covered in under selection followed by evaluation. e) Negotiate an agreement with the supplier. The intent of this requirement may include the negotiation between organization and supplier The negotiation may include the definition of purchasing information The organization shall ensure the adequacy of specified purchase requirements prior to their communication to the supplier. The organization shall ensure that purchased product conforms to specified purchase requirements. The type and extent of control applied to the supplier and the purchased product shall be dependent upon the effect of the purchased product on subsequent product realization or the final product. Purchasing information shall describe the product to be purchased, including where appropriate a) requirements for approval of product, procedures, processes and equipment, b) requirements for qualification of personnel, and c) quality management system requirements. The organization shall ensure the adequacy of specified purchase requirements prior to their communication to the supplier The organization shall evaluate and select suppliers based on their ability to supply product in accordance with the organization's requirements The type and extent of control applied to the supplier and the purchased product shall be dependent upon the effect of the purchased product on subsequent product realization or the final product. Purchasing information shall describe the product to be purchased, including where appropriate

14 ISO/IEC text Rationale / Explanation ISO 9001 para. ISO 9001 text From the perspective of ISO 9001, purchasing information is decided by the organization. Where an agreement means contract, it relate to the requirement of of ISO 9001, since purchasing information is included in the contract. f) Assess the execution of the agreement. If this requirement relates to an out-sourced process, the requirement of 4.1 of ISO 9001:2000 can be considered as relevant. g) Confirm that the delivered product or service complies with the agreement. h) Make payment or provide other agreed consideration to the supplier for the product or service rendered. The assessment of the execution of the agreement can be considered as a part of the control of the supplier, by the organization. One of the execution aspects of the agreement can be receiving inspection. Confirmation of the compliance with the agreement can be considered as receiving inspection or other actions described in of ISO ISO 9001 does not include financial issues a) requirements for approval of product, procedures, processes and equipment, b) requirements for qualification of personnel, and c) quality management system requirements. The organization shall ensure the adequacy of specified purchase requirements prior to their communication to the supplier. Where an organization chooses to outsource any process that affects product conformity with requirements, the organization shall ensure control over such processes. Control of such outsourced processes shall be identified within the quality management system. The organization shall ensure that purchased product conforms to specified purchase requirements. The type and extent of control applied to the supplier and the purchased product shall be dependent upon the effect of the purchased product on subsequent product realization or the final product. The organization shall establish and implement the inspection or other activities necessary for ensuring that purchased product meets specified purchase requirements The organization shall establish and implement the inspection or other activities necessary for None None ensuring that purchased product meets specified purchase requirements.

15 5.2.3 Supply Process ISO/IEC text Rationale / Explanation ISO 9001 para. ISO 9001 text Purpose of the Supply Process The purpose of the Supply Process is to provide an acquirer with a product or service that meets agreed requirements Supply Process Activities The supplier shall implement the following activities in accordance with applicable organizational policies and procedures with respect to the Supply Process. a) Determine the existence and identity of an acquirer who has, or who represents a party or parties having, a need for a product or service. b) Evaluate a request for the supply of a product or service to determine feasibility and how to respond. No Comment N/A N/A ISO 9001 does not include presales activities The intent of this requirement can be recognized as the definition of the product from an ISO 9001 point of view. Then and may relate to this requirement. None None The organization shall determine a) requirements specified by the customer, including the requirements for delivery and post-delivery activities, b) requirements not stated by the customer but necessary for specified or intended use, where known, c) statutory and regulatory requirements related to the product, and d) any additional requirements determined by the organization. The organization shall review the requirements related to the product. This review shall be conducted prior to the organization's commitment to supply a product to the customer (e.g. submission of tenders, acceptance of contracts or orders, acceptance of changes to contracts or orders) and shall ensure that

16 Bestelformulier Stuur naar: NEN Standards Products & Services t.a.v. afdeling Klantenservice Antwoordnummer WB Delft Ja, ik bestel NEN Standards Products & Services Postbus GB Delft Vlinderweg AX Delft T (015) F (015) ex. NPR-ISO/IEC TR 90005:2008 en Systems engineering - Guidelines for the application of ISO 9001 to system life cycle processes Wilt u deze norm in PDF-formaat? Deze bestelt u eenvoudig via Gratis nieuwsbrieven Wilt u op de hoogte blijven van de laatste ontwikkelingen op het gebied van normen, normalisatie en regelgeving? Neem dan een gratis abonnement op een van onze nieuwsbrieven. Gegevens Bedrijf / Instelling T.a.v. O M O V Klantnummer NEN Uw ordernummer BTW nummer Postbus / Adres Postcode Plaats Telefoon Fax Factuuradres (indien dit afwijkt van bovenstaand adres) Postbus / Adres Postcode Plaats Datum Handtekening Retourneren Fax: (015) klantenservice@nen.nl Post: NEN Standards Products & Services, t.a.v. afdeling Klantenservice Antwoordnummer 10214, 2600 WB Delft (geen postzegel nodig). Voorwaarden De prijzen zijn geldig tot 31 december 2016, tenzij anders aangegeven. Alle prijzen zijn excl. btw, verzend- en handelingskosten en onder voorbehoud bij o.m. ISO- en IEC-normen. Bestelt u via de normshop een pdf, dan betaalt u geen handeling en verzendkosten. Meer informatie: telefoon (015) , dagelijks van 8.30 tot uur. Wijzigingen en typefouten in teksten en prijsinformatie voorbehouden. U kunt onze algemene voorwaarden terugvinden op: Normalisatie: de wereld op één lijn. preview