Any requirements to be performed by a supplier (software provider) will need to be incorporated into the contract because the contract is the binding document for contractor performance and deliverables. Therefore, this NPR 7150.2 requirement needs to be considered during the earliest phases of a project when the Request for Proposals (RFPs), the Statement of Work (SOW), and the contract are being developed.
The specific software change and non-conformance information to be provided by the supplier needs to be sufficient for the acquirer to assess the impact on the overall project. The guidance in this Handbook for SWE-080 and SWE-113 is helpful in determining the type of information to require of the software supplier.
Suppliers may capture information in various formats depending on the tools, processes, and procedures they use to track software changes and non-conformances. Negotiate records access and/or delivery format with the software supplier to ensure useful, timely, accurate, and complete information is available for monitoring by the acquirer. Electronic access to the supplier's configuration management system or the non-conformance tracking system allows continuous monitoring of these activities to be able to assess progress.
The method and frequency for providing these records for project review are also included in the contract. Consider the following, non-exhaustive list of options:
- As needed by the acquirer via direct electronic access.
- At or before formal reviews, such as those found in NPR 7123.1A, NPR 7120.5, NPR 7120.7 (IT and Institutional Infrastructure) and NPR 7120.8 (Research and Technology).
- At the request of the acquirer.
- At regularly scheduled status, progress, and/or technical meetings.
- At acceptance reviews.
- During acquirer audits of the supplier.
Another item to consider when levying this requirement is that software suppliers typically start formally capturing software changes and non-conformances after the software has been baselined the first time. However, suppliers may delay creating that initial baseline to avoid the overhead of formal tracking which requires formal reviews and approvals before software changes can be implemented. It is recommended that the supplier formally track software changes and non-conformances once formal requirement verification activities have begun.
Consult Center Process Asset Libraries (PALs) for Center-specific guidance related to requiring the software supplier to track software changes and non-conformances and provide the data for the project's review.
See Topic 7.3 - Acquisition Guidance in this Handbook for additional guidance. Additionally, guidance related to supplier requirements and software change tracking may be found in the following related requirements in this Handbook:
Track and Evaluate Changes
Software Change Request/Problem Report
Software Version Description
Software Test Report
Software Documentation Requirements - Software Inspection, Peer Reviews, Inspections.