3. Guidance
It's important to note that for SWE-032, a CMMI-DEV rating is an organizational qualifier to acquire, develop, or maintain software for or by NASA for Classes A, B, and C. |
Many of the requirements in NPR 7150.2 are consistent with the established process areas in the CMMI-DEV framework. The CMMI-DEV rating as well as consistent NPR 7150.2 requirements are both needed to ensure that organizations have demonstrated the capability to perform key software engineering processes and have a binding agreement to continue to execute key software engineering processes during the development of NASA's most critical software systems. This requirement applies to both Safety Critical as well as Not Safety-Critical software in Classes A, B, and C. It is recommended that projects check the status of the software development or maintenance organization's CMMI rating at each major project life cycle review to ensure continued compliance and to identify potential risk areas in the software processes. A "check" can easily be done via the Software Engineering Institute's Published Appraisals website . General Software Acquisition Guidance: The content of the supplier agreement is critical to the acquisition of any software, including software embedded in a delivered system. In addition to the CMMI Maturity Level requirements placed on the supplier by SWE-032, the supplier agreement must also specify compliance with the software contract requirements identified in NPR 7150.2. The creation and negotiation of any supplier agreement involving software needs to include representatives from the Center's software engineering and software assurance organizations to ensure that the software requirements are represented in the acquisition agreement(s). The agreements clearly identify the following aspects of the acquisition: - Technical requirements on the software.
- Identification and definition of all software deliverables, including documentation.
- Required access to intermediate and final software work products throughout the development life cycle.
- Compliance and permissible exceptions to NPR 7150.2 and any applicable Center software engineering requirements.
- Software development status reporting including implementation progress, technical issues, and risks.
- Definition of acceptance criteria for software and software work products.
- Non-technical software requirements including: licensing, ownership, use of third party or Open Source Software, and maintenance agreements.
Representatives from the Center's software engineering and assurance organizations must evaluate all software-related contract deliverables prior to acceptance by the Project. The deliverables must be evaluated for: - Compliance with acceptance criteria.
- Completeness.
- Accuracy.
Class A software – If you acquire, develop or maintain Class A software the organization performing the functions is required to have a non-expired CMMI-DEV Level 3 or higher rating. Class A software acquisition guidance – To ensure that the solicitation, contract, and delivered products meet the requirements of this NPR, the Project's acquisition team must be supported by representatives from a software engineering and software assurance organization that is either rated at CMMI-DEV Maturity Level 3 or higher or rated at CMMI-DEV Capability Level 3 in at least the process areas of Supplier Agreement Management and Process and Product Quality Assurance. This support may be in the form of direct involvement in the development of supplier agreements or review and approval of these agreements. The support must also include review and approval of any software-related contract deliverables. The extent of the CMMI-DEV Level 3 rated organization's support required for a Class A acquisition can be determined by the Center's Engineering Technical Authority responsible for the project. Identification of the appropriate personnel from a organization that has been rated at a CMMI-DEV Level 3 or higher (see description in previous paragraph) to support the Project acquisition team is the responsibility of the designated Center Engineering Technical Authority and Center Management. The Center Engineering Technical Authority has the responsibilities for ensuring that the appropriate and required NASA Software Engineering requirements are included in an acquisition. For those cases in which a Center or project desires a general exclusion from the NASA Software Engineering requirement(s) in this NPR or desires to generically apply specific alternate requirements that do not meet or exceed the requirements of this NPR, the requester can submit a waiver for those exclusions or alternate requirements for approval by the NASA Headquarters' Chief Engineer with appropriate justification (see SWE-120). Class A software development or maintenance guidance - The software organizations that directly develop or maintain Class A software are required to have a valid CMMI-DEV Level 3 or higher rating for the organization performing the activities. Support contracts supporting NASA in-house software development organizations can be included in the NASA organizational assessments. Project contractors and subcontractors performing Class A software development are required to have their own CMMI-DEV Level 3 rating. It is important for NASA and primes to pass this requirement down in contracts to ensure all subcontractors have the necessary CMMI-DEV rating. The CMMI-DEV Level 3 rating is to be maintained throughout the project's development or maintenance period. NASA requests organizations' CMMI ratings be posted on the SEI website . SEI vets the validity of the CMMI appraisals on this list and assures the rating hasn't expired (as of this writing CMMI ratings are valid for a 3 year period). In rare instances (rating earned in a classified environment) an organization may have a current CMMI-DEV rating, but it doesn't appear on the SEI website. In these cases the supplier's claim can be directly checked with SEI. Class B software - CMMI-DEV Maturity Level 2 Rating or higher for software, or CMMI-DEV Capability Level 2 Rating or higher for software in the following process areas: a. Requirements Management. b. Configuration Management. c. Process and Product Quality Assurance. d. Measurement and Analysis. e. Project Planning. f. Project Monitoring and Control. g. Supplier Agreement Management (if applicable). Class B software acquisition guidance - To ensure that the solicitation, contract, and delivered products meet the requirements of this NPR, the Project's acquisition team must be supported by representatives from a software engineering and software assurance organization that is either rated at CMMI-DEV Maturity Level 2 or higher or rated at CMMI-DEV Capability Level 2 in at least the process areas of Supplier Agreement Management and Process and Product Quality Assurance. This support may be in the form of direct involvement in the development of supplier agreements or review and approval of these agreements. The support must also include review and approval of any software-related contract deliverables. The Center Engineering Technical Authority responsible for the project determines the extent of the CMMI-DEV Level 2 rated organization's support required (see description in previous paragraph) for a Class B acquisition. Identification of the appropriate personnel from a organization that has been rated at a CMMI-DEV Level 2 or higher to support the Project acquisition team is the responsibility of the designated Center Engineering Technical Authority and Center Management. The Center Engineering Technical Authority has the responsibilities for ensuring that the appropriate and required NASA Software Engineering requirements are included in an acquisition. For those cases in which a Center or project desires a general exclusion from the NASA Software Engineering requirement(s) in this NPR or desires to generically apply specific alternate requirements that do not meet or exceed the requirements of this NPR, the requester can submit a waiver for those exclusions or alternate requirements for approval by the NASA Headquarters' Chief Engineer with appropriate justification (see SWE-120). Class B software development or maintenance guidance - The software organizations that directly develop or maintain Class B software are required to have a valid CMMI-DEV Level 2 or higher rating (via a Continuous or Staged representation) for the organization performing the activities. Support contracts supporting NASA in-house software development organizations can be included in the NASA organizational assessments. Project contractors and subcontractors performing Class B software development are required to have their own CMMI-DEV Level 2 or higher rating. The CMMI-DEV Level 2 maintains an active rating during the development or maintenance period. The rating is to be posted on the SEI website . Guidance on the exception for Class B software development and maintenance - If this option is used, the project is responsible for funding the evaluation and for addressing any all risks that are identified during the evaluation. A SCAMPI (Standard CMMI Appraisal Method for Process Improvement) B or SCAMPI C appraisal across the listed process areas in this requirement is one method for conducting this evaluation. The Center Engineering Technical Authority is responsible for maintaining all records associated with the evaluation for the life of the project. The decision on participators in the evaluation process is determined by the responsible Center Engineering Technical Authority on the project. Recommended guidance is that the "qualified evaluator" has demonstrated experience on a SCAMPI A appraisal or training, such as CMMI Practitioner Level 2 training. Completion of an introduction to CMMI training course must not be the only criteria used in the selection. Class C software -The required CMMI-DEV Level for Class C software will be defined per Center/project requirements. Class C software acquisition guidance – Center level directives provide information on how to satisfy " P (Center)" requirements for SWE-032 for Class C software. In the case of the Project acquiring a system that includes Class C software, it is recommended that the solicitation, contract, and delivered products meet the requirements of this NPR. The Project's acquisition team is to be supported by representatives from a software engineering and software assurance organization that is either rated at CMMI-DEV Maturity Level 2 or higher or rated at CMMI-DEV Capability Level 2 in at least the process areas of Supplier Agreement Management and Process and Product Quality Assurance. The Center decides the extent and evidence required to show that personnel in a CMMI-DEV Level 2 rated organization have participated in the acquisition activities. The extent of the CMMI-DEV Level 2 rated organization support required for a Class C acquisition is determined by the Center Engineering Technical Authority responsible for the project. If a Center does not have any CMMI-DEV Level 2 rated organizations, then the acquisition team can be supported by software engineers knowledgeable of the CMMI-DEV software development practices. Identification of the appropriate personnel that are knowledgeable of the CMMI-DEV software development practices to support the Project acquisition team is the responsibility of the designated Center Engineering Technical Authority and Center Management. The Center Engineering Technical Authority has the responsibilities for ensuring that the appropriate and required NASA Software Engineering requirements are included in an acquisition. For those cases in which a Center or project desires a general exclusion from the NASA Software Engineering requirement(s) in this NPR or desires to generically apply specific alternate requirements that do not meet or exceed the requirements of this NPR, the requester can submit a waiver for those exclusions or alternate requirements for approval by the NASA Headquarters' Chief Engineer with appropriate justification (see SWE-120). Class C software development or maintenance guidance – Recommended practice is that all software organizations that directly develop or maintain Class C software have a valid CMMI-DEV Level 2 rating for the organization performing the activities. Support contracts supporting NASA in-house software development organizations can be included in the NASA organizational assessments. Project contractors and subcontractors performing Class C software development are required to have their own CMMI-DEV Level/Capability rating consistent with Center/project requirements. These organizations are to maintain software process areas as well as an active CMMI-DEV rating during the development or maintenance period. The rating is to be posted on the SEI website . If a Center does not have a CMMI-DEV Level 2 rated organization, then the development and or maintenance team can be supported by a software engineer who has at a minimum completed the CMMI Practitioner Level 2 training and is knowledgeable of the CMMI-DEV software development practices. The level of support required is based on project risk and is determined by the Center Technical Authority responsible for the software activities. |