A maturity model for the Spanish software industry based on ISO standards

Highlights

• A Software Engineering Maturity Model was produced for Spanish software industry.

• The model is based on standards: ISO/IEC 12207, ISO/IEC 15504 and ISO/IEC 17021.

• It allows a certification of the organizational maturity for software enterprises.

• Helping to improve the software development quality in all types of enterprises.

• Currently there are 38 development enterprises certified by AENOR in this model.

Abstract

Many organizations are implementing process improvement models, seeking to increase their organizational maturity for software development. However, implementing traditional maturity models involves a large investment (as regards money, time and resources) which is beyond the reach of vast majority of small organizations. This paper presents the use and adaptation of some ISO models in the creation of an organizational maturity model for the Spanish software industry. This model was used satisfactorily to (i) improve the software processes of several Spanish small firms, and (ii) obtain an organizational maturity certification for software development, granted by the Spanish Association for Standardization and Certification.

Introduction

The software industry is made up mainly of small and medium software companies [1] which favor the growth of national economies [2]. One important concern of software industry companies has been the development of software products with an optimum use of resources, time and costs [3]; in other words, the quest is to be efficient. In this respect, small companies need efficient Software Engineering practices that are suitable for their particular characteristics. These practices would support the development of products of high quality [2] which must evolve if they are to adapt to new demands and scenarios [4] as they seek to make these companies become more competitive. In recent years, a key research area in the software engineering community has been the evaluation of the maturity of software processes, given its impact on the efficiency of the software product development process [5]. According to [6], a maturity model “contains the essential elements of effective processes for one or more disciplines and describes an evolutionary improvement path from ad-hoc, immature processes to disciplined, mature processes with improved quality and effectiveness”. Having efficient processes by means of organizational maturity helps a firm understand its position in terms of process management and execution [5]. This in turn leads to an increase in software product quality since, according to [7], there is a close relationship between software process quality and the software product quality obtained using this process.

It is precisely because of the considerations outlined above that software development firms are putting greater and greater emphasis on building their software products to a level of quality that allows them to meet the needs of their clients satisfactorily, as they strive to compete adequately in the local and international markets. At the present time, the strategy of gaining certification in one quality model or another is used by software development companies. This is done to guarantee the quality of the enterprise's products; certification is an element that, amongst other things, marks a company out from its competitors and gives it a good sales image in the eyes of its customers. A number of software process capability/maturity models have been developed and these are being used for software process improvement/assessment by companies [8]. At the moment, the most popular and most widely-used certification in the world for cataloging the maturity of a software-development organization is CMMI-DEV [9]. For some considerable time now, however, this model has been the only option for a certification of this type. That has meant that it has had a monopoly, such that the costs (associated with consulting and more especially with certification) have put the service beyond the reach of most of the firms which form part of the software industry. On this very issue, the study carried out by [10] concludes that many firms do not adopt CMMI because of its high costs. The fact that it is inappropriate for small-scale organizations (which make up the greater part of the software industry) is another disadvantage. Moreover, this model takes a long time to implement.

Bearing in mind the above state of affairs, together with the present-day economic climate, we believed that it was important to offer another option for the certification of organizational maturity (focused on software development) to firms in the Spanish software industry (thinking especially of those small firms with fewer than 50 employees). That offer had to be both appropriate and accessible. To create this new scheme for the certification of organizational maturity for software development, we counted on the support of different actors in the country, such as the government and the industry itself, as well as the scientific-academic community in Spain. The input from this synergy brought into being a Software Engineering Maturity Model (also called Organizational Maturity Model in this paper) which allows us to assess and to certify the software enterprises by means of organizational maturity levels (in the same way as the CMMI model does). It is important to highlight that this model:

• was financed by the Spanish Ministry of Industry, Tourism and Trade.

• involved researchers from universities and practitioners from organizations of the Software Engineering field, and used mainly the ISO/IEC 15504 part 2 [11] and 7 [12] standards, as well as ISO/IEC 12207 [13] for its creation.

• has the backing of the Spanish Association for Standardization and Certification — AENOR (www.aenor.es), the body responsible for offering certification in this model.

• has financial support (from the Spanish Ministry of Industry, Tourism and Trade), for those firms wishing to opt for this certification.

• provides the certification that is required of any software development firm which wishes to bid for official tenders or contracts with the Spanish state.

This paper, then, seeks to present a Software Engineering Maturity Model that has been produced for the Spanish software industry. The model aims to be an effective tool in helping to improve the quality of software development in organizations that wish to tackle certification schemes related to organizational maturity in the context of software development. The goal is to strengthen their productivity and competitiveness in the national and international markets. The proposed certification scheme is based on: (i) a software lifecycle process model in accordance with the ISO/IEC 12207 Standard, (ii) a model for assessing the capability of these processes and the maturity of the organizations to develop software in accordance with parts 2 and 7 from ISO/IEC 15504 Standard respectively, and (iii) requirements of the audit according to ISO/IEC 17021 standard [14]. The paper also sets out the results of the use of this model in carrying out the audit of 16 firms which have obtained their corresponding AENOR Certificate for Level 2 in compliance with the Software Engineering Maturity Model created.

These introductory comments have set the scene; Section 2 goes on to present a more detailed background, in which the research methods and the project context are explained and the related work in this field is referred too. The Software Engineering Maturity Model developed is described in Section 3. Section 4 sets out the use of this model from the viewpoint of the auditors during the audit process in the enterprises aiming to achieve the certification. Finally, Section 5 discusses the work performed in relation to the development and application of the model and Section 6 presents our conclusions and future lines of work.