ISO/IEC DIS 33063:2026(en)

ISO/IEC / JTC1/SC7 WG 10

Secretariat: BIS

Date: 2025-12-23

Information technology – Process assessment – Process assessment model for software testing

© ISO/IEC 2026

All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting on the internet or an intranet, without prior written permission. Permission can be requested from either ISO at the address below or ISO’s member body in the country of the requester.

ISO copyright office

CP 401 • Ch. de Blandonnet 8

CH-1214 Vernier, Geneva

Phone: +41 22 749 01 11

Email: copyright@iso.org

Website: www.iso.org

Published in Switzerland

Contents

Foreword v

Introduction vi

1 Scope 1

2 Normative references 1

3 Terms and definitions 1

4 The process assessment model 2

4.1 Introduction 2

4.2 Structure of the process assessment model 2

4.2.1 General 2

4.2.2 Processes 3

4.2.3 Process dimension 5

4.2.4 Quality dimension 6

4.3 Assessment indicators 6

5 The process dimension 7

5.1.1 General 7

5.2 Organizational test process group 8

5.2.1 OT.1 Organizational test process 8

5.3 Test mmanagement process group 9

5.3.1 TM.1 Test strategy and planning process 9

5.3.2 TM.2Test monitoringand control process 10

5.3.3 TM.3 Test completion process 11

5.4 Dynamic test process group 12

5.4.1 DT.1 Test design and implementation process 12

5.4.2 DT.2 Test environment and data management process 13

5.4.3 DT.3 Test execution process 14

5.4.4 DT.4 Test incident reporting process 15

6 The quality dimension 15

Annex A (informative) Assessment guidelines 17

A.1 General assessment guideline(informative) 17

A.2 Process application guideline (normative) 17

A.3 Guideline on the use of additional processes from other PAM(informative) 19

Annex B (informative) Information product characteristics 20

B.1 Information product categories 20

B.2 Information product description 21

Annex C (informative) Additional processes 25

C.1 Static testing process group 25

C.1.1 STAT.1 Work product review process 25

C.1.2 STAT.2 Static analysis process 26

C.2 Test management process group 27

C.2.1 TM.4 Problem resolution management process 27

Annex D (informative) Supplementary process definition 29

D.1 Static analysis process 29

Bibliography 30

Foreword

ISO (the International Organization for Standardization) is a worldwide federation of national standards bodies (ISO member bodies). The work of preparing International Standards is normally carried out through ISO technical committees. Each member body interested in a subject for which a technical committee has been established has the right to be represented on that committee. International organizations, governmental and non-governmental, in liaison with ISO, also take part in the work. ISO collaborates closely with the International Electrotechnical Commission (IEC) on all matters of electrotechnical standardization.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the various types of ISO documents should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives).

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights. ISO shall not be held responsible for identifying any or all such patent rights. Details of any patent rights identified during the development of the document will be in the Introduction and/or on the ISO list of patent declarations received (see www.iso.org/patents).

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT),see www.iso.org/iso/foreword.html.

This document was prepared by Joint Technical Committee ISO/IEC JTC1, Information technology], Subcommittee SC 7, Software and systems engineering.

This secondedition cancels and replaces the firstedition (ISO/IEC 33063:2015), which has been technically revised.

The main changes are as follows:

— adaptation to the updated version of ISO/IEC/IEEE 29119-2:2021 Software and systems engineering – Software testing – Part 2: Test processes

— adaptation to the updated version of ISO/IEC 33020:2019 Information technology – Process assessment – Process measurement framework for assessment of process capability

A list of all parts in the ISO 330xx series can be found on the ISO website.

Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html.

Introduction

The ISO/IEC 330xx set of standards covering the domain of process assessment are based on a view of assessment that establishes architecture of three components:

— Process models that define processes, the entities that are the subject of anassessment;

— Measurement frameworks that provide scales for evaluating specified attributes; and

— A specification of the process to be followed in conducting assessments.

This standard provides an example of a process assessment model for software testing for use in performing a conformant assessment in accordance with the requirements of ‘ISO/IEC 33002 – Process Assessment – Requirements for performing process assessments’.

An integral part of conducting an assessment is to use a process assessment model (PAM) related to a process reference model (PRM) and conformant with the requirements defined in ISO/IEC 33004.

A process reference model cannot be used alone as the basis for conducting a consistent and reliable assessment of process capability since the level of detail is not sufficient.

Therefore:

— the description of the process purpose and process outcome(s) provided by the process reference model need to be supported with a comprehensive set of indicators of process performance; and

— the capability levels and process attributes defined in ISO/IEC 33020 and its associated rating scale need to be supported with a setof indicators of process capability.

Used in this way and in conjunction with a documented process, consistent and repeatable ratings of process capability is possible.

The ISO/IEC 33063 standard, a process assessment model for software testing, contains a set of indicators to be considered when interpreting the intent of the Process reference model. These indicators may also be used when implementing a process improvement program or to help evaluate and select an assessment model, methodology and/or tools.

The process reference model defined in ‘ISO/IEC/IEEE 29119-2 - Software and Systems Engineering — Software Testing — Part 2: Test Processes’ has been used as the basis for the ISO/IEC 33063 process assessment model for software testing.

Within ISO/IEC 33063:

— clause 4 provides a detailed description of the structure and key components of the process assessment model, which introduces two dimensions: a process dimension and a quality dimension; assessment indicators are also introduced in this clause;

— clause 5 addresses the process dimension. It uses process definitions from ISO/IEC/IEEE 29119-2 to identify a process reference model. The processes of the process reference model are described in the process assessment model in terms of purpose and outcomes. The process assessment model expands the process reference model process definitions by including a set of process performance indicators called base practices for each process. The process assessment model also defines a second set of indicators of process performance by associating work products with each process;

— clause 6 provides a brief description of the quality dimension of the process assessment model;

— Annex A provides a guideline on how the planning and scoping of an assessment is done with this process assessment model for software testing;

— Annex B provides selected characteristics for typical information products to assist the assessor in evaluating the quality level of processes;

— Annex C introduces additional process areas for the process assessment model;

— Annex D provides the additional process reference model processes which will be used by the PAM in Annex D;

— Bibliography contains a list of informative references.

NOTE As the processes described in this model are generic when practically applied to an assessment, they have to be applied to the different test levels or test levels or test types encountered in the project which is to be assessed. The multiple applications of the processes have to be documented in the assessment scope. It also provides guideline on the use of additional processes from other Process assessment models.

The International Organization for Standardization (ISO) draws attention to the fact that it is claimed that compliance with this document may involve the use of a patent.

ISO takes no position concerning the evidence, validity and scope of this patent right.

The holder of this patent right has assured ISO that he/she is willing to negotiate licences under reasonable and non-discriminatory terms and conditions with applicants throughout the world. In this respect, the statement of the holder of this patent right is registered with ISO. Information may be obtained from the patent database available at www.iso.org/patents.

Attention is drawn to the possibility that some of the elements of this document may be the subject of patent rights other than those in the patent database. ISO shall not be held responsible for identifying any or all such patent rights.

Information technology – Process assessment – Process assessment model for software testing)

This document:

— defines aprocess assessment model that meets the requirements of ISO/IEC 33004and that supports the performance of an assessment of process capability using the process measurement framework defined in ISO/IEC 33020. The process assessment model provides indicators for guidance on the interpretation of the process purposes and outcomes as defined in ISO/IEC/IEEE 29119-2 and the process attributes as defined in ISO/IEC 33020;

— provides guidance, by example, on the definition, selection and use of assessment indicators.

A process assessment model comprises a set of indicators of process performance and process capability.The indicators are used as a basis for collecting the objective evidence that enables an assessor to assignratings, following the requirements of ISO/IEC 33002. The set of indicators included in this standard is neither intended to be an all-inclusive setnor is it intended to be applicable in its entirety. Subsets that are appropriate to the context and scope of theassessment should be selected.

The process assessment model in this standard is directed at assessment sponsors andcompetent assessors who wish to select a model, and associated documented process method, forassessment (for either capability determination or process improvement).

Any process assessment model for Software Testing meeting the requirements defined in ISO/IEC 33004 concerning models for process assessment may be used for assessment. Different models and methods may be needed to address differing business and testing needs. This assessment model is provided as an exemplar of a model meeting all the requirements expressed in ISO/IEC 33004.

The following documents are referred to in the text in such a way that some or all of their content constitutes requirements of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments) applies.

ISO/IEC/IEEE 29119‑1, Software and systems engineering — Software testing — Part 1: General concepts

ISO/IEC/IEEE 29119‑2, Software and systems engineering — Software testing — Part 2: Test processes

ISO/IEC 33001, Information technology — Process assessment — Concepts and terminology

ISO/IEC 33004, Information technology — Process assessment — Requirements for process reference, process assessment and maturity models

ISO/IEC 33020, Information technology — Process assessment — Process measurement framework for assessment of process capability

For the purposes of this document, the terms and definitions given in ISO/IEC 33001, ISO/IEC/IEEE 29119-1 and ISO/IEC/IEEE 29119-2apply.

ISO and IEC maintain terminological databases for use in standardization at the following addresses:

— ISO Online browsing platform: available at https://www.iso.org/obp

— IEC Electropedia: available at https://www.electropedia.org/

ISO/IEC 33063 provides aprocess assessment model (PAM) for software testing.

The process assessment model is a two-dimensional model. In one dimension, the process dimension, the processes are defined and classified into process categories together with theset of assessment indicators of process performance. In the other dimension, the quality dimension, for each process attribute in the process measurement framework a set of processquality indicators is defined for the selected process quality characteristic.

Figure 1 — Structure of the process assessment model

Figure 1 shows the process assessment model as a two-dimensional model, the process dimension with its relationship to ISO/IEC/IEEE 29119-2Software and systems engineering – Software testing; Part 2: Test processes, and the quality dimension in relationship to a process measurement framework. The process assessment modelfor software testing defined in ISO/IEC 33063 is conformant with the ISO/IEC 33004 requirements for a process assessment model, and can be used as the basis for conducting an assessment of software testing processes.

This clause describes the detailed structure of the process assessment model and its key components.

This process assessment model expands upon the process reference model by adding the definition and use of assessment indicators. Assessment indicators comprise of indicators of process performance and process capability. These are defined to support the assessor’s judgment of the performance and capability of an implemented process.

Clause 5, together with its associated Annex B, describes the components of the process dimension. Clause 6 describes the quality dimension.

ISO/IEC 33004 requires that processes included in a process reference model satisfy the following criteria:

"The fundamental elements of a process reference model are the set of descriptions of the processes within the scope of the model. These process descriptions shall meet the following requirements:

a) a process shall be described in terms of its purpose and outcomes;

b) the set of process outcomes shall be necessary and sufficient to achieve the purpose of the process;

c) process descriptions shall not contain or imply aspects of the process quality characteristic beyond the basic level of any relevant process measurement framework conformant with ISO/IEC 33003."

As processes are directlyderived and applied from ISO/IEC/IEEE 29119-2, these requirements are satisfied.

The process assessment model includes process groups defined in ISO/IEC/IEEE 29119-2 which are:

— the Organizational test process;

— the Test management processes;

— the Dynamic test processes.

The Static Test Processes group is added in an informative Annex D expanding the current process reference model since they are the processes to be assessed when considering industry practice.

The quality dimension comprising a set of process attributes for a selected process qualitycharacteristic is incorporated as a process measurement framework together with a set of processquality indicators.

NOTE ISO/IEC 33020 provides a process measurement framework for the assessment of process capabilitywhich canbe incorporated into this document. ISO/IEC 33020 also includes a set of process quality indicators foreach process attribute in the process measurement framework.

Figure 2 lists the processes fromISO/IEC/IEEE 29119-2 that are included in the process dimension of the process assessment model for software testing.

Figure 2 — Process groups and processes of PRM, ISO/IEC/IEEE 29119-2

Test processes in this process assessment modelare classified into organizational test(OT) process group, test management (TM) process group and dynamic test (DT) process group, exactly following the structure given in the process reference model.

The organizational testprocess group includes a single process performed for the creation and maintenance of organizational test specifications, such as organizational test policies, organizational test strategies, and other organization-wide specifications.

This group includes the process listed in Table 1.

Table 1 — Organizational testprocess group

The test managementprocess group consists of processes that cover the management of testing. The processes contain practices that may be used by anyone who manages the whole test project or a particular test level, or test typewithin the project.

This group includes the processes listed in Table 2.

Table 2 — Test management process group

Thedynamic testprocess group consists of processes that prepare and maintain the test environment; design, implement and execute the tests and/or report the incidents resulting from the test execution.

Thedynamic testprocess group includes the processes listed in Table 3.

Table 3 — Dynamic test process group

As illustrated in the Annex B.2, the processes within the test management process group and dynamic test process group are generic. Within the context of an assessment, they have to be applied to the whole project, different test levels, or test types depending on the characteristics of the project to be assessed.

For example, processes within the test management process can be applied to the management ofprojects (e.g., master test level), of test levels such as unit testing or acceptance testing, orof types of testing such as security testing and performance testing. The processes within the dynamic test process group can e.g., be applied to integrationtesting or performance testing, security testing or other test levels/test types.

NOTE Application of the test management processes is unique for each situation with distinct characteristics, hence Annex B.2, Process Application Guideline, is normative.

For practical purpose, in an informative Annex C, three processes are added. The additional processes problem resolution managementprocess (TM.4), is from the ISO/IEC 15504-5, andwork product review process(STAT.1)is from the ISO/IEC 20246 while the static analysis process (STAT.2) is from Annex D. Those additional processes in the Annex C are included for the practical assessment of software test processes reflecting the industry practice.

The guideline on the use of additional processes from other process assessment models is depicted in the Annex B.3.

For the process dimension, all the processes in Figure 2 are included within the process dimension of the process assessment model. The processes are classified into process groups. There are four processgroups: organizational test process, test management process, dynamic test process, and static test process. The process groups and their associated processes are described in Clause 5 and in Annex C.

Each process in the process assessment model is described in terms of a purpose statement. These statements contain the unique functional objectives of the process when performed in a particular environment. A list of specific outcomes is associated with each of the process purpose statements, as a list of expected positive results of the process performance.

Satisfying the purpose statement of a process represents the first step in building a level 1 process capability where the expected outcomes are observable.

For the quality dimension, the minimum requirement is that the process is performed, i.e. theimplemented process achieves its process purpose and the expected outcomes are observable.

Process attributes are features of a process that can be evaluated on a scale of achievement, providing ameasure of the quality of the process and are applicable to all processes.

Further details on the quality dimension can be found in Clause 6.

A process assessment model is based on the principle that the quality of a process can be assessed bydemonstrating the achievement of process attributes on the basis ofevidences related to assessmentindicators.

There are two types of assessment indicators: process performance indicators and process qualityindicators. Process performance indicators address the process purpose and outcomes of each process in the process dimension. Process quality indicators demonstrate the achievement of the processattributes in the quality dimension.

The process performance indicators are:

— Base practice (BP);

— Information products (IP).

The performance of base practices (BPs) provide an indication of the extent of achievement of the process purpose and process outcomes. Information products (IPs) are either used or produced (or both), when performing theprocess. Informationitems that are the key outputs of the process are primarily used as performanceindicators.

Annex B provides the list of information products (IP) associated with the processes in Clause 5. The information products are identified by categories. The information products are indicated by the process IDs.

Process quality indicators depend on the process quality characteristic of interest. The minimumrequirement is that at least one of the process attributes shall comprise the achievement of the definedprocess purpose and process outcomes for the process; this is termed the process performanceattribute (see ISO/IEC 33003 Clause 4.2.1).

The process performance and process quality indicators represent types of objective evidence thatmight be found in an instantiation of a process and therefore could be used to judge achievement ofquality. Figure 3 shows how the assessment indicators are related to process performance and processquality.

Figure 3 — Assessment indicators

This clause defines the processes and theprocess performance indicators of the process assessment model. The processes in the process dimension can be directlymapped to the processes defined in theprocess reference model.

The processes are classified (for the purpose of this process assessment model) into process groups which are listed in Clause 4.

The individual processes are described in terms of process name, process purpose, and process outcomesas defined in ISO/IEC/IEEE 29119-2.

In addition, the process performance indicators of the process assessment model provide information in the form of:

a) base practices for the process providing a definition of the tasks and activities needed to accomplish the test process purpose and fulfil the process outcomes; each base practice is associated to one or more process outcomes; and

b) information productsthat are the key outputs of the process, and are related to one or more processoutcomes; and

c) characteristics associated with each information product.

The process purposes, outcomes, the base practices and the information products associated with the processes are included in this clause. The information product characteristics are contained in Annex B. The base practices and information products constitute the set of indicators of process performance.

The associated information products listed in this clause may be used when reviewing potential inputs and outputs of an organization's process implementation.

The associated information products provide objective guidance for outputs to look for and objective evidence supporting the assessment of a particular process.

A documented assessment process and assessor judgment is needed to ensure that process context (application domain, business purpose, development and testing methodology, size of the organization, etc.) is explicitly considered when using this information.

This assessment process should not be considered as a checklist of what each organization must have but rather as an example and starting point for considering whether, given the context, the information products are necessary and contributing to the intended purpose of the process.

NOTE Consideration of assessing the additional test process areas in Annex C such aswork product review process (STAT.1), static analysis process (STAT.2), problem resolution managementprocess (TM.4) may be required to guarantee the assessment of all the test processes.

A process assessment model incorporates a process measurement framework conformant with therequirementsof ISO/IEC 33003 and is expressed as a process quality characteristic with a defined set ofprocess attributes. At minimum, a process measurement framework includes a process quality attributeofprocess performance, which is needed to demonstrate that the process achieves its expected processoutcomes. Other process quality attributes may be added over the process performance attribute.

NOTE 1 ISO/IEC 33020 provides a process measurement framework for the assessment of process capability which can be incorporated into this document. ISO/IEC 33020 also includes a set of process quality indicators for each process attribute in the process measurement framework.

The assessment indicators are used as a basis for collecting objective evidence to support an assessor’sjudgement in assigning ratings of the performance and quality of an implemented process. The set ofindicatorsdefined in ISO/IEC 33063 are not intended to be an all-inclusive set and applicable in its entirety.Subsets appropriate to the context and scope of the assessment should be selected, andpotentially augmented with additional indicators.

A process assessment is conducted according to a documented assessment process. A documentedassessment process will identify the rating method to be used in rating process attributes and identifyor define the aggregation method to be used in determining ratings.

NOTE 2 ISO/IEC 33020 includes a process attribute rating scale, process attribute rating method, and aggregation method which can provide a suitable basis for use for incorporating into any documented assessment process.

1. 
   (informative)
   
   Assessment guidelines
   1. General assessment guideline(informative)

This process assessment model for software testing builds upon the standard ISO/IEC/IEEE 29119Software and Systems Engineering – Software Testing – Part 2: Test Processes.Within this standard the test process is described in a generic way using a multi-layer approach, see figure 2 in Clause 4.2.2.

The top level consists of the Organizational Test Process Group consisting of one process called the Organizational Test Process. The second level is the Test Management process group (TM). The three processes Test Strategy and Planning Process, Test Monitoring and Control Process and Test Completion Process belong to this group. The bottom layer is the Dynamic Test Process group (DT). Within these group four processes are defined: Test Design & Implementation Process, Test Environment &Data ManagementProcess, Test Execution Process and Test Incident Reporting Process.

All can be seen in Figure 2, no test levels or test types are prescribed within ISO/IEC/IEEE 29119-2. As every project is different, the testing needs also differ. In a project which develops a safety-related system a lot of emphasis will be placed on testing with several test levels and test types, whereas a project which develops a web application might do less testing.

In order to accommodate all projects, the generic description of test processes was chosen. This is an important concept in ISO/IEC/IEEE 29119 and needs to be known in order to understand the standard. The process assessment model described in this standard follows the same concept. For each of the generic processes defined in ISO/IEC/IEEE 29119-2 a corresponding process description in the process assessment model is defined.

However, this generic approach has a high impact of the planning and scoping of an assessment.

In case a project has two test levels, e.g., unit testing and system testing, the test processes defined in the Test Management process group (TM) and in the Dynamic Test Process group (DT) will have to be “applied” two times. Test design and implementation, test environment will not be the same for unit testing and system testing. Also test planning, monitoring & control and test completion may be done differently for the two test levels and therefore be assessed separately.

In addition, conformant with the requirements of ISO/IEC 33002 the lead assessor may decide together with the assessment sponsor to include further processes from other process assessment model.

• 1. Process application guideline (normative)

Within the scope definition of the assessment the lead assessor together with the sponsor shall specify which processes will be assessed and to which the test level(s), and test type(s) they are applied.

In case a project has two test levels, e.g.,unit testing and system testing, and a test type(non-functional testing), e.g., reliability testing, the test processes defined in the Test Management process group (TM) and in the Dynamic Test Process group (DT) will have to be “applied”three times. It also needs application of the Test Management process group (TM) for project test including project(master) test plan process.The following processes would be assessed and rated separately:

— OT.1 Organization test process

— TM.1 Test strategy andplanning process [for Project Test]

— TM.2 Test monitoring and control process [for Project Test]

— TM.3 Test completion process [for Project Test]

— TM.1 Test strategy andplanning process [for Unit Testing]

— TM.2 Test monitoring and control process [for Unit Testing]

— TM.3 Test completion process [for Unit Testing]

— DT.1 Test design and implementation process [for Unit Testing]

— DT.2 Test environment and data management process [for Unit Testing]

— DT.3 Test execution process [for Unit Testing]

— DT.4 Test incident reporting process [for Unit Testing]

— TM.1 Test strategy andplanning process [for System Testing]

— TM.2 Test monitoring and control process [for System Testing]

— TM.3 Test completion process [for System Testing]

— DT.1 Test design and implementation process [for System Testing]

— DT.2 Test environment and data management process [for System Testing]

— DT.3 Test execution process [for System Testing]

— DT.4 Test incident reporting process [for System Testing]

— TM.1 Test strategy andplanning process [for Reliability Testing]

— TM.2 Test monitoring and control process [for Reliability Testing]

— TM.3 Test completion process [for Reliability Testing]

— DT.1 Test design and implementation process [for Reliability Testing]

— DT.2 Test environment and data management process [for Reliability Testing]

— DT.3 Test execution process [for Reliability Testing]

— DT.4 Test incident reporting process [for Reliability Testing]

When the lead assessor performs the rating of the Test Design and Implementation Process and Test strategy and planning process, for example, they have to be rated three times for unit testing, system testing, and reliability testing as seen in figure B.2.

Figure A.2 — Example of process rating

In the case in figure B.2, the application context shall be clearly scoped if the lead assessor is to perform rating once for each of both processes, for example, partially for the Test Design and Implementation Process and fully for the Test strategy and planning process. This means that the Test Design and Implementation Process is partially achieved, and Test strategy and planning process is fully achieved only in the scope of unit testing, system testing and reliability testing. Here, the Test strategy and planning process for project test, so called the Project(or Master) Test strategy and planning process can be assessed together or separately based on the lead assessor’s judgement.

• 1. Guideline on the use of additional processes from other PAM(informative)

Conformant with the requirements of ISO/IEC 33002 the lead assessor may decide together with the assessment sponsor to include further processes from other process assessment models, other standards, and self-defined processes (Annex E in this case). For example, if the assessment sponsor wants to assess the defect resolution capability, the process“SUP.9Problem resolution management process” from the process assessment model in ISO/IEC 15504-5 may be added. Other examples of additional processes are shown in Annex D. They include the Work Product Review Process(from ISO/IEC 20246), and the Static Analysis Process (from Annex E).

Other candidates for the additional processes can be the incident management process, the configuration management process, and so forth that the lead assessor together with the help from assessment sponsor considers necessary for practical test process assessment.

1. 
   (informative)
   
   Information product characteristics
   1. Information product categories

This annex describes the categories of information product. The category description characterizes the distinctive nature or features of the category.

• 1. Information product description

The information items associated with the processes in Clause 5 and Annex C are described in this annex. The descriptions are exemplary.

1. 
   (informative)
   
   Additional processes
   1. Static testing process group
      1. STAT.1 Work product review process

Reviewing to check testability and deriving test cases during the course of review is core part of software testing. The work product review process is from the ISO/IEC 20246, Software and systems engineering — Work product reviews.

• • 1. STAT.2Static analysis process

Static analysis has been widely adopted in industry as one of the major practices detecting defects in an efficient manner. This process is from the “E.1Static analysis” process defined on Annex E.

• 1. Test management process group
     1. TM.4 Problem resolution management process

Problem resolution management is an integral process with testing processes to improve software quality. Without proper defect triage and resolution, improving the actual quality of the test items is not possible. The problem resolution management process is directly from the “SUP.9 Problem resolution management” from the process assessment model in ISO/IEC 15504-5 (withdrawn).

1. 
   (informative)
   
   Supplementary process definition
   1. Static analysis process

Process ID STAT.2

Process name Static analysis process

Process purpose

The purpose of the static analysisprocess is to identify all test items, define the static analysis method, perform thestatic analysis and report the outcomes.

Process outcomes

As a result of successful implementation of the static analysisprocess:

a) the static analysis items are selected;

b) the static analysis method is chosen;

c) if appropriate, the static analysis rules are selected;

d) the tools and environment are ready;

e) the static analysis is performed;

f) the static analysis results are recorded;

g) incidents are resolved as part of the Incident Reporting Process.

NOTE This process description is modified based on the “static analysis preparation” process and “Perform static analysis” process of PRM, ISO/IEC CD1 29119-2:2011, Systems and Software Engineering — Software Testing — Part 2: Test Processes.

Bibliography

NOTE The following documents contain definitions and may provide general guidance to terms in the indicator set.

[1] ISO 9001:2015, Quality management systems — Requirements

[2] ISO 9004:2018, Quality management — Quality of an organization — Guidance to achieve sustained success

[3] ISO/IEC/TR 9294:2005, Information technology — Guidelines for the management of softwaredocumentation

[4] ISO 10007:2017, Quality management — Guidelines for configuration management

[5] ISO/IEC 12207:2017, Systems and software engineering — Software life cycle processes

[6] ISO/IEC 15288:2023, Systems engineering — System life cycle processes

[7] ISO/IEC 15289:2019, Systems and software engineering — Content of systems and software lifecycle process information products (Documentation)

[8] ISO/IEC/TS 33061:2021, Information technology — Process assessment — Process assessment model for software life cycle processes

[9] ISO/IEC 25000:2014, Systems and software engineering — Systems and software Quality Requirements and Evaluation (SQuaRE) — Guide to SQuaRE

[10] ISO/IEC/IEEE 29119‑3:2021, Software and systems engineering — Software testing — Part 3: Test documentation

[11] ISO/IEC/IEEE 29119‑4:2021, Software and systems engineering — Software testing — Part 4: Test techniques

[12] ISO/IEC 33002:2015, Information technology — Process assessment — Requirements for performing process assessment

[13] ISO/IEC 15504‑5:2012, Information technology - Process assessment – Part 5: An exemplar software process assessment model (withdrawn)