ISO 12207 software life cycle process assessment, from $800

What the ISO 12207 assessment covers

ISO/IEC/IEEE 12207:2017 defines a common framework for software life cycle processes. It describes the processes an organization uses to acquire, supply, develop, operate, maintain and retire software, with a shared vocabulary that customers, suppliers and regulators can use when they discuss how software is built.

The framework groups processes into agreement processes, such as acquisition and supply, organizational project-enabling processes, such as life cycle model management, infrastructure, portfolio, human resource, quality and knowledge management, technical management processes, such as project planning, risk, configuration and information management, measurement and quality assurance, and technical processes, from business and stakeholder needs through requirements, architecture, design, implementation, integration, verification, transition, validation, operation, maintenance and disposal.

Our assessment compares your actual development practice with the processes that matter for your work and reports where they are well defined and followed, where they are informal and where gaps create risk for quality, security or delivery.

• Selection of the processes relevant to your products and customers
• Review of process descriptions, templates and tools
• Sampling of project evidence: requirements, design, code reviews, tests, releases
• Interviews with developers, testers, product owners and managers
• Written assessment report with findings, gaps and recommendations

The assessment can cover one product team or the whole engineering organization. Starting with one team gives a quick, focused result that can then be extended, while an organization-wide scope shows how consistent practice is across teams.

Assessment options and how 12207 relates to other standards

ISO 12207 is a reference model, so the useful question is which processes to assess. A product company might focus on requirements, design, verification and maintenance; a supplier delivering software under contract might also include agreement, configuration and transition processes. We agree the selection with you, so the report covers what your customers care about.

The framework does not prescribe a methodology. Agile, iterative and traditional approaches can all meet it, as long as the purpose and outcomes of each process are achieved. We assess outcomes and evidence, not whether you use a particular method.

Several standards build on 12207. Process capability assessments in the ISO/IEC 330xx family, and Automotive SPICE in the automotive sector, use process reference models derived from it. ISO 9001 and ISO/IEC 27001 can be combined with it, for example to show quality management and secure development together.

Open source components are part of almost every product, so we also look at how they are selected, tracked and updated, since licence and vulnerability management are now part of good life cycle practice.

What decides the price

An ISO 12207 assessment with EUROTECH starts at $800. Time depends on the scope of processes and the number of projects sampled.

• Number of processes selected for assessment
• Number of projects or products sampled
• Team size and number of development sites
• Regulated software, such as medical, automotive or financial systems
• Interviews online or in person

We confirm days and every fee in a written quote. Read access to your issue tracker, repository and test reports for the sampled projects shortens the assessment considerably.

Teams that build regulated or safety-related software usually need more time, because the evidence trail from requirements to verification has to be checked in more detail.

Teams spread across several sites or companies may need extra interviews to see how practice differs between them.