tickitplus – what it can do for you
Post on 25-Feb-2016
33 Views
Preview:
DESCRIPTION
TRANSCRIPT
TickITplus – what it can do for you
Talk to BCS HantsMarch 2012
Graham GeeQuality & InfoSec Manager
Graham GeeBSc in Astrophysics and PhD in Submillimetre Astronomy at Queen Mary College, University of London26+ years in IT industryWide range of employers, clients, market sectorsPreviously 10 years in mainland Europe (NL, CH, B, D)20+ years in quality assurance, consultancy and managementLast 4.5 years Quality & InfoSec Manager at IPL in Bath20 years as MBCS, <1 as FBCSBCS Council member/trustee in early 00’s – change programme
Use this layout for text on top of a vertically striped picture.
IPL backgroundTrusted, independent consulting & solutions house• 30 year track record• 260 staff, £28m+ turnover• Business/mission critical contexts• Consistently exceed expectations• Multiple market sectors
Re-defined strategy (MBO April ‘08)
• Intelligent Business• Four service offerings
• Business and technical consulting• Solution delivery, managed services
• Raising our profile
Official Business Partner
IPL DifferentiatorsQuality & adaptability of staffDepth of business & technical knowledge Execution & deliveryQuality of outputValue for moneyLong term business relationshipsCommercial flexibilityTransparency & trustSize & scale
Aerospace & Defence
Ministry of DefenceFlight RefuellingEADSThalesLogicaGE Aviation
Avionics systemsMission planning
Crypto key managementSecure communications
Network managementIn-flight refuelling
Banking & Finance
NationwideClydesdale BankBank of EnglandBarclaysBristol & West Investments
Online financial product applicationsCore banking systems
Asset & unit pricing controlLiquidity reporting
Data migration & integrationPensions policy administration
Emergency Services
EADS FiReControlHertfordshire ConstabularyKent PoliceNorthamptonshire PoliceNPIAWiltshire Police
Core policing systemsISS4PS complianceCollision recordingANPR data analysis
GIS & crime mappingMobile data solutions
Government
Local AuthoritiesAudit CommissionMet OfficeGovernment OmbudsmenTechnology Strategy Board
Web portalsWeb-enabled Information
Complaints handling“Digital Britain” testing
GIS & mapping applications
Industry
A Global Energy CompanyImperial Tobacco GroupIBMGlaxoSmithKlineFertility Focus
Data warehouse & applicationsManagement information systems
Information management & SOAClinical drug trials data archive
Medical devices
Telecoms, Broadcast & Media
Nokia MusicEricssonNSNAeponaO2
OrangeUbiquisys
GSM core network systemsTransmission and QoS management
Intelligent NetworksMultimedia services
Network/Service Management SystemsTechnical Launch Services
Transport
AmeyAtkinsHighways AgencyMouchelTfLWincanton
Traffic control centre systemsManaged motorways
Intelligent transport systemsTransport logistics
Asset management
IPL’s origins more than 30 years ago in UK Aerospace and DefenceRange of market sectors/customers, business/mission critical contextsObjective since 1979 “to provide customers with high quality, high reliability software within timescale, budget and specification”“Quality is the responsibility of all individuals within the Company”More than 20 years ago (before SEI’s CMM existed)
By 1988 IPL’s QMS and processes were aligned to the international standard ISO 9001 and a few years later the TickIT software sector-specific schemeTickIT was largely adopted by the UK software development industryEspecially in IPL’s core market sector with high quality requirements
IPL’s Focus on Quality
TickITBuilt into certification to ISO 9001 with regular external assessment by specially qualified auditors (in IPL’s case this is six-monthly by BSI and now LRQA)Was mandatory for many years for software companies working directly or indirectly for MoDIs a best practice guide aligned with international standards ISO 9001, ISO 9000-3 and ISO 12207
QMS Pressures 2010-2012Wide range of market sectors, systems, applications and technologiesIncreasing emphasis on business processes rather than detailed technical proceduresQMS not kept pace with changing world – needs modern approach, flexible, responsive, look-and-feelProcess-based approach and measurement:
Services Business Manual, TickITplusManaged services:
Application take-on, support, ITIL, ISO20000?IP generation: Product development
Accreditations & Affiliations
ISO 9001:2008/TickIT ISO 27001:2005 ISO 14001:2004
Was due to launch in January 20113-year “clock” to migrate from TickIT started ticking in Dec 2011Adds process capability assessment, with levels mapped to international standard ISO/IEC 15504, similar to CMMISo moves TickIT to same basis as CMMI but also
Backed by UK plc (including BSI, BCS, Intellect, MoD)Integral part of certification to international standard ISO 9001 by certification bodies such as BSI, LRQA and DNVRequires mapping of project, technical, organisational, IT-specific, agreement and maturity processes to the Base Processes Library
TickITplus
IPL’s 1st plan v. TickITplus levels
ISO 15504 process levels TickITplus Target1. Performed Foundation 20112. Managed Bronze 20113. Established Silver 20114. Predictable Gold 20125. Optimizing Platinum 2013
TickIT lead auditor course in 2006:Declining interest in the scheme; only one accredited trainer in the UK;Auditor and company registrations dropping; only ever good practice guidance;CMMI stolen march in India and elsewhere from its US origins
Joined IPL in Oct 2007 aiming to bring QMS into 21st centuryLong experience in Quality/TickIT and with BCS TickITplus coming “soon” as UK alternative to CMMI…Occasionally we get pressure around our plans w.r.t. CMMI in questionnaires and responses
Happened again at end of 2010 around Thales preferred supplier selection
TickITplus was a long time coming – chronic lack of communication
Steps to TickITplus: 2006-2010
Transition of Certification Body to LRQA – December 2010Kept the faith –> information sessions hosted at Intellect, early 2011Speculative gap analysis cf. list of process titles – March/April 2011Assessor/practitioner training by Dave Wynn for IT Governance – JuneBase Process Library (BPL) finally published – also June 2011 Confirmed gap analysis (cf. BPL) –> 1st draft PRM – July 20113-year “clock” to migrate from TickIT started ticking in Dec 2011LRQA Stage 1 assessment – end Sept 2011 -> 3 Minor N/CsLRQA Stage 2 assessment – Dec 2011 -> certification but 7 new Minor N/Cs (just before Christmas!) and Corrective Action Plan
Steps to TickITplus: during 2011
Eight scope profiles (currently two)40 processes (currently 22): organizational, project and technical
Mapped to four international standards (currently one and a half)
ISO 9001 ISO 20000 and ISO 27001 – resp. Q2/Q3 2012ISO 15504 – basis laid but rest later, possibly 2013
Combined assessor/practitioner training – overseen by gasqCurrently three UK Certification Bodies (BSI, DNV, LRQA)Run by Joint TickIT Industry Steering Committee (JTISC)
What does TickITplus involve?
What does TickITplus look like?
CurrentlySystems and Software Development and SupportProduct Validation, Quality and Measurement
To comeInformation Management and SecurityService ManagementProject and Programme ManagementCorporate Strategy Planning and ManagementLegal and ComplianceIT Systems Engineering and Infrastructure
Scope profiles
Human Resource ManagementManagement FrameworkCorporate Management and LegalInfrastructure and Work Environment ManagementImprovementMeasurement and AnalysisCustomer FocusRisk ManagementLifecycle Model Management
Organizational processes
Measurement and AnalysisProcess ID ORG.6 Process Name Measurement and Analysis Category Organizational Processes Type A
Process Purpose To provide information to enable better decision making. Version v1r0
Process Outcome Process Base Practices Input Work Products Output Work Products ISO 9001
OU.1 Measurements are used to demonstrate achievement of business objectives, to support decisions and identify improvement.
BP.1 Define Measurement and Analysis Policy and Procedures Policies are established, approved and communicated to ensure that measures are identified, collected, analysed, reported and used, to support the achievement of the business plan. Procedures are established for developing measures against key business objectives, to understand performance. The procedures define the method for identifying, collecting, storing, analysing and using measures. Policies and procedures are periodically reviewed and updated in line with the business plan. The policies and procedures are maintained under the management framework.
Business Plan Measurement Policy Measurement Procedures
4.2.1d) 4.2.3
Measurement is embedded in the top-level documents for each management system. There is a specific Integrated Management Procedure (IMP02) focussed on audit and improvement
[Business Needs] Strategy, Objectives, Targets, Key Performance Measures
Quality Policy IS and ISMS Policies IMP02, Audit and Improvement
BP.2 Identify Measurement Objectives and Data The organization establishes where measures are necessary and identifies the objectives and data sources necessary to achieve them. The objectives and data sources are reviewed and agreed by stakeholders.
Business Plan Stakeholder Requirements
Measurement Objectives Measurement Data Sources
5.4.1
Company-level measurement objectives are defined for each management system. The top-level objectives for the services business are in the SBM. There are more detailed measurement objectives in a document for Operations which informs the specific objectives for each software project. These are reviewed and agreed by the Quality Review Board (QRB, comprising COO, CTO and Quality Manager) for Quality, and the IS Forum for InfoSec.
Strategy, Objectives, Targets, Key Performance Measures Quality Policy IS and ISMS Policies
Quality Objectives Services Business Manual Operations Quality Objectives Quality Plan: Quality Objectives ISMS Overview
BP.3 Collect and Analyse Measurement Data Measurement data is collected and stored in line with the collection method. The measurement data is validated and any need for additional measurement is identified The measurement data is analysed to provide indicators and recommendations to stakeholders.
Measurement Objectives Measurement Data Sources
Measurement and Analysis Data Measurement And Analysis Report
8.2.3 8.2.4 8.4
CurrentlyProject ManagementConfiguration and Change ManagementProblem and Incident Management
To comeDecision ManagementInformation ManagementIT Finance ManagementManagement Reporting
Project processes
Project ManagementProcess ID PRJ.1 Process Name Project Management Category Project Procedures Type B/C
Process Purpose To ensure that the projects meet their objectives. Version v1r0
Process Outcome Process Base Practices Input Work Products Output Work Products ISO 9001
OU.1 The organization achieves project objectives in a controlled manner, and delivery is on time, in budget and to quality.
BP.1 Establish Project Management Policies and Procedures Policies are established, approved and communicated that govern the project management methodology and the delivery of projects. Procedures are defined, approved and made available for use, to implement the project management policies. The procedures cover project planning, tailoring, estimating, monitoring and control, resourcing, reporting, escalation, together with supplier, stakeholder, risk and issue management The policies and procedures are maintained under the management framework.
Business Plan Project Management Policies Project Management Procedures
4.2.1d) 4.2.3
The Delivery Manual contains the processes related to project management. It was reviewed and approved by a subset of the Board and Exec Committee. Supporting documents provide additional procedures. They are made available via the intranet.
Strategy Annual Business Plan Services Business Manual
Delivery Manual SCOP-R: Project Control Quality Objectives Management Procedure 2: Progress Reporting SCOP-P 9001, Risk Management
BP.2 Scope the Project A scope statement is defined for the project with deliverables agreed by stakeholders. The quality objectives and the requirements for the project are established and documented. Objectives, constraints and assumptions are recorded and agreed before project initiation Projects select and tailor the appropriate lifecycle model, and the rationale is documented. Estimates are produced against the agreed scope, including any necessary contingency. A budget for the work to be undertaken is prepared. The scope, objectives, constraints, selected approach, estimates and budget are reviewed by stakeholders and approved by management.
Stakeholder Requirements Scope Statement 7.2.1 7.2.2
Project scope and estimates will have been defined as part of the proposal process. The Delivery Manual and SCOP-R describe how to initiate a project. The Project Plan and Quality Plan set out the key aspects for the project to be delivered.
Invitation to Tender/Request for Proposal Proposal Delivery Manual: Initiate Project SCOP-R: Project Control Operations Quality Objectives
Project Plan Quality Plan: Project Lifecycle
Data and Record ManagementIntegration ManagementVerificationValidationTransition and Release ManagementMaintenance ManagementStakeholder Requirement DefinitionRequirements AnalysisArchitectural DesignDevelopment Implementation
Technical processes
Architectural DesignProcess ID TEC.13 Process Name Architectural Design Category Technical Processes Type B/C
Process Purpose To produce a top-level design that identifies the major components and interfaces of the product. Version v1r0
Process Outcome Process Base Practices Input Work Products Output Work Products ISO 9001
OU.1 The top-level design addresses all the system requirements, with no defects found in development.
BP.1 Establish Development Approach Different development approaches are considered in formulating the architecture design, and an approach is selected that best meets the system requirements. The selection decision and supporting rationale is documented, reviewed and approved.
Lifecycle Model Description and Assets
Selected Lifecycle 7.1 7.3.1
Initial development approach is captured in quality plan. Refined during requirements and design stages. SCOP-P 800x, Software Development Methods ETC Agile Framework
Quality Plan
BP.2 Create Architectural Design The top-level design is created taking into account the architectural standards of the organization. The major components and interfaces necessary to meet the system requirements are identified. System requirements are traceable to the major components. Interfaces include interactions between system components, and between the system and the external environment. Design constraints, assumptions and dependencies are documented.
System Requirements Top Level Design Traceability Report
4.2.1d) 4.2.3 7.3.3 7.5.3
The system is designed to ensure that it meets the system requirements, external interfaces and selected design standards. Design specifications are produced in line with the design methodology selected. SCOP-P 2001 provides the default format and content for design specs. The approach to traceability depends upon customer requirements, the nature of system under development and any applicable standards (e.g. higher levels of DO-178B) plus the design methodology and modelling tools being used.
System Requirements Spec Quality Plan: Design Process SCOP-P 200x, design standards
High Level Design Traceability Matrix
BP.3 Review Architectural Design The top-level design is reviewed by stakeholders to ensure all system requirements have been adequately addressed. The customer is advised of any adverse impact on cost, schedule and customer needs arising from the proposed top-level design, along with possible alternatives.
Top Level Design Review Records Top Level Design Customer Notifications
7.2.3 7.3.4 7.3.5 7.3.6
The review approach is defined in the Quality Plan. Detailed reviews can include Preliminary and Critical Design Reviews with customer involvement.
High Level Design Quality Plan: Review Process SCOP-P 4001, Review Standards
High Level Design Review Records
BP.4 Manage Architecture Changes Changes to the top-level design are formally controlled through the change control process. Changes to the top-level design are reviewed by stakeholders for their impact on cost, schedule and customer needs. The results of the review are communicated to stakeholders, and records maintained.
Change Request Change Record 4.2.4 7.2.3b) 7.3.7
What has TickITplus done for us?
Modern, pragmatic, detailed process/practice requirements NOT good practice guidance (cf. TickIT)Based on international standards - ISO 9001 and ISO 15504 (aka. SPICE)Scheme to be extended to allow combined assessment with ISO 20000 and ISO 27001Regular, professional and independently assured assessments by certification bodies - currently BSI, DNV and LRQA in the UK cf. CMMIMuch less bureaucratic than CMMIBUT TickITplus Foundation level (currently 22 processes) is only equivalent to CMMI Levels 2/3 (resp. 7/11 processes) with capability maturity dimension based on ISO 15504 to be added
TickITplus lessons/benefits
LRQA surveillance visit – end March 2012Some processes clearly need improving/redefining
Configuration/change management Integration managementLifecycle model management Improvement
LRQA’s recertification visit at end of August 2012Extension to cover ISO 27001 later in 2012?Could consider adding additional scope profiles?Move up to Bronze (OK) and Silver (difficult) when availableShare the good news with the UK IT community via BCS, LRQA, Intellect, with Omniprove and Nexor
IPL – where next with TickITplus?
Questions?
Dr Graham Gee FBCS CITP TSSFQuality & InfoSec Managergraham.gee@ipl.com01225 475287
Eveleigh HouseGrove StreetBath BA1 5LR01225 475000
Additional slides
To be used as required
Customers
Government
Aerospace & Defence
Banking & Finance
Emergency Services
Customers
Transport
Telecoms, Broadcast &
Media
Industry A Global EnergyCompany
Engagement Models
Managing risk• Time-boxed• Risk/reward• Fixed price
Flexibility• Time & materials• Gain share• IPR ownership
Partnership• Bid-stage engagement• Teaming agreement
Long term relationship via a range of engagement models
Staffing• Single consultant• Managed team of >50
Location• Your premises• IPL’s offices
Availability• Quick commercial response• Start within days
Business ConsultingIdentifying the business need
• Information management• Business analysis• Business process management• Business case preparation• IS strategy• Programme management
Technical ConsultingAnalysing the technical options
• Client-side - procurement support, technical project management, design authority
• Project specific - rapid prototyping, requirements capture, architecture design
• Subject matter expertise – eg telecoms technologies, secure communications, geospatial technologies
• Bid support - expert advice and technology recommendations
Solution DeliveryDelivering the solution
• Full life-cycle implementation• Software development• Systems integration• Mitigating risk and sharing development burden• Reducing development timescales
• 3rd party product expertise• Accredited quality methodology• Predictable, reliable, transparent delivery
Managed ServicesSupporting commercial solutions
• On-going support and maintenance services• 3rd party application support• System hosting• Reducing overall cost of ownership• Freeing organisation to focus
on core skills and strategic projects• Secure, modern premises• UK facilities & staff
Working with IPL“IPL is our strategic software partner...track record of delivering high quality, leading edge software...”
Commercial Director
“IPL brought a fresh and independent look at the way we develop systems...helped us to take a valuable step back from the day-to-day detail...together, we will develop more successful solutions...” CIO
“...a first class and dependable software development service... contributed value at many levels in the design and development cycle” CTO
Working with IPL
“Actually appear to live the culture of customer support and commitment. Deliver what they say they are going to deliver when they say they are going to deliver” Programme Manager
“They are a reliable, professional outfit...work hard to understand the clients requirements and deliver against them”Application Support Manager
“Very competent, very proactive, willing to assist, reliable and effective.” Programme Manager
top related