Beyond ISO 9000-3

There are a significant number of additional areas of ISO 9001 that can be addressed through CM-related activities.

4.1 Management responsibility
4.2 Quality system
4.4.2.2 Organizational and technical interfaces
4.6 Purchasing
4.7 Control of customer-supplied product
4.9 Process control
4.14 Corrective and preventive action
4.15 Handling, storage, packaging, preservation, and delivery
4.16 Control of quality records
4.19 Servicing
4.20 Statistical techniques

4.1 Management responsibility

Reports produced by the CM system on progress and exceptions support management review of the suitability and effectiveness of the development practices, as part of the quality system (ISO 9001 4.1.3).

4.2 Quality system

For a software engineering organization, the CM policies, procedures, and standards represent a significant portion of the quality system. Tools to support and automate the CM process support and enforce adherence to policies, procedures, and standards.

These procedures can also be automated through integrated workflow and groupware tools that increase the effectiveness and efficiency of the information exchange.

4.4 Design control

CM practices can go beyond control of configuration items to ensure that necessary information regarding status and change is communicated to appropriate individuals and organizations (ISO 9001 4.4.2.2).

Standard distribution lists and notification procedures linked to specific activities prevent significant missed communication.

4.6 Purchasing

The primary application of this paragraph of ISO 9001 in software engineering environments is to third party development. When an organization subcontracts software development to a third party, evaluation of the subcontractor's CM practices is a critical component of the vendor selection and approval process.

If appropriate, the subcontractor can be required to follow or implement specific CM practices.

Intermediate or final product and all related documentation (e.g., specifications, plans, progress reports, test reports) received from the subcontractor can all be treated as if they were in-house developed configuration items. Applying CM practices to third party development is of particular benefit for coordinating in-house integration and verification activities and for fault resolution.

4.7 Control of customer-supplied product

In software development, customer-supplied product includes software that is used in the development process or that is included in the product to be delivered to the customer. This software is specified by the customer and supplied by the customer or by a third party; the software can be a standard, off-the-shelf (shrink-wrapped) product or one that is custom developed.

Depending on how the included software is packaged and distributed, ISO requirements to verify, store, and maintain this software appropriately may met by considering the included software as a configuration item.

Requirements for the verification of customer-supplied product apply only to those portions of the customer-supplied product that are used in conjunction with the supplier’s product. For example, if the customer specifies that the supplier’s product is to run under UNIX System 5, the supplier’s responsibility is to verify that the developed product works as specified under UNIX System 5. The supplier must identify and report any errors in UNIX System 5 that impact the operation of the supplier’s product.