Get Certified: Proven Methods to Pass the Software Certifications CSQA Exam

Requirements Tracing is defined as the ability to describe and follow the life of a requirement, in both a forward and backward direction, ideally through the whole systems life cycle. Requirements tracing should capture all levels of requirement engineering. These levels can be defined as the technical, cognitive, and social levels. The technical level can be described as taking the customer’s interests and needs and applying them to the product’s goals, constraints, and outcomes. The cognitive level is developing an understanding between the customer and the supplier on the functionality, non-functionality, and possible side effects of the technical level. Finally, the social level is documenting the technical and cognitive levels in a comprehensive manger.

Requirement traceability is important to the project in many ways.  The CMM covers requirement traceability primarily in Software Configuration Management, but activity 10 of Software Product Engineering states the specific need for consistency and traceability between software work products.  The Requirement Management KPA states the need to manage requirements so they can be easily mapped to a specified requirement in the later steps of the software development life-cycle.  ISO also requires the ability to trace each requirement from the beginning to the end of the development phases. 

The dynamic nature of most business activities causes software or system changes. Changes require well-formulated and well-documented procedures to prevent the manipulation of programs for unauthorized purposes. The primary objective of configuration management (or change control) is to get the right change installed at the right time. Change control concerns should be identified so that proper control mechanisms can be established to deal with the concerns.

Some key points regarding changes include:

Each release of software, documentation, database, etc., should have a unique version number. Changes should be incorporated through new versions of the program. There should be a process for moving versions in and out of production on prescribed dates.

Procedures should exist for maintaining the production and source libraries. They should address when to add to the library and when prior versions should be deleted. Care should be taken to regularly review libraries for obsolete programs, as large libraries can negatively impact operations performance.

Project documentation such as requirements specifications, design documents, test plans, standards, procedures, and guidelines should also be identified with version numbers and kept under version control to ensure the project team is working with the latest, approved documents.

It is a concept that enriches an employee’s job and enables quick actions to be taken. Customer and user satisfaction is normally increased when they can get quick action from front line staff.

To be effective, empowerment must be part of a process. The empowered employee must know their limits of empowerment, and when and how they can make decisions. For example, a help desk employee may be empowered to hire a courier to deliver a report needed quickly by a user; but only up to a cost of $100. Another empowerment example would be in a “charge-out” environment where a programmer can fix a program at no charge to the user if the programmer believes the problem was caused by incorrect programming.

Most people on a job, and even in management positions, do not understand what the job is, or what is right versus wrong. Moreover, it is not clear to them how to find out.

Many of them are afraid to ask questions or to report trouble. The economic loss from fear is appalling. It is necessary, for better quality and productivity that people feel secure.

Another related aspect of fear is the inability to serve the best interest of the company through necessity to satisfy specified rules, or to satisfy a production quota, or to cut costs by some specified amount.

One common result of fear is seen in inspection. An inspector records incorrectly the result of an inspection for fear of overdrawing the quota of allowable defectives of the work force.

Incorporating risk management into the software development life cycle includes planning at the following levels:

Long-Term or High-Level

This level includes both long range planning, and optimizing the organization's mix of projects in order to obtain a balance.

Medium-Term or Medium-Level

This level deals with project management strategies, project evaluation, and selection and project portfolio management

Short-Term or Low-Level

This level includes development, integration and testing strategies.

While there is no one best way to develop a security awareness program, the process that follows is an all-inclusive process of the best security awareness training program. This example includes these three steps:

IT management creates a security awareness policy.

Develop the strategy that will be used to implement that policy.

Assign the roles for security and awareness to the appropriate individuals.

Step 1 – Create a Security Awareness Policy

The CIO and/or the IT Director need to establish a security awareness policy. The policy needs to state management’s intension regarding security awareness. Experience has shown that unless senior management actively supports security awareness, there will be a lack of emphasis on security among the staff involved in using information technology and information.

Management support for security awareness begins with the development and distribution of a security awareness policy. Once that policy has been established, management makes security awareness happen through supporting the development of a strategy and tactics for security awareness, appropriately funding those activities, and then becoming personally involved in ensuring the staff knows of management’s support for security awareness.

Step 2 – Develop a Security Awareness Strategy

A successful IT security program consists of: 1) developing an IT security policy that reflects business needs tempered by known risks; 2) informing users of their IT security responsibilities, as documented in the security policy and procedures; and 3) establishing processes for monitoring and reviewing the program.

Security awareness and training should be focused on the organization’s entire user population. Management should set the example for proper IT security behavior within an organization. An awareness program should begin with an effort that can be deployed and implemented in various ways and is aimed at all levels of the organization including senior and executive managers. The effectiveness of this effort will usually determine the effectiveness of the awareness and training program. This is also true for a successful IT security program.

An effective IT security awareness and training program explains proper rules of behavior for the use of an organization’s IT systems and information. The program communicates IT security policies and procedures that need to be followed. This must precede and lay the basis for any sanctions imposed due to noncompliance. Users first should be informed of the expectations. Accountability must be derived from a fully informed, well-trained, and aware workforce.

This step describes the relationship between awareness, training, and education – the awareness training-education continuum. An effective IT security awareness and training program can succeed only if the material used in the program is firmly based on the IT security awareness policy and IT issue-specific policies. If policies are written clearly and concisely, then the awareness and training material – based on the policies – will be built on a firm foundation.

Step 3 – Assign the Roles for Security Awareness

While it is important to have a policy that requires the development and implementation of security and training, it is crucial that IT organizations understand who has responsibility for IT security awareness and training. This step identifies and describes those within an organization that have responsibility for IT security awareness and training.

Some organizations have a mature IT security program, while other organizations may be struggling to achieve basic staffing, funding, and support. The form that an awareness and training program takes can vary greatly from organization to organization. This is due, in part, to the maturity of that program. One way to help ensure that a program matures is to develop and document IT security awareness and training responsibilities for those key positions upon which the success of the program depends.