SANS 16085-2007 Systems and software engineering - Life cycle processes - Risk management《系统和软件工程 寿命周期过程 风险管理》.pdf

1、 Collection of SANS standards in electronic format (PDF) 1. Copyright This standard is available to staff members of companies that have subscribed to the complete collection of SANS standards in accordance with a formal copyright agreement. This document may reside on a CENTRAL FILE SERVER or INTRA

2、NET SYSTEM only. Unless specific permission has been granted, this document MAY NOT be sent or given to staff members from other companies or organizations. Doing so would constitute a VIOLATION of SABS copyright rules. 2. Indemnity The South African Bureau of Standards accepts no liability for any

3、damage whatsoever than may result from the use of this material or the information contain therein, irrespective of the cause and quantum thereof. ISBN 978-0-626-20226-2 SANS 16085:2007Edition 1ISO/IEC 16085:2006Edition 2SOUTH AFRICAN NATIONAL STANDARD Systems and software engineering Life cycle pro

4、cesses Risk management This national standard is the identical implementation of ISO/IEC 16085:2006 and is adopted with the permission of the International Organization for Standardization and the International Electrotechnical Commission. Published by Standards South Africa 1 dr lategan road groenk

5、loof private bag x191 pretoria 0001 tel: 012 428 7911 fax: 012 344 1568 international code + 27 12 www.stansa.co.za Standards South Africa SANS 16085:2007 Edition 1 ISO/IEC 16085:2006 Edition 2 Table of changes Change No. Date Scope National foreword This South African standard was approved by Natio

6、nal Committee StanSA SC 71C, Information technology ICT systems and software engineering, in accordance with procedures of Standards South Africa, in compliance with annex 3 of the WTO/TBT agreement. This SANS document was published in August 2007. Reference numberISO/IEC 16085:2006(E)IEEEStd 16085-

7、2006INTERNATIONAL STANDARD ISO/IEC16085IEEEStd 16085-2006Second edition2006-12-15Systems and software engineering Life cycle processes Risk management Ingnierie des systmes et du logiciel Processus du cycle de vie Gestion des risques SANS 16085:2007This s tandard may only be used and printed by appr

8、oved subscription and freemailing clients of the SABS .ISO/IEC 16085:2006(E) IEEE Std 16085-2006 PDF disclaimer This PDF file may contain embedded typefaces. In accordance with Adobes licensing policy, this file may be printed or viewed but shall not be edited unless the typefaces which are embedded

9、 are licensed to and installed on the computer performing the editing. In downloading this file, parties accept therein the responsibility of not infringing Adobes licensing policy. The ISO Central Secretariat accepts no liability in this area. Adobe is a trademark of Adobe Systems Incorporated. Det

10、ails of the software products used to create this PDF file can be found in the General Info relative to the file; the PDF-creation parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodies. In the unlikely event that a problem

11、relating to it is found, please inform the Central Secretariat at the address given below. ISO Case postale 56 CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.org Web www.iso.org ii SANS 16085:2007This s tandard may only be used and printed by approved subscription

12、 and freemailing clients of the SABS .ISO/IEC 16085:2006(E)(Revision ofIEEE Std 1540-2001)Systems and software engineering Life cycle processes Risk management SponsorSoftware +1 978 750 8400. Permission to photocopy portions ofany individual standard for educational classroom use can also be obtain

13、ed through the Copyright ClearanceCenter.NOTEAttention is called to the possibility that implementation of this standard may require use of subjectmatter covered by patent rights. By publication of this standard, no position is taken with respect to theexistence or validity of any patent rights in c

14、onnection therewith. The IEEE shall not be responsible foridentifying patents for which a license may be required by an IEEE standard or for conducting inquiries into thelegal validity or scope of those patents that are brought to its attention.SANS 16085:2007This s tandard may only be used and prin

15、ted by approved subscription and freemailing clients of the SABS .iv Copyright 2006 IEEE. All rights reservedIEEE IntroductionRisk management is a key discipline for making effective decisions and communicating the results withinorganizations. The purpose of risk management is to identify potential

16、managerial and technical problemsbefore they occur so that actions can be taken that reduce or eliminate the probability and/or impact of theseproblems should they occur. It is a critical tool for continuously determining the feasibility of project plans,for improving the search for and identificati

17、on of potential problems that can affect life cycle activities andthe quality and performance of products, and for improving the active management of projects. This standard can be applied equally to systems and software. Annex D is specific to software and the ISO/IEC 12207 series of life cycle sta

18、ndards, in order to summarize where risk management is mentioned, in lieuof a specific risk management process. Notice to usersErrataErrata, if any, for this and all other standards can be accessed at the following URL: http:/standards.ieee.org/reading/ieee/updates/errata/index.html. Users are encou

19、raged to check this URL forerrata periodically.InterpretationsCurrent interpretations can be accessed at the following URL: http:/standards.ieee.org/reading/ieee/interp/index.html.PatentsAttention is called to the possibility that implementation of this standard may require use of subject mattercove

20、red by patent rights. By publication of this standard, no position is taken with respect to the existence orvalidity of any patent rights in connection therewith. The IEEE shall not be responsible for identifyingpatents or patent applications for which a license may be required to implement an IEEE

21、standard or forconducting inquiries into the legal validity or scope of those patents that are brought to its attention.This introduction is not part of ISO/IEC/IEEE 16085:2006, Systems and software engineering Life cycleprocesses Risk management.SANS 16085:2007This s tandard may only be used and pr

22、inted by approved subscription and freemailing clients of the SABS .Copyright 2006 IEEE. All rights reserved vParticipantsThe following individuals participated in the development of this standard. Robert N. Charette, ChairPaul R. CrollCheryl JonesGarry J. RoedlerJames W. MooreWhen the IEEE-SA Stand

23、ards Board approved this standard, it had the following membership:Steve M. Mills, ChairRichard H. Hulett, Vice ChairDon Wright, Past ChairJudith Gorman, Secretary*Member EmeritusAlso included are the following nonvoting IEEE-SA Standards Board liaisons:Satish K. Aggarwal, NRC RepresentativeRichard

24、DeBlasio, DOE RepresentativeAlan H. Cookson, NIST RepresentativeMichael D. FisherIEEE Standards Project EditorMark D. BowmanDennis B. BrophyJoseph BruderRichard CoxBob DavisJulian Forster*Joanna N. GueninMark S. HalpinRaymond HapemanWilliam B. HopfLowell G. JohnsonHerman KochJoseph L. Koepfinger*Dav

25、id J. LawDaleep C. MohlaPaul NikolichT. W. OlsenGlenn ParsonsRonald C. PetersenGary S. RobinsonFrank StoneMalcolm V. ThadenRichard L. TownsendJoe D. WatsonHoward L. WolfmanSANS 16085:2007This s tandard may only be used and printed by approved subscription and freemailing clients of the SABS .vi Copy

26、right 2006 IEEE. All rights reservedContents1. Overview 11.1 Scope 11.2 Purpose. 11.3 Field of application 21.4 Conformance 21.5 Disclaimer 32. Normative references. 33. Definitions . 34. Application of this standard. 65. Risk management in the life cycle. 65.1 Risk management process 65.2 Null Clau

27、se 15Annex A (informative) Risk management plan. 16Annex B (informative) Risk action request . 19Annex C (informative) Risk treatment plan 21Annex D (informative) Application of risk management in the software life cycle . 23Annex E (informative) Annotated bibliography 30SANS 16085:2007This s tandar

28、d may only be used and printed by approved subscription and freemailing clients of the SABS .Copyright 2006 IEEE. All rights reserved 1Systems and software engineering Life cycle processes Risk management1. OverviewThis standard prescribes a continuous process for risk management. Clause 1 provides

29、an overview anddescribes the purpose, scope, and field of application, as well as prescribing the conformance criteria. Clause2 lists the normative references; informative references are provided in Annex E. Clause 3 providesdefinitions. Clause 4 describes how risk management is applied to the life

30、cycle. Clause 5 prescribes therequirements for a risk management process. There are several informative annexes. Annex A, Annex B, and Annex C recommend content of three docu-ments: Risk Management Plan, Risk Action Request, and Risk Treatment Plan. Annex D summarizes whererisk management is mention

31、ed in the ISO/IEC 12207 series of software life cycle process standards. Anequivalent annex is not included for ISO/IEC 15288, the system life cycle process standard, since it includesa risk management process. Annex E, as previously mentioned, is an annotated bibliography of standardsand other docu

32、ments related to the material covered in this standard.1.1 ScopeThis standard describes a process for the management of risk during systems or software acquisition, supply,development, operations, and maintenance.1.2 PurposeThe purpose of this standard is to provide suppliers, acquirers, developers,

33、 and managers with a single set ofprocess requirements suitable for the management of a broad variety of risks. This standard does not providedetailed risk management techniques, but instead focuses on defining a process for risk management inwhich any of several techniques may be applied.1.3 Field

34、of applicationThis standard defines a process for the management of risk throughout the life cycle. This standard is suit-able for adoption by an organization for application to all appropriate projects. This standard is useful formanaging the risks associated with organizations dealing with system

35、or software issues. FINAL DRAFT / PROJET FINALSANS 16085:2007This s tandard may only be used and printed by approved subscription and freemailing clients of the SABS .ISO/IEC 16085:2006(E) SYSTEMS AND SOFTWARE ENGINEERING 2 Copyright 2006 IEEE. All rights reservedThis standard may be applied in conj

36、unction with the ISO/IEC 12207:1995 series of standards, ISO/IEC15288, or applied independently. 1.3.1 Application with ISO/IEC 12207:1995 seriesISO/IEC 12207:1995 is currently the ISOs “umbrella” standard describing standard processes for the acqui-sition, supply, development, operations, and maint

37、enance of software. The standard recognizes that activelymanaging risk is a key success factor in the management of a software project. ISO/IEC 12207:1995 men-tions risk and risk management in several places, but did not provide a process for risk management (seeAnnex D). This risk management standa

38、rd provides that process in a manner aligned with the risk manage-ment process definition provided by subsequent amendments to ISO/IEC 12207. This standard may be usedfor managing organizational-level risk or project-level risk, in any domain or life cycle phase, to support theperspectives of manage

39、rs, participants, and other stakeholders. In the life cycle process framework provided by ISO/IEC 12207:1995, risk management is an “organiza-tional life cycle process.” The activities and tasks in an organizational process are the responsibility of theorganization using that process. The organizati

40、on therefore ensures that this process has been established.When used with ISO/IEC 12207:1995, this standard assumes that the other management and technical pro-cesses of ISO/IEC 12207 perform the treatment of risk. Appropriate relationships to those processes aredescribed. 1.3.2 Application with IS

41、O/IEC 15288:2002 seriesISO/IEC 15288:2002 includes a risk management process and mentions risk and risk management in severalplaces. This standard may be used for managing organizational-level risk, enterprise-level risk, or project-level risk, in any domain or life cycle stage, to support the persp

42、ectives of managers, participants, and otherstakeholders.16085 is broadly compatible with the risk management process documented in ISO/IEC 15288:2002 andprovides additional process information to aid planning and execution of risk management. When used withISO/IEC 15288:2002, this standard assumes

43、that the other management and technical processes of ISO/IEC15288 perform the treatment of risk. The scope, purpose, field of application, and conformance requirementsin Clause 1 can be interpreted for system life cycle application. The definitions (Clause 3), process informa-tion (Clause 5) and out

44、lines for the risk management plan (Annex A), risk action request (Annex B), and risktreatment plan (Annex C) can be directly applied to the system life cycle. 1.3.3 Application independent of ISO/IEC seriesThis standard may be used independently of any particular systems or software life cycle proc

45、ess standard.When used in this manner, the standard applies additional provisions for the treatment of risk. 1.4 ConformanceAn organization or project may claim conformance to this standard by implementing a process, demonstrat-ing through plans and performance all of the requirements (specified as

46、mandatory by the word shall) in theactivities and tasks described in Clause 5.Note that in those instances where this standard is applied independently of ISO/IEC 12207:1995 or ISO/IEC 15288:2002, an additional set of requirements for risk treatment is provided in 5.1.4.2.IEEE Std 16085-2006SANS 160

47、85:2007This s tandard may only be used and printed by approved subscription and freemailing clients of the SABS .LIFE CYCLE PROCESSES RISK MANAGEMENTCopyright 2006 IEEE. All rights reserved 31.5 DisclaimerThis standard establishes minimum requirements for a risk management process, activities and ta

48、sks. Imple-menting these requirements or the preparation of risk management plans or risk action requests according tothis standard does not ensure an absence of risks. Conformance with this standard does not absolve any partyfrom any social, moral, financial, or legal obligation.2. Normative refere

49、ncesThe following referenced documents are indispensable for the application of this document. For datedreferences, only the edition cited applies. For undated references, the latest edition of the referenceddocument (including any amendments or corrigenda) applies. ISO/IEC 12207:1995, Information Technology Software Life Cycle Processes.1ISO/IEC 12207:1995/AMD.1:2002, Information Technology Software Life Cycle Processes Amendment 1.ISO/IEC 12207:1995/AMD.2:2003, Information Technology Software Life Cycle Processes Amendment 2.ISO/