1、 Reference numberISO/IEC 16085:2006(E)IEEEStd 16085-2006INTERNATIONAL STANDARD ISO/IEC16085IEEEStd 16085-2006Second edition2006-12-15Systems and software engineering Life cycle processes Risk management Ingnierie des systmes et du logiciel Processus du cycle de vie Gestion des risques ISO/IEC 16085:
2、2006(E) IEEE Std 16085:2006(R2011) (Revision of IEEE Std 1540-2001) Systems and software engineering Life cycle processes Risk management Sponsor Software the PDF-creation parameters were optimized for printing. Every care has been taken to ensure that the file is suitable for use by ISO member bodi
3、es. In the unlikely event that a problem relating to it is found, please inform the Central Secretariat at the address given below. ISO Case postale 56 x CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.org Web www.iso.org ii This ISO/IEC/IEEE document is an Interna
4、tional Standard and is copyright-protected by ISO, IEC, and the IEEE. Except aspermitted under the applicable laws of the users country, neither this ISO/IEC/IEEE standard nor any extract from it may bereproduced, stored in a retrieval system or transmitted in any form or by any means, electronic, p
5、hotocopying, recording orotherwise, without prior written permission being secured.Requests for permission to reproduce should be addressed to either ISO, IEC, or the IEEE at the addresses below.Print: ISBN 0-7381-4968-3 SH95519PDF: ISBN 0-7381-4969-1 SS95519No part of this publication may be reprod
6、uced in any form, in an electronic retrieval system or otherwise, without the priorwritten permission of the publisher.Abstract: A process for the management of risk in the life cycle is defined. It can be added to theexisting set of software life cycle processes defined by the ISO/IEC 12207 or ISO/
7、IEC 15288series of standards, or it can be used independently.Keywords: integrity, risk, risk acceptance, risk analysis, risk management, risk treatmentISO copyright office Case postale 56 CH-1211 Geneva 20 Tel. + 41 22 749 01 11 Fax + 41 22 749 09 47 E-mail copyrightiso.org Web www.iso.orgHead of S
8、ales, Marketing +1 978 750 8400. Permission to photocopy portions ofany individual standard for educational classroom use can also be obtained through the Copyright ClearanceCenter.NOTEAttention is called to the possibility that implementation of this standard may require use of subjectmatter covere
9、d by patent rights. By publication of this standard, no position is taken with respect to theexistence or validity of any patent rights in connection therewith. The IEEE shall not be responsible foridentifying patents for which a license may be required by an IEEE standard or for conducting inquirie
10、s into thelegal validity or scope of those patents that are brought to its attention.iv Copyright 2006 IEEE. All rights reservedIEEE IntroductionRisk management is a key discipline for making effective decisions and communicating the results withinorganizations. The purpose of risk management is to
11、identify potential managerial and technical problemsbefore they occur so that actions can be taken that reduce or eliminate the probability and/or impact of theseproblems should they occur. It is a critical tool for continuously determining the feasibility of project plans,for improving the search f
12、or and identification of potential problems that can affect life cycle activities andthe quality and performance of products, and for improving the active management of projects. This standard can be applied equally to systems and software. Annex D is specific to software and the ISO/IEC 12207 serie
13、s of life cycle standards, in order to summarize where risk management is mentioned, in lieuof a specific risk management process. Notice to usersErrataErrata, if any, for this and all other standards can be accessed at the following URL: http:/standards.ieee.org/reading/ieee/updates/errata/index.ht
14、ml. Users are encouraged to check this URL forerrata periodically.InterpretationsCurrent interpretations can be accessed at the following URL: http:/standards.ieee.org/reading/ieee/interp/index.html.PatentsAttention is called to the possibility that implementation of this standard may require use of
15、 subject mattercovered by patent rights. By publication of this standard, no position is taken with respect to the existence orvalidity of any patent rights in connection therewith. The IEEE shall not be responsible for identifyingpatents or patent applications for which a license may be required to
16、 implement an IEEE standard or forconducting inquiries into the legal validity or scope of those patents that are brought to its attention.This introduction is not part of ISO/IEC/IEEE 16085:2006, Systems and software engineering Life cycleprocesses Risk management.Copyright 2006 IEEE. All rights re
17、served vParticipantsThe following individuals participated in the development of this standard. Robert N. Charette, ChairPaul R. CrollCheryl JonesGarry J. RoedlerJames W. MooreWhen the IEEE-SA Standards Board approved this standard, it had the following membership:Steve M. Mills, ChairRichard H. Hul
18、ett, Vice ChairDon Wright, Past ChairJudith Gorman, Secretary*Member EmeritusAlso included are the following nonvoting IEEE-SA Standards Board liaisons:Satish K. Aggarwal, NRC RepresentativeRichard DeBlasio, DOE RepresentativeAlan H. Cookson, NIST RepresentativeMichael D. FisherIEEE Standards Projec
19、t EditorMark D. BowmanDennis B. BrophyJoseph BruderRichard CoxBob DavisJulian Forster*Joanna N. GueninMark S. HalpinRaymond HapemanWilliam B. HopfLowell G. JohnsonHerman KochJoseph L. Koepfinger*David J. LawDaleep C. MohlaPaul NikolichT. W. OlsenGlenn ParsonsRonald C. PetersenGary S. RobinsonFrank S
20、toneMalcolm V. ThadenRichard L. TownsendJoe D. WatsonHoward L. Wolfmanvi Copyright 2006 IEEE. All rights reservedContents1. Overview 11.1 Scope 11.2 Purpose. 11.3 Field of application 21.4 Conformance 21.5 Disclaimer 32. Normative references. 33. Definitions . 34. Application of this standard. 65. R
21、isk management in the life cycle. 65.1 Risk management process 65.2 Null Clause 15Annex A (informative) Risk management plan. 16Annex B (informative) Risk action request . 19Annex C (informative) Risk treatment plan 21Annex D (informative) Application of risk management in the software life cycle .
22、23Annex E (informative) Annotated bibliography 30Copyright 2006 IEEE. All rights reserved 1Systems and software engineering Life cycle processes Risk management1. OverviewThis standard prescribes a continuous process for risk management. Clause 1 provides an overview anddescribes the purpose, scope,
23、 and field of application, as well as prescribing the conformance criteria. Clause2 lists the normative references; informative references are provided in Annex E. Clause 3 providesdefinitions. Clause 4 describes how risk management is applied to the life cycle. Clause 5 prescribes therequirements f
24、or a risk management process. There are several informative annexes. Annex A, Annex B, and Annex C recommend content of three docu-ments: Risk Management Plan, Risk Action Request, and Risk Treatment Plan. Annex D summarizes whererisk management is mentioned in the ISO/IEC 12207 series of software l
25、ife cycle process standards. Anequivalent annex is not included for ISO/IEC 15288, the system life cycle process standard, since it includesa risk management process. Annex E, as previously mentioned, is an annotated bibliography of standardsand other documents related to the material covered in thi
26、s standard.1.1 ScopeThis standard describes a process for the management of risk during systems or software acquisition, supply,development, operations, and maintenance.1.2 PurposeThe purpose of this standard is to provide suppliers, acquirers, developers, and managers with a single set ofprocess re
27、quirements suitable for the management of a broad variety of risks. This standard does not providedetailed risk management techniques, but instead focuses on defining a process for risk management inwhich any of several techniques may be applied.1.3 Field of applicationThis standard defines a proces
28、s for the management of risk throughout the life cycle. This standard is suit-able for adoption by an organization for application to all appropriate projects. This standard is useful formanaging the risks associated with organizations dealing with system or software issues. FINAL DRAFT / PROJET FIN
29、ALISO/IEC 16085:2006(E) SYSTEMS AND SOFTWARE ENGINEERING 2 Copyright 2006 IEEE. All rights reservedThis standard may be applied in conjunction with the ISO/IEC 12207:1995 series of standards, ISO/IEC15288, or applied independently. 1.3.1 Application with ISO/IEC 12207:1995 seriesISO/IEC 12207:1995 i
30、s currently the ISOs “umbrella” standard describing standard processes for the acqui-sition, supply, development, operations, and maintenance of software. The standard recognizes that activelymanaging risk is a key success factor in the management of a software project. ISO/IEC 12207:1995 men-tions
31、risk and risk management in several places, but did not provide a process for risk management (seeAnnex D). This risk management standard provides that process in a manner aligned with the risk manage-ment process definition provided by subsequent amendments to ISO/IEC 12207. This standard may be us
32、edfor managing organizational-level risk or project-level risk, in any domain or life cycle phase, to support theperspectives of managers, participants, and other stakeholders. In the life cycle process framework provided by ISO/IEC 12207:1995, risk management is an “organiza-tional life cycle proce
33、ss.” The activities and tasks in an organizational process are the responsibility of theorganization using that process. The organization therefore ensures that this process has been established.When used with ISO/IEC 12207:1995, this standard assumes that the other management and technical pro-cess
34、es of ISO/IEC 12207 perform the treatment of risk. Appropriate relationships to those processes aredescribed. 1.3.2 Application with ISO/IEC 15288:2002 seriesISO/IEC 15288:2002 includes a risk management process and mentions risk and risk management in severalplaces. This standard may be used for ma
35、naging organizational-level risk, enterprise-level risk, or project-level risk, in any domain or life cycle stage, to support the perspectives of managers, participants, and otherstakeholders.16085 is broadly compatible with the risk management process documented in ISO/IEC 15288:2002 andprovides ad
36、ditional process information to aid planning and execution of risk management. When used withISO/IEC 15288:2002, this standard assumes that the other management and technical processes of ISO/IEC15288 perform the treatment of risk. The scope, purpose, field of application, and conformance requiremen
37、tsin Clause 1 can be interpreted for system life cycle application. The definitions (Clause 3), process informa-tion (Clause 5) and outlines for the risk management plan (Annex A), risk action request (Annex B), and risktreatment plan (Annex C) can be directly applied to the system life cycle. 1.3.3
38、 Application independent of ISO/IEC seriesThis standard may be used independently of any particular systems or software life cycle process standard.When used in this manner, the standard applies additional provisions for the treatment of risk. 1.4 ConformanceAn organization or project may claim conf
39、ormance to this standard by implementing a process, demonstrat-ing through plans and performance all of the requirements (specified as mandatory by the word shall) in theactivities and tasks described in Clause 5.Note that in those instances where this standard is applied independently of ISO/IEC 12
40、207:1995 or ISO/IEC 15288:2002, an additional set of requirements for risk treatment is provided in 5.1.4.2.IEEE Std 16085-2006LIFE CYCLE PROCESSES RISK MANAGEMENTCopyright 2006 IEEE. All rights reserved 31.5 DisclaimerThis standard establishes minimum requirements for a risk management process, act
41、ivities and tasks. Imple-menting these requirements or the preparation of risk management plans or risk action requests according tothis standard does not ensure an absence of risks. Conformance with this standard does not absolve any partyfrom any social, moral, financial, or legal obligation.2. No
42、rmative referencesThe following referenced documents are indispensable for the application of this document. For datedreferences, only the edition cited applies. For undated references, the latest edition of the referenceddocument (including any amendments or corrigenda) applies. ISO/IEC 12207:1995,
43、 Information Technology Software Life Cycle Processes.1ISO/IEC 12207:1995/AMD.1:2002, Information Technology Software Life Cycle Processes Amendment 1.ISO/IEC 12207:1995/AMD.2:2003, Information Technology Software Life Cycle Processes Amendment 2.ISO/IEC 15026:1998, Information Technology System and
44、 Software Integrity Levels.ISO/IEC 15288: 2002, Systems Engineering System life cycle processes NOTES1ISO/IEC 12207:1995 is not needed if this standard is being applied independently of ISO/IEC 12207.2IEEE/EIA 12207.0-1996 may be used as a replacement for ISO/IEC 12207:1995.23ISO/IEC 15288:2002 is n
45、ot needed if this standard is being applied independently of ISO/IEC 15288.3. DefinitionsFor the purposes of this document, the following terms and definitions apply. The Authoritative Dictionaryof IEEE Standard Terms B19 should be referenced for terms not defined in this clause.3.1 consequence: An
46、outcome of an event.NOTES1There can be more than one consequence from one event.2Consequences can range from positive to negative. However, consequences are always negative for safety aspects.3Consequences can be expressed qualitatively or quantitatively.ISO Guide 73:2002, definition 3.1.23.2 event:
47、 The occurrence of a particular set of circumstances.1ISO/IEC publications are available from the ISO Central Secretariat, Case Postale 56, 1 rue de Varemb, CH-1211, Genve 20, Swit-zerland/Suisse (http:/www.iso.ch/). ISO/IEC publications are also available in the United States from Global Engineerin
48、g Documents,15 Inverness Way East, Englewood, Colorado 80112, USA (http:/ Electronic copies are available in the United Statesfrom the American National Standards Institute, 11 West 42nd Street, 13th Floor, New York, NY 10036, USA (http:/www.ansi.org/).2IEEE publications are available from the Insti
49、tute of Electrical and Electronics Engineers, 445 Hoes Lane, P.O. Box 1331, Piscat-away, NJ 08855-1331, USA (http:/standards.ieee.org/).ISO/IEC 16085:2006(E)IEEE Std 16085-2006SYSTEMS AND SOFTWARE ENGINEERING 4 Copyright 2006 IEEE. All rights reservedNOTES1The event can be certain or uncertain.2The event can be a single occurrence or a series of occurrences.3The probability associated with the event can be estimated for a given period of time.ISO Guide 7
