1、BRITISH STANDARD BS ISO/IEC 16085:2006 Systems and software engineering Life cycle processes Risk management ICS 35.080 BS ISO/IEC 16085:2006 This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 January 2007 BSI 2007 ISBN 978-0-580-49977-7 Nati
2、onal foreword This British Standard was published by BSI. It is the UK implementation of ISO/IEC 16085:2006. It supersedes BS ISO/IEC 16085:2004 which is withdrawn. The UK participation in its preparation was entrusted to Technical Committee IST/15, Software and systems engineering. A list of organi
3、zations represented on IST/15 can be obtained on request to its secretary. This publication does not purport to include all the necessary provisions of a contract. Users are responsible for its correct application. Compliance with a British Standard cannot confer immunity from legal obligations. Ame
4、ndments issued since publication Amd. No. Date Comments Reference number ISO/IEC 16085:2006(E) IEEE Std 16085-2006INTERNATIONAL STANDARD ISO/IEC 16085 IEEE Std 16085-2006 Second edition 2006-12-15 Systems and software engineering Life cycle processes Risk management Ingnierie des systmes et du logic
5、iel Processus du cycle de vie Gestion des risques BS ISO/IEC 16085:2006ii ISO/IEC 16085:2006(E) (Revision of IEEE Std 1540-2001) Systems and software engineering Life cycle processes Risk management Sponsor Software informative references are provided in Annex E. Clause 3 provides definitions. Claus
6、e 4 describes how risk management is applied to the life cycle. Clause 5 prescribes the requirements for a risk management process. There are several informative annexes. Annex A, Annex B, and Annex C recommend content of three docu- ments: Risk Management Plan, Risk Action Request, and Risk Treatme
7、nt Plan. Annex D summarizes where risk management is mentioned in the ISO/IEC 12207 series of software life cycle process standards. An equivalent annex is not included for ISO/IEC 15288, the system life cycle process standard, since it includes a risk management process. Annex E, as previously ment
8、ioned, is an annotated bibliography of standards and other documents related to the material covered in this standard. 1.1 Scope This standard describes a process for the management of risk during systems or software acquisition, supply, development, operations, and maintenance. 1.2 Purpose The purp
9、ose of this standard is to provide suppliers, acquirers, developers, and managers with a single set of process requirements suitable for the management of a broad variety of risks. This standard does not provide detailed risk management techniques, but instead focuses on defining a process for risk
10、management in which any of several techniques may be applied. 1.3 Field of application This standard defines a process for the management of risk throughout the life cycle. This standard is suit- able for adoption by an organization for application to all appropriate projects. This standard is usefu
11、l for managing the risks associated with organizations dealing with system or software issues. JET FINAL BS ISO/IEC 16085:20062 This standard may be applied in conjunction with the ISO/IEC 12207:1995 series of standards, ISO/IEC 15288, or applied independently. 1.3.1 Application with ISO/IEC 12207:1
12、995 series ISO/IEC 12207:1995 is currently the ISOs “umbrella” standard describing standard processes for the acqui- sition, supply, development, operations, and maintenance of software. The standard recognizes that actively managing risk is a key success factor in the management of a software proje
13、ct. ISO/IEC 12207:1995 men- tions risk and risk management in several places, but did not provide a process for risk management (see Annex D). This risk management standard provides that process in a manner aligned with the risk manage- ment process definition provided by subsequent amendments to IS
14、O/IEC 12207. This standard may be used for managing organizational-level risk or project-level risk, in any domain or life cycle phase, to support the perspectives of managers, participants, and other stakeholders. In the life cycle process framework provided by ISO/IEC 12207:1995, risk management i
15、s an “organiza- tional life cycle process.” The activities and tasks in an organizational process are the responsibility of the organization using that process. The organization therefore ensures that this process has been established. When used with ISO/IEC 12207:1995, this standard assumes that th
16、e other management and technical pro- cesses of ISO/IEC 12207 perform the treatment of risk. Appropriate relationships to those processes are described. 1.3.2 Application with ISO/IEC 15288:2002 series ISO/IEC 15288:2002 includes a risk management process and mentions risk and risk management in sev
17、eral places. This standard may be used for managing organizational-level risk, enterprise-level risk, or project- level risk, in any domain or life cycle stage, to support the perspectives of managers, participants, and other stakeholders. 16085 is broadly compatible with the risk management process
18、 documented in ISO/IEC 15288:2002 and provides additional process information to aid planning and execution of risk management. When used with ISO/IEC 15288:2002, this standard assumes that the other management and technical processes of ISO/IEC 15288 perform the treatment of risk. The scope, purpos
19、e, field of application, and conformance requirements in Clause 1 can be interpreted for system life cycle application. The definitions (Clause 3), process informa- tion (Clause 5) and outlines for the risk management plan (Annex A), risk action request (Annex B), and risk treatment plan (Annex C) c
20、an be directly applied to the system life cycle. 1.3.3 Application independent of ISO/IEC series This standard may be used independently of any particular systems or software life cycle process standard. When used in this manner, the standard applies additional provisions for the treatment of risk.
21、1.4 Conformance An organization or project may claim conformance to this standard by implementing a process, demonstrat- ing through plans and performance all of the requirements (specified as mandatory by the word shall) in the activities and tasks described in Clause 5. Note that in those instance
22、s where this standard is applied independently of ISO/IEC 12207:1995 or ISO/ IEC 15288:2002, an additional set of requirements for risk treatment is provided in 5.1.4.2. BS ISO/IEC 16085:20063 1.5 Disclaimer This standard establishes minimum requirements for a risk management process, activities and
23、 tasks. Imple- menting these requirements or the preparation of risk management plans or risk action requests according to this standard does not ensure an absence of risks. Conformance with this standard does not absolve any party from any social, moral, financial, or legal obligation. 2. Normative
24、 references The following referenced documents are indispensable for the application of this document. For dated references, only the edition cited applies. For undated references, the latest edition of the referenced document (including any amendments or corrigenda) applies. ISO/IEC 12207:1995, Inf
25、ormation Technology Software Life Cycle Processes. 1 ISO/IEC 12207:1995/AMD.1:2002, Information Technology Software Life Cycle Processes Amendment 1. ISO/IEC 12207:1995/AMD.2:2003, Information Technology Software Life Cycle Processes Amendment 2. ISO/IEC 15026:1998, Information Technology System and
26、 Software Integrity Levels. ISO/IEC 15288: 2002, Systems Engineering System life cycle processes NOTES 1ISO/IEC 12207:1995 is not needed if this standard is being applied independently of ISO/IEC 12207. 2IEEE/EIA 12207.0-1996 may be used as a replacement for ISO/IEC 12207:1995. 2 3ISO/IEC 15288:2002
27、 is not needed if this standard is being applied independently of ISO/IEC 15288. 3. Definitions For the purposes of this document, the following terms and definitions apply. The Authoritative Dictionary of IEEE Standard Terms B19 should be referenced for terms not defined in this clause. 3.1 consequ
28、ence: An outcome of an event. NOTES 1There can be more than one consequence from one event. 2Consequences can range from positive to negative. However, consequences are always negative for safety aspects. 3Consequences can be expressed qualitatively or quantitatively. ISO Guide 73:2002, definition 3
29、.1.2 3.2 event: The occurrence of a particular set of circumstances. 1 ISO/IEC publications are available from the ISO Central Secretariat, Case Postale 56, 1 rue de Varemb, CH-1211, Genve 20, Swit- zerland/Suisse (http:/www.iso.ch/). ISO/IEC publications are also available in the United States from
30、 Global Engineering Documents, 15 Inverness Way East, Englewood, Colorado 80112, USA (http:/ Electronic copies are available in the United States from the American National Standards Institute, 11 West 42nd Street, 13th Floor, New York, NY 10036, USA (http:/www.ansi.org/). 2IEEE publications are ava
31、ilable from the Institute of Electrical and Electronics Engineers, 445 Hoes Lane, P.O. Box 1331, Piscat- away, NJ 08855-1331, USA (http:/standards.ieee.org/). BS ISO/IEC 16085:20064 NOTES 1The event can be certain or uncertain. 2The event can be a single occurrence or a series of occurrences. 3The p
32、robability associated with the event can be estimated for a given period of time. ISO Guide 73:2002, definition 3.1.4 3.3 probability: The extent to which an event (3.1.4) is likely to occur NOTES 1ISO 3534-1:1993, definition 1.1, gives the mathematical definition of probability as “a real number in
33、 the scale 0 to 1 attached to a random event. It can be related to a long-run relative frequency of occurrence or to a degree of belief that an event will occur. For a high degree of belief, the probability is near 1.” 2Frequency rather than probability may be used in describing risk. 3Degrees of be
34、lief about probability can be chosen as classes or ranks, such as rare/unlikely/moderate/likely/almost certain, or incredible/improbable/remote/occasional/probable/frequent. ISO Guide 73:2002, definition 3.1.3 3.4 project risk profile: A projects current and historical risk-related information; a co
35、mpendium or aggre- gate of all of the individual risk profiles in a project. NOTEThe project risk profile information includes the risk management context, along with the chronological record of risks and their individual risk profiles, priority ordering, risk-related measures, treatment status, con
36、tingency plans, and risk action requests. A project risk profile consists of a collection of the risk profiles of all the individual risks, which in turn includes the current and historical risk states. See risk profile and risk state. 3.5 risk: The combination of the probability of an event and its
37、 consequence. NOTES 1The term “risk” is generally used only when there is at least the possibility of negative consequences. 2In some situations, risk arises from the possibility of deviation from the expected outcome or event. 3See ISO/IEC Guide 51 for issues related to safety. ISO Guide 73:2002, d
38、efinition 3.1.1 3.6 risk acceptance: The decision to accept a risk. NOTES 1The verb “to accept” is chosen to convey the idea that acceptance has its basic dictionary meaning. 2Risk acceptance depends on risk criteria. ISO Guide 73:2002, definition 3.4.10 3.7 risk action request: The recommended trea
39、tment alternatives and supporting information for one or more risks determined to be above a risk threshold. 3.8 risk category: A class or type of risk (e.g., technical, legal, organizational, safety, economic, engineer- ing, cost, schedule). NOTEA risk category is a characterization of a source of risk. See source. 3.9 risk criteria: The terms of reference by which the significance of risk is assessed. BS ISO/IEC 16085:2006
