A01_Attachment_0008_Configuration_Management_Process_Description.pdf

CONFIGURATION MANAGEMENT PROCESS DESCRIPTION (CM PD)

DOCUMENT NUMBER – SEC_Support-002

Version 3.0 13 April -2012

All SEC material must receive CECOM Public Affairs Office (PAO) review prior to public release

US Army Communications-Electronics Command (CECOM)

Software Engineering Center (SEC) 6002 Combat Drive

APG, MD 21005-1845

SEC_Support-002 iii 13 April -2012

1. PURPOSE

2. SCOPE

3. ENTRY AND EXIT CRITERIA

A. ENTRY CRITERIA

B. EXIT CRITERIA

4. INPUTS

5. OUTPUTS

6. ROLES AND RESPONSIBILITIES

7. STANDARDS PRACTICES

A. IDENTIFY CONFIGURATION ITEMS (CIS)

B. ESTABLISH A CONFIGURATION MANAGEMENT SYSTEM

C. CREATE OR RELEASE BASELINE

D. TRACK CHANGE REQUESTS

E. CONTROL CONFIGURATION ITEMS

F. ESTABLISH CONFIGURATION MANAGEMENT RECORDS

G. PERFORM CONFIGURATION AUDITS

H. PLAN THE PROCESS

I. PROVIDE RESOURCES

J. TRAINING

K. IDENTIFY AND INVOLVE RELEVANT STAKEHOLDERS

L. MONITOR AND CONTROL THE PROCESS

M. OBJECTIVELY EVALUATE ADHERENCE

N. COLLECT PROCESS RELATED EXPERIENCES

8. TAILORING GUIDELINES

9. TOOLS

10. REFERENCES

11. ACRONYMS AND DEFINITIONS

APPENDIX A – CM PROCESS FLOW ..................................................................................................... A-1 APPENDIX B – CMMI TO PROCESS DESCRIPTION MAPPING ............................................................ B-1 APPENDIX C - RECORD OF CHANGES ................................................................................................. C-1

Configuration Management Process Definition

SEC_Support-002 1 13 April 2012

1. PURPOSE

The purpose of CM is to establish and maintain the integrity of work products using configuration identification, configuration control, configuration status accounting, and configuration audits. These four functions apply to software, hardware, firmware and documentation.

The key activities include:

• Identifying the configuration of selected work products that compose baselines at any point in time

• Controlling changes to configuration items

• Building or providing specifications to build work products from the configuration management system

• Maintaining the integrity of baselines

• Providing accurate status and current configuration data to developers, end users and customers

2. SCOPE

This document applies to all personnel and efforts that SEC supports including, but not limited to: service efforts, acquired services, software development and sustainment efforts.

3. ENTRY AND EXIT CRITERIA

A. ENTRY CRITERIA

The entry criteria for the process includes, but is not limited to the following:

• A new project

• Any task or assignment is accepted which forms the baseline for CM activities

B. EXIT CRITERIA

The exit criteria for the process can be any or all of the following:

• The project has been completed

• Project has been cancelled

4. INPUTS

Inputs account for items that come from outside the process that are used during the execution of the process. Inputs to the process can include, but are not limited to:

• Work Products

• Change Requests – proposed baseline changes

• Requirements Management Plans

• Project Work Breakdown Structure (WBS)

5. OUTPUTS

The following work products are produced during the defined process:

SEC_Support-002 2 13 April 2012

• CM Plan

• Records of change decisions, verified changes and changed data

• Configuration Audit Reports

• Controlled work products

• Configuration Control Board (CCB) Meeting Minutes

• Action Item List from Quality Assurance (QA) evaluations

• Change Management System (storage media, procedures and tools for recording and accessing change requests)

Additional work products may be produced during the execution of this defined process. All work products, whether required or additional, shall be placed under appropriate configuration control.

6. ROLES AND RESPONSIBILITIES

The following roles and responsibilities have been defined as having responsibilities in CM activities.

Tasks Roles/Responsibilities

Pr oj ec t L ea d

Te am

M em be rs

C on fig ur at io n M an ag em en t O ff ic er

Q ua lit y

A ss ur an ce

H ig he r L ev el

M an ag em en t

Tr ai ni ng

C oo rd in at or

Identify CIs C C R

A Establish Configuration

Management System C I

R

Create/release baselines I I R

Track Change Requests I I R

Control Configuation Items I I R

Establish CM Records I I R

Perform CM Audits C I R

Plan the process C I R C A Provide resources R I I A C

Verify and enable Training R I C I A C Monitor and Control Process C I R

Objectively Evaluate Adherence C C I A/R A Collect Process Related Experience C C R C A

R - Responsible

Doer. Degree of responsibility assigned by person who is Accountable. Responsibility can be delegated but not shared.

A - Accountable

Authority. One per task/activity. Assigned at lowest level and implied at higher organizational levels. Cannot be delegated.

SEC_Support-002 3 13 April 2012

C - Consulted

Consulted. Asked for an opinion or decision prior to the final decision being made or action being taken.

I - Informed Informed. Told of a decision or action after it is complete.

7. STANDARDS PRACTICES

This PD provides the high-level requirements for the SEC CM process. Each organization within SEC will use this PD to develop their own organization specific processes and/or Standard Operating Procedures (SOPs) or a CM plan. These SOPs or a CM plan will address the “how” the unique needs of their organization’s CM processes are implemented and performed in the course of satisfying the standard SEC requirements in this PD. The following standard practicies are used to determine compliance with this process. Refer to the high-level process flow chart shown in Appendix A for additional information.

A. IDENTIFY CONFIGURATION ITEMS (CIs) Configuration identification includes the selection of CIs, determination of the types of configuration documentation required for each CI, the assignment of unique identifiers to each CI and the technical documentation describing its configuration, and the establishment of configuration baselines. Each organization/project must identify the CIs for their product or service uniquely.

The following criteria must be met for identifying CIs:

• Identify CIs and work products

• Identify the format for a unique identifer

• Identify when each CI is placed under CM

• Identify how product changes are documented

• Identify owner of the CI

• Identify relationships among the CI

B. ESTABLISH A CONFIGURATION MANAGEMENT SYSTEM

A CM system establishes a method for creating and maintaining baselines, tracking and controlling changes to work products and maintaining the integrity of the baseline.

The following criteria must be met for establishing a CM System:

• Define levels of access and control for CIs

• Define a storage media for controlling CIs

• Define and develop the processes and procedures for the CMS Define the tools or other mechanisms, whether automated, semi-manual, or manual, by which the tracking of the CM-controlled products takes place, including the tracking of changes

• Define manual means of tracking change, if an automated mechanism is not available

C. CREATE OR RELEASE BASELINE

A baseline may include a single file or hundreds of documents for a single CI, but generally a formal baseline consists of a single specification (Functional Baseline) or a set of specifications (Allocated, Product Baselines) or work products that has been formally reviewed and agreed

SEC_Support-002 4 13 April 2012 upon.

The following criteria must be met for creating or releasing a baseline:

• Obtain approval from a CCB or equivalent review board

• Create or release from the Configuration Management System

• Document the set of CIs that are contained in the baseline

• Make the current set of baselines readily available

D. TRACK CHANGE REQUESTS

Utilize a CM System for storing, analyzing, and tracking change requests. This includes the methods for documenting a change and processing a change.

The following criteria must be met for tracking changes:

• Initiate and record change requests in the CM System

• Analyze the impact of change requests

• Categorize and prioritize change requests

• Review with relevant stakeholders for agreement of contents of next baseline

• Track the status of change requests to closure

E. CONTROL CONFIGURATION ITEMS

Control is maintained over the configuration of the work product baseline. This control includes tracking the configuration of each CI, approving a new configuration if necessary, and updating the baseline.

The following criteria must be met for control of CIs:

• Record changes to CIs and reasons for changes

• Obtain authorization before changed CIs are entered in the CM system

• Control changes to CIs throughout the life of the product or service

• Maintain the integrity of CIs

• Perform reviews to ensure that changes have not caused unintended effects on the baseline

F. ESTABLISH CONFIGURATION MANAGEMENT RECORDS

Record CI actions in sufficient detail to establish content and status, relevant stakeholder involvement, version status and product revision history.

Example of Work Products:

• Revision history of CIs

• Change log

• Change Request Records

• Status of CIs

• Differences between baselines

G. PERFORM CONFIGURATION AUDITS

Configuration audits must be performed to confirm that resulting baselines and documentation conform to customer standards.

SEC_Support-002 5 13 April 2012

Examples of Audits:

• Functional Configuration Audit (FCA) The FCA is conducted to verify that the as-tested functional characteristics of a CI have achieved the requirements specified in its functional baseline documentation and that operational and support documentation is complete and satisfactory.

• Physical Configuration Audit (PCA) The PCA is conducted to verify that the as-built CI conforms to the technical documentation that defines it.

• Configuration Management Audit (CMA) The CMA is conducted to confirm that CM records and CI are complete, consistent, and accurate.

• Transition Configuration Audit (TCA) The TCA is an audit of the baseline materials (i.e., documentation, software, training materials and the support environment) for a system transitioning from a contractor or another government agency. This audit is completed to assure that a system transitioning to the SEC is supportable and complete.

H. PLAN THE PROCESS

This document establishes the requirements, objectives, and plans for performing the configuration management process. Directorate level procedures and project work plans will provide additional details.

I. PROVIDE RESOURCES

Providing resources is a shared responsibility between SEC and its subordinate organizations.

Resources not provided at the SEC level shall be acquired (i.e., developed or purchased) by the organization responsible for providing the service (i.e., Directorate, Division, or work effort).

J. TRAINING

First line supervisor has primary responsibility for training, the project/service lead must ensure that personnel assigned to their work effort have the required training to perform their duties.

Training for any provided resources is the responsibility of the resource owner. Example training topics and which roles should be trained include:

Role Training Topic

Project Lead CM Process Training

Team Members CM Process Training

CMO CM Process Training

Training shall be accomplished in accordance with (IAW) the SEC Organizational Training (OT)

PD.

K. IDENTIFY AND INVOLVE RELEVANT STAKEHOLDERS

The objective of planning stakeholder involvement is to ensure that interactions necessary to perform the process are accomplished. The roles and responsibilities identified in Section 6 of

SEC_Support-002 6 13 April 2012 the PD shall be accounted for when planning for stakeholder involvement.

L. MONITOR AND CONTROL THE PROCESS

Monitoring and controlling the process ensures that the process is progressing as planned and that activities and milestones are taking place as required. Corrective actions shall be developed, implemented and tracked to closure as a result of monitoring and controlling the configuration management process.

Some examples of measures used for monitoring and controlling the project/work CM process are listed below:

• Number of changes to configuration items

• Number of configuration audits conducted

• Schedule of CCB or audit activities

• Number of CI audited vs number of CI deficiencies

• Number of process change requests and number of CCB approved change requests

Refer to the SEC Project/Work Monitoring and Control PD for additional information on monitoring and controlling the process.

Refer to the SEC Measurement and Analysis (MA) PD and the SEC Organizational Measurement Guide for information about using measurements to monitor and control a process.

M. OBJECTIVELY EVALUATE ADHERENCE

Adherence to the process shall be determined by an objective evaluation of the activities and work products defined in this PD and the defined process.

During the objective evaluation, the QA practitioner or independent staff (outside of the work effort chain of command) shall verify the extent the work effort has adhered to the standards as specified in this process description or in other tailored and approved standards.

Refer to the SEC Product and Process Quality Assurance PD for additional information on performing objective evaluations.

N. COLLECT PROCESS RELATED EXPERIENCES

The CM process shall be monitored to identify opportunities to improve the process. Process Practitioners, as well as PPQA personnel, share improvement responsibilities according to their specific roles. This monitoring process includes, but is not limited to, the following areas and activities:

• Noncompliance issues identified by QA practitioners shall be reviewed to distinguish between work effort performance issues and process weaknesses. These reviews should be made across all work efforts in an attempt to identify deficiencies. Resulting improvement activities could include simplifying or clarifying the process, providing additional training in the process or providing additional resources to support the relevant process

• Practitioners of the process shall be encouraged to identify weaknesses or improvement opportunities in the process and to submit a SEC Process Improvement Request

(SPIR)SPIR TOOL

• Project/service leads and others involved in this process shall monitor sources of https://www.us.army.mil/suite/doc/8089757 https://www.us.army.mil/suite/doc/18222448 https://www.us.army.mil/suite/doc/23961148 https://www.us.army.mil/suite/doc/23961148 https://www.us.army.mil/suite/doc/18238676 https://epm2.sed.monmouth.army.mil:8443/sites/PIO/SPIR2/default.aspx

SEC_Support-002 7 13 April 2012 information for tools, processes, and other technologies that could be used to improve the process. Potential process improvement candidates shall be considered for implementation IAW the SEC OPD Process OPD Process

• Lessons learned should be collected by all personnel who have a responsibility for carrying out CM activities, and should be communicated to other personnel (e.g., Leads, process personnel, QA practitioners, management, etc.) as required. Lessons learned can be collected at any time

8. TAILORING GUIDELINES

The SEC CM PD provides a description of the activities necessary to implement configuration management. Tailoring is not permitted for the SEC CM PD. Subordinate organizations may develop their own SOPs to define their local processes. Refer to the SEC Tailoring Waiver Guidelines for additional information on tailoring.

9. TOOLS

The following is a list of SEC tools are available for use when performing CM activities:

• SharePoint

• Software Control and Reference Office (SCRO)

10. REFERENCES

• SEC Process Tailoring/Waiver Guidelines

• CMMI Guidelines for Process Integration and Product Improvement, 3rd Edition, 2010

11. ACRONYMS AND DEFINITIONS

See the SEC Process Improvement Acronyms and Definitions document located on the PAL for a list of common acronyms and definitions used in this process description.

https://akocac.us.army.mil/suite/doc/33365839&inline=true https://www.us.army.mil/suite/doc/18682907 https://www.us.army.mil/suite/doc/18682907 https://www.us.army.mil/suite/doc/17218884

SEC_Support-002 A-1 13 April 2012

APPENDIX A – CM PROCESS FLOW

SEC_Support-002 B-1 13 April 2012

APPENDIX B – CMMI TO PROCESS DESCRIPTION MAPPING

CMMI to Process Description Mapping

Specific Practice Section where requirement is covered SP 1.1 Identify Configuration Items 7.A SP 1.2 Establish a Configuration Management System

7.B

SP 1.3 Create or Release Baselines 7.C SP 2.1 Track Change Requests 7.D SP 2.2 Control Configuration Items 7.E SP 3.1 Establish Configuration Management Records

7.F7.B

SP 3.2 Perform Configuration Audits Error! Reference source not found.

Generic Practice

2.1 Establish organizational policy This PD

2.2 Plan the process 7.H

2.3 Provide resources 0

2.4 Assign responsibility 66

2.5 Train people 7.J

2.6 Control work products 7.E

2.7 ID and involve relevant stakeholders 7.K

2.8 Monitor & control the process 7.L

2.9 Objectively evaluate adherence 7.M

2.10 Review status with higher Management 7.L

3.1 Establish a defined process 7

3.2 Collect process related experiences 7.N

SEC_Support-002 C-1 13 April 2012

APPENDIX C - RECORD OF CHANGES

*A – ADDED, M – MODIFIED, D – DELETED

DATE VERSION CHANGE

REQUEST

NUMBER

A, M, D*

SECTION TITLE OR BRIEF

DESCRIPTION

UPDATED BY

30 Apr 08 CM-001

Version 2.0

A,M,D All Updated Version Number to 2.0.

Updated the Document Date to reflect the updates.Modified Communications-Electronics Life Cycle Management Command to CECOM LCMC. Added statement concerning changes. Changed Edward C. Thomas to Stephen F.

Kovacs and Organization Name.

Paragraph 2 was added to say that this PD is written at a higher level and mandates that a CM process shall be in place for each organization. It also reflects compliance with CMMI V1.2.

Updated to reflect paragraph additions. This paragraph was modified to establish the SEC organizational level process for CM.

Removed reference to organizational procedure titles which have now been moved to Appendix D. Added Process Owner Roles and Responsibilities. Added and deleted some of the acronyms that were in CM-001, Version 1.0. Removed the Matrix for SPs.Removed the color and GPs from the process flow blocks. Removed any references to names, addresses and personal phone numbers. Deleted “Guidelines for Configuration Audits” and moved this to Section 6 (Specific Practices). Added Policies, Procedures and Standards for the organizations within the CECOM LCMC. Added POC within each organization if a copy of a Policy, Procedure or Standard is needed for reference.

Patti Watkins

Removed Configuration Management Librarian Roles and CMP Developer Roles.

SEC_Support-002 C-2 13 April 2012

DATE VERSION CHANGE

REQUEST

NUMBER

A, M, D*

SECTION TITLE OR BRIEF

DESCRIPTION

UPDATED BY

This Section was rewritten to be in compliance with the CMMI V1.2 model. Added Proof of Compliance after each specific practice. This will help the project Lead or CMO in preparing the artifacts for

SCAMPI.

28 Feb 12 3.0 A,M,D All Migrated to new template. Updated to reflect changes for CMMI Version 1.3 and to include all three constellations. Removed the “who” and the “how” but left the “what”

Patti Watkins, Terri Harbut

13 Apr 12 3.0 A,M,D Modified CM PD based from comments made by the PICB and

CM IPT.

Patti Watkins

Terri Harbut