Software Quality Assurance & Testing Stack Exchange is a question and answer site for software quality control experts, automation engineers, and software testers. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We as an organisation need to provide our regulator with a description of the processes describing how we "handle" software (usually computational software) that we buy or obtain from others. These processes are typically getting the right software, installation on our systems, installation testing and verification, validation, how to handle updates from the supplier (bug fixes vs upgrades in functionality and whether or not to upgrade), retirement, ...

Can someone point me to relevant ISO/IEEE/... standards or guidelines where such processes are described? I have been looking at some IEEE standards (1074-2006, 1058-1998, 730-2002,...) but the focus there always lies on software that the organisation itself develops. I need some internationally recognized standard from which I can derive a kind of software configuration plan (I hope that's the right terminology) for our software in which the general processes I mentioned are specialized for our organisation.


share|improve this question
When you say acquire, do you mean you it's a tool you use on your systems? Or you bought the company that makes it and it now falls under your company's umbrella? – corsiKa Sep 12 '13 at 19:28
@corsiKa: software we buy or get for free (as in free beer) by means of a specialized computer code data bank. Sorry for the bad wording. – GertVdE Sep 13 '13 at 6:10

I think you should research about CMMI for Acquisition:

share|improve this answer

This link can provide you some guidance on IT requirements for regulatory compliance such as SOx, HIPPA, etc.

share|improve this answer

If you're looking for a framework to give you some structure, ITIL would be a good place to start. It's flexible in that you're empowered to adapt ITIL to your own situation and needs. There are many level's of ITIL implementation, but check over this link on the fundamentals and see if it's what you're looking for:

ITIL Foundation

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.