We as an organisation need to provide our regulator with a description of the processes describing how we "handle" software (usually computational software) that we buy or obtain from others. These processes are typically getting the right software, installation on our systems, installation testing and verification, validation, how to handle updates from the supplier (bug fixes vs upgrades in functionality and whether or not to upgrade), retirement, ...

Can someone point me to relevant ISO/IEEE/... standards or guidelines where such processes are described? I have been looking at some IEEE standards (1074-2006, 1058-1998, 730-2002,...) but the focus there always lies on software that the organisation itself develops. I need some internationally recognized standard from which I can derive a kind of software configuration plan (I hope that's the right terminology) for our software in which the general processes I mentioned are specialized for our organisation.


  • When you say acquire, do you mean you it's a tool you use on your systems? Or you bought the company that makes it and it now falls under your company's umbrella?
    – corsiKa
    Commented Sep 12, 2013 at 19:28
  • @corsiKa: software we buy or get for free (as in free beer) by means of a specialized computer code data bank. Sorry for the bad wording.
    – GertVdE
    Commented Sep 13, 2013 at 6:10

3 Answers 3


I think you should research about CMMI for Acquisition: http://cmmiinstitute.com/cmmi-solutions/cmmi-for-acquisition/


This link can provide you some guidance on IT requirements for regulatory compliance such as SOx, HIPPA, etc. http://www.metricstream.com/insights/IT_sys_val.htm


If you're looking for a framework to give you some structure, ITIL would be a good place to start. It's flexible in that you're empowered to adapt ITIL to your own situation and needs. There are many level's of ITIL implementation, but check over this link on the fundamentals and see if it's what you're looking for:

ITIL Foundation

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.