+-----------------------------------------------------------------------+
| # VBA IRM Directive No. 3.04.02                                       |
|                                                                       |
| # VBA Software Engineering Methodology                                |
+-----------------------------------------------------------------------+
| POLICY:                                                               |
+-----------------------------------------------------------------------+
| 1\. The Application Architecture and System Development Methodology   |
| Staff (20S3) will manage and maintain the VBA program for Systems     |
| Engineering and Software Development. The Director, Applications      |
| Architecture and Systems Development Methodology is responsible for   |
| ensuring that the VBA employs a well-defined, integrated set of       |
| software development and project management processes that will       |
| ensure the development of the quality software needed to support the  |
| accomplishment of VBA's business goals.                               |
+-----------------------------------------------------------------------+
| 2\. The software development and project management processes used by |
| VBA organizations, business units, and their supporting contractors   |
| will ensure the development of Quality Software. In order to achieve  |
| the goal of producing Quality Software, the VBA will emulate many     |
| other government organizations that are striving to improve their     |
| software development processes by adopting the one common standard of |
| measurement for process improvement - the Capability Maturity Model   |
| (CMM).                                                                |
+-----------------------------------------------------------------------+
| 3\. This policy and the employment of the VBA standard software       |
| development methodology will provide the foundation for software      |
| development and maintenance activities within the VBA. The purpose of |
| the policy is to institutionalize the environment for continuous      |
| process improvement. Therefore this policy is evolutionary and will   |
| expand as the organization reaches a higher level of maturity.        |
+-----------------------------------------------------------------------+
| 4\. VBA organizations, business units, and supporting contractors     |
| that develop software will follow the CMM. The CMM has become a de    |
| facto government and industry standard for software development       |
| \"best practices" and provides a framework that describes the key     |
| elements of an effective software process. The CMM describes an       |
| evolutionary improvement path from an ad hoc, immature process to a   |
| mature, disciplined process and covers practices for planning,        |
| engineering, and managing software development and maintenance.       |
+-----------------------------------------------------------------------+
| 5.  The CMM describes five levels of process maturity. Level 1 is the |
|     lowest level (initial) ad hoc software development process, and   |
|     Level 5 is the highest (optimizing). The VBA goal is to move to   |
|     CMM Level 2 -- the Repeatable Level and the attainment of CMM     |
|     Level 3 -- the Defined Level. At the Repeatable Level, policies   |
|     for managing software and the procedures needed to implement      |
|     those policies are well established. The objective in achieving   |
|     Level 2 is to institutionalize effective management processes for |
|     software projects.                                                |
+-----------------------------------------------------------------------+

+-----------------------------------------------------------------------+
| 6\. All VBA systems development and operations managers and support   |
| staff will follow CMM Level 2 (Repeatable Level) "best practices" in  |
| conduct of software development projects.                             |
+-----------------------------------------------------------------------+
| 7\. All VBA systems development projects, in-house and contractor     |
| developed, will follow CMM Level 2 (Repeatable Level) "best           |
| practices" in conduct of software development projects.               |
+-----------------------------------------------------------------------+
| Best Practices Are Defined as Follows:                                |
+-----------------------------------------------------------------------+
| ## REQUIREMENTS MANAGEMENT                                            |
|                                                                       |
| Requirements form the basis for all software development and          |
| maintenance. For every project, all requirements and changes to       |
| requirements (both technical and business) are analyzed, documented,  |
| and managed throughout the project life cycle. The requirements and   |
| changes to requirements are the basis for project planning            |
| activities. The requirements are baselined according to the           |
| Configuration Management plan and form the basis for estimating,      |
| planning, performing, and tracking the project's activities. Any      |
| changes to requirements are reflected in the project's plans,         |
| activities and deliverables. All requirements are reviewed, and       |
| agreed to, by software managers and other affected groups before      |
| being approved.                                                       |
+-----------------------------------------------------------------------+
| ## SOFTWARE PROJECT PLANNING                                          |
|                                                                       |
| A project plan is the basis for executing and managing a project's    |
| activities. Each software project is managed according to a           |
| documented plan based on the requirements. All commitments, including |
| work product sizing estimates, cost, and schedule are negotiated with |
| the affected groups and documented.                                   |
+-----------------------------------------------------------------------+
| ## SOFTWARE TRACKING AND OVERSIGHT                                    |
|                                                                       |
| The software development plan, developed during the planning phase,   |
| is used as the basis for tracking the software activities,            |
| communicating status, and revising plans of the software project      |
| (ref: The Capability Maturity Model, *Guidelines for Improving the    |
| Software Process*, Carnegie Mellon University Software Engineering    |
| Institute). The projects are tracked and the results documented       |
| against the documented estimates, commitments, and plans, all of      |
| which are included in the project plan. Any significant variance is   |
| reported and corrective action is taken to adjust the project         |
| performance or the project plan as appropriate. Any changes to the    |
| project plan and associated commitments, including size, cost, and    |
| schedule are documented and negotiated with the affected groups. Any  |
| changes to external commitments are reviewed with senior management.  |
+-----------------------------------------------------------------------+

+-----------------------------------------------------------------------+
| ## SOFTWARE QUALITY ASSURANCE                                         |
|                                                                       |
| A documented plan exists for Software Quality Assurance (SQA) at the  |
| project level. This plan provides for quality management to exist as  |
| an integrated function within the project. In addition, an            |
| independent SQA function exists to verify compliance to policies,     |
| procedures, standards, conventions, and requirements. Major           |
| deliverables are reviewed using Walk-through and/or Peer Reviews. SQA |
| activities are reported to and reviewed with project managers and     |
| senior management. The SQA function and the project manager are peers |
| working together toward overall success of the project.               |
| Non-compliance issues are escalated through the independent SQA       |
| function to senior management for resolution.                         |
+-----------------------------------------------------------------------+
| ## CONFIGURATION MANAGEMENT                                           |
|                                                                       |
| A documented plan exists for Configuration Management (CM), at the    |
| project level, which includes the work products to be placed under    |
| CM. A baseline of controlled items is established and maintained by   |
| CM and changes to that baseline are controlled and managed to ensure  |
| their integrity. The baselines and CM activities are periodically     |
| audited.                                                              |
+-----------------------------------------------------------------------+
| ## SUBCONTRACTOR MANAGEMENT                                           |
|                                                                       |
| When it provides a best-cost solution, the VBA may choose to utilize  |
| sub-contractors in software development. VBA standards and procedures |
| are used to select sub contractors , manage their activities, and     |
| track the deliverables of software development. The subcontractors    |
| will use processes and standards that are consistent with VBA for     |
| software development. The contractual agreements will include all VBA |
| requirements and conditions used to manage the subcontracted work     |
| effort. Changes to the subcontract are made with the involvement and  |
| agreement of all affected groups, senior management, and the          |
| subcontractor.                                                        |
+-----------------------------------------------------------------------+
| ## TRAINING                                                           |
|                                                                       |
| Each individual in VBA has a personal training plan. This plan is     |
| based on the skills inventory and the needs of the project. The       |
| individual plans are used to identify and obtain the training needed  |
| to support the project and the Carnegie Mellon University Capability  |
| Maturity Model (CMM) Key Process Areas (KPA) and to enhance the       |
| individual's skills.                                                  |
+-----------------------------------------------------------------------+
| PROCESS IMPROVEMENT                                                   |
|                                                                       |
| A written Software Process Improvement (SPI) plan will be established |
| for the VBA and a representative from each VBA business unit will be  |
| appointed to coordinate all process improvement activities within the |
| organization as well as to participate in the VBA headquarters level  |
| group. Software Processes used by the VBA are assessed annually (at a |
| minimum) for strengths and weaknesses and the process improvement     |
| plan is updated based on the findings.                                |
+-----------------------------------------------------------------------+

+-----------------------------------------------------------------------+
| ## WAIVERS                                                            |
|                                                                       |
| Senior management may grant waivers of the VBA policy for specific    |
| elements to specific projects when it is determined that the policy   |
| either does not support the business case or when the policy does not |
| provide a best cost solution. The waivers are always included in the  |
| project's software development plan.                                  |
+-----------------------------------------------------------------------+
| REFERENCES:                                                           |
|                                                                       |
| 1.  VBA Systems Development Lifecycle (SDLC) Guidelines               |
+-----------------------------------------------------------------------+
| PROPONENT ORGANIZATION: Any questions regarding this directive and    |
| its procedural handbooks will be directed to the Director,            |
| Applications Architecture and Systems Development Methodology.        |
+-----------------------------------------------------------------------+
| NOTICE: Place this directive in *Part I of M20-4*, behind *Tab 3.0,   |
| Applications Management.*                                             |
+-----------------------------------------------------------------------+
| IMPLEMENTATION DATE: Immediately upon receipt.                        |
+-----------------------------------------------------------------------+

> By Direction of the Under Secretary for Benefits
>
> K. Adair Martinez
>
> Chief Information Officer