Compliance as a Continuous Process
A continuous quality process ensures compliance tasks are not only deployed across every stage of the SDLC, but also
ingrained into the team's workflow. It can be achieved by taking a policy-based approach that embeds automated policy monitoring
"sensors" across the SDLC. This involves defining policies that capture the organization's expectations around quality and security,
then leveraging automation as a sensor that checks 1) if the policies are being applied correctly and 2) if they are achieving
the expected results.
Rather than constantly incur the costs of testing quality and security defects out of the software (auditing), organizations
invest in establishing a system that helps the team build quality and security into the software.
With such an infrastructure in place, team productivity increases dramatically. By following clearly-defined expectations for
building quality and security into code, development is freed from the constant interruption of having to review, reproduce,
and remediate defects reported by QA. Moreover, with so many defects being prevented, QA resources can be reduced or reallocated
into tasks that deliver increased business value–such as performing a more extensive high-level "functional audit" of the
application and assisting the team to monitor and improve its continuous quality process.
Parasoft Policy-Based Infrastructure
The Parasoft Policy-Based Infrastructure centralizes compliance via a development policy, which is a defined set of validation goals
that an organization would like to achieve and measure throughout the SDLC. A properly- defined "policy" allows the organization
to increase productivity while mitigating the risks associated with compliance to laws, regulations, and best practices.
The overall goal is to drive a more effective SDLC process with automation.
The Parasoft infrastructure integrates into the team's current development environment and drives policy via process and workflow
automation, which is achieved through both Parasoft quality components and any other application within the organization's development
infrastructure.
Parasoft's policy-based infrastructure features the following components:
Policy Management
The Parasoft Policy Management solution is a central repository that defines management's expectations about how to execute SDLC tasks
"correctly" in order to achieve and demonstrate compliance. The Policy Management module takes compliance guidelines and turns them
into executable best practices. Metrics and control limits can be set within each policy in order to trigger escalations and/or
notifications. This sets a measurement baseline to monitor policy compliance, process visibility, and granular tasks.
Policies can include:
- Architectural best practices and approval
- Design best practices and approval
- Development best practices and monitoring (security, reliability, performance, maintaibility)
- Quality process best practices and monitoring
- Process Adherence
- Automated Test Analysis (Code Analysis, Peer Code Review, Regression Testing...)
- Quality Gates
- Test Coverage
- Risk/Release Monitoring
- Runtime monitoring
Process/Workflow Automation
Process/Workflow Automation is established to test for compliance to the defined policy.
Process and workflow automation can request approval or verification for human/manual tasks or automatically
query SDLC systems for specific process artifacts. The Process/Workflow component monitors the SDLC infrastructure for policy compliance.
Furthermore, more granular human tasks can be orchestrated in order to achieve compliance to specific SDLC policies. For example,
a review process can be executed when specific components of a project are completed. A human task for review can be
generated–bringing together developer and manger as well as key artifacts such as the requirement, the code, code analysis
results, and unit test and functional test plans.
Preconfigured, customizable policy templates define common compliance processes that span everything from planning, to validation,
to approval/sign-off tasks. Then, Process/Workflow Automation converts checklist items into executable processes. This helps
organizations move beyond simply describing "how" to conduct the software validation efforts and towards establishing a "living process"
that ensures validation is actually performed according to expectations.
Visibility
Established policies have associated metrics and service level agreements (SLAs) in order to provide visibility at various levels
of granularity. This includes:
- Policy Compliance
- Process Visibility
- Task Progress
- Correlated SDLC Metrics
Since the Process/Workflow engine works across both business process and SDLC systems, data that is traditionally located in
disparate locations can be correlated in context of "process." The result is visibility that not only demonstrates compliance
efforts, but also improves an organization's ability to deliver quality software and to continually increase their productivity.
Quality Repository
The quality repository is the central location to deploy, manage, and enforce organization and project policies.
It is locally deployed and accessible globally. This flexibility allows core organization policies to be defined and applied
to specific project configurations. Since no two projects are created equal, it is important for the project manager to have
the ability to optimize productivity while adhering to validation requirements and other corporate defined policies.
The quality repository is the centralizing mechanism that allows compliance to be measured and continuously improved.
Reporting System
Parasoft's reporting system provides the information you need to identify quality, security, and process problems, address
their root causes, and then monitor improvements.
The reporting system combines information from multiple sources (source control, bug tracking, and requirements management
systems, as well as your Parasoft testing solutions and third party tools), which provides users with the ability to make
objective decisions. The gathered data is correlated, organized, and delivered to different user roles within the organization
to support their decision system.
The reporting system works as part of a comprehensive team-wide solution that reduces delivery delays and improves the quality
and security of complex, multi-language enterprise applications. This particular component of that solution can help organizations:
- Improve productivity through process improvement.
- Obtain comprehensive, objective, on-demand insight into the development process.
- Meet goals predictably.
- Manage distributed development.
