Parasoft Outsourcing Solution ensures that applications satisfy your SLA expectations around quality, security, maintainability, and performance–regardless of obstacles such as communication barriers, different development environments, and high team turnover. Policy establishment, application, and monitoring Parasoft's policy-based approach 1) Establishes policies that define your organization's expectations for development and testing; 2) leverages an automated infrastructure to ensure consistent, unobtrusive policy application; and 3) continuously monitors policy compliance for real-time, objective visibility. Multiple, complementary technologies Parasoft automates a broad spectrum of quality and security practices for C/C++, Java, .NET, SOA, Web, and RIA–the most comprehensive in the industry. Supported practices include: Code analysis (pattern-based, data flow, metrics) Peer code review Unit & component testing Functional & integration testing Security & penetration testing Load & performance testing Business process testing Continuous regression testing Extensive, centralized reporting Provides continuous visibility into policy compliance, as well as development processes, progress, and productivity. The system alerts you to issues as they emerge so you can address them before they impact deadlines or budgets. Automated infrastructure Analyzes the project nightly, then notifies the appropriate team members if action is needed. This ensures that your prescribed quality and security tasks are applied consistently and accurately–without disrupting project progress. Interactive desktop testing is also available for immediate feedback. Rapid issue resolution, reduced developer learning curve Each issue detected is prioritized, automatically correlated to the developer who introduced it, then distributed to his or her IDE with direct links to the problematic code and a description of how to remediate it. Eventually, developers start writing compliant code as a matter of habit. 20 years of experience The Parasoft approach has evolved over our 20 years in business. With experience helping 58% of the Fortune 500 companies implement a broad range of validation and verification practices, Parasoft knows what it takes to ensure adoption and establish a sustainable, repeatable, and predictable process.

The greatest challenge of outsourced or geographically-distributed development is how to ensure that high-quality, flexible code is delivered promptly and predictably–regardless of obstacles such as communication barriers, different development environments, and team turnover. Developers might implement code based on a misunderstanding of your requirements and quality policies. The outsourcer's status estimations might be inaccurate or untruthful. Or, the code might be completed on time, but require tremendous rework.

These and other headaches can be prevented by using Parasoft Outsourcing Solution, which:

• Establishes policies that define your organization's expectations for development and testing.
• Leverages an automated infrastructure to ensure consistent, unobtrusive policy application across teams and locations.
• Continuously monitors policy compliance for real-time, objective visibility.

Developers verify conformance to objective criteria as code is developed, then conformance is verified again upon code check in. By exposing structural errors as they are introduced and preventing entire classes of defects, this verification helps developers deliver better code faster and prevents surprises later in the process. Moreover, continuous visibility into development processes, progress, and productivity–as well as policy compliance–helps managers ensure project predictability.

For capability details tailored to your specific development environment, see the following pages:

• C/C++
• Java
• .NET
• SOA
• Web
• RIA

Compliance as a Continuous Process

A continuous quality process ensures the compliance tasks that you prescribe for outsourcers or geographically-distributed teams are not only deployed across every stage of the SDLC, but also ingrained into the team's workflow. It can be achieved by taking a policy-based approach that embeds automated policy monitoring "sensors" across the SDLC. This involves defining policies that capture the organization's expectations around quality and security, then leveraging automation as a sensor that checks 1) if the policies are being applied correctly and 2) if they are achieving the expected results.

Rather than constantly incur the costs of testing quality and security defects out of the software (auditing), organizations invest in establishing a system that helps the team build quality and security into the software.

With such an infrastructure in place, team productivity increases dramatically. By following clearly-defined expectations for building quality and security into code, development is freed from the constant interruption of having to review, reproduce, and remediate defects reported by QA. Moreover, with so many defects being prevented, QA resources can be reduced or reallocated into tasks that deliver increased business value–such as performing a more extensive high-level "functional audit" of the application and assisting the team to monitor and improve its continuous quality process.

Parasoft Policy-Based Infrastructure

The Parasoft Policy-Based Infrastructure centralizes compliance via a development policy, which is a defined set of validation goals that an organization would like to achieve and measure throughout the SDLC. A properly- defined "policy" allows the organization to increase productivity while mitigating the risks associated with compliance to laws, regulations, and best practices. The overall goal is to drive a more effective SDLC process with automation.

The Parasoft infrastructure integrates into the team's current development environment and drives policy via process and workflow automation, which is achieved through both Parasoft quality components and any other application within the organization's development infrastructure.

Parasoft's policy-based infrastructure features the following components:

Policy Management

The Parasoft Policy Management solution is a central repository that defines management's expectations about how to execute SDLC tasks "correctly" in order to achieve and demonstrate compliance. The Policy Management module takes compliance guidelines and turns them into executable best practices. Metrics and control limits can be set within each policy in order to trigger escalations and/or notifications. This sets a measurement baseline to monitor policy compliance, process visibility, and granular tasks.

Policies can include:

• Architectural best practices and approval
• Design best practices and approval
• Development best practices and monitoring (security, reliability, performance, maintaibility)
• Quality process best practices and monitoring
  • Process Adherence
  • Automated Test Analysis (Code Analysis, Peer Code Review, Regression Testing...)
  • Quality Gates
  • Test Coverage
  • Risk/Release Monitoring
• Runtime monitoring

Process/Workflow Automation

Process/Workflow Automation is established to test for compliance to the defined policy. Process and workflow automation can request approval or verification for human/manual tasks or automatically query SDLC systems for specific process artifacts. The Process/Workflow component monitors the SDLC infrastructure for policy compliance.

Furthermore, more granular human tasks can be orchestrated in order to achieve compliance to specific SDLC policies. For example, a review process can be executed when specific components of a project are completed. A human task for review can be generated–bringing together developer and manger as well as key artifacts such as the requirement, the code, code analysis results, and unit test and functional test plans.

Preconfigured, customizable policy templates define common compliance processes that span everything from planning, to validation, to approval/sign-off tasks. Then, Process/Workflow Automation converts checklist items into executable processes. This helps organizations move beyond simply describing "how" to conduct the software validation efforts and towards establishing a "living process" that ensures validation is actually performed according to expectations.

Visibility

Established policies have associated metrics and service level agreements (SLAs) in order to provide visibility at various levels of granularity. This includes:

• Policy Compliance
• Process Visibility
• Task Progress
• Correlated SDLC Metrics

Since the Process/Workflow engine works across both business process and SDLC systems, data that is traditionally located in disparate locations can be correlated in context of "process." The result is visibility that not only demonstrates compliance efforts, but also improves an organization's ability to deliver quality software and to continually increase their productivity.

Quality Repository

The quality repository is the central location to deploy, manage, and enforce organization and project policies. It is locally deployed and accessible globally. This flexibility allows core organization policies to be defined and applied to specific project configurations. Since no two projects are created equal, it is important for the project manager to have the ability to optimize productivity while adhering to validation requirements and other corporate defined policies.

The quality repository is the centralizing mechanism that allows compliance to be measured and continuously improved.

Reporting System

Parasoft's reporting system provides the information you need to identify quality, security, and process problems, address their root causes, and then monitor improvements.

The reporting system combines information from multiple sources (source control, bug tracking, and requirements management systems, as well as your Parasoft testing solutions and third party tools), which provides users with the ability to make objective decisions. The gathered data is correlated, organized, and delivered to different user roles within the organization to support their decision system.

The reporting system works as part of a comprehensive team-wide solution that reduces delivery delays and improves the quality and security of complex, multi-language enterprise applications. This particular component of that solution can help organizations:

• Improve productivity through process improvement.
• Obtain comprehensive, objective, on-demand insight into the development process.
• Meet goals predictably.
• Manage distributed development.