FDIC OIG: Audiit Report 05-037 (SCM Plan Elements) - Controls Over the Risk-Related Premium System, September, 2005

SCM PLAN ELEMENTS AS DESCRIBED IN THE SOFTWARE CONFIGURATION MANAGEMENT GUIDEBOOK

	Plan Requirement
CM [configuration management] Organization
Roles and Responsibilities	Identify who is responsible for configuration management.
Tools/Environment	Identify the environment and software tools that will be used for configuration management throughout the application or product lifecycle.
Training	Describe the training required to implement the configuration tools and procedures.
*Configuration Identification*
Identification Methods	Describe how configuration products are to be named, marked, and numbered. The identification scheme needs to cover hardware, system software, Commercial-Off-The-Shelf products, and all application development artifacts listed in the product directory structure such as plans, models, components, test software, results and data, executables, etc. Naming conventions for Endevor data sets should be described, if applicable.
*Configuration and Change Control*
CM Repository	The FDIC has standardized the use of StarTeam and Endevor as the tools for managing the CM library. The CQMS [configuration and quality management staff] Team and the Infrastructure Services Branch are responsible for performing nightly backups, providing for disaster recovery and the general maintenance of the CM repositories. Describe any custom folders and discuss any custom security in place.
View and Branch Management	Describe the configuration to use multiple branches to segregate work, parallel development, introduction of code from external parties, or providing a gate between development and Development Integration.
Project Baselines	A baseline is a “snapshot” in time of one version of each artifact in the project repository. A baseline is the official standard on which subsequent work is based and to which authorized changes are made. The three main reasons for creating baselines are reproducibility, traceability, and reporting. Baselines also play a role in determining when an artifact needs to come under formal configuration and change control.
Document Processing and Approval	Documents that have a review level of either Formal – External or Formal – Internal require a review cycle and a documented review record.
Change Request Processing and Approval	The application will follow the Change Request processes and procedures in StarTeam. Describe any variation of the process by which problems and changes are submitted, reviewed, and dispositioned.
Change Control Board	Describes the membership and procedures for processing change requests.
Release Process	Describe what is in the release, who it is for, and whether there are any known problems, and installation instructions.
*Status Accounting*
Reports	Describe the content, format, and purpose of the requested reports and configuration audits. Reports are used to assess the “quality of the product” at any given time of the project or product life cycle. Reporting on defects based on change requests may provide some useful quality indicators and thereby alert management and developers to particularly critical areas of development.
*Configuration Evaluations*	Configuration evaluations are conducted to confirm that SCM activities and processes performed for an application are in compliance with FDIC standards and the resulting baselines and documentation are accurate.
Physical Configuration Audit	At the end of each iteration, the Project Manager or their representative will conduct a physical configuration audit to confirm that: the change requests targeted for the iteration deployment are documented properly, the artifacts changed against those CRs [change requests] are linked and that all appropriate artifacts are correctly labeled, and the artifacts specified in the Development Case are either created, revised, or finalized. Describe any additional audits that will be conducted for the application. Reasons for doing so may involve regulatory requirements.
Functional Configuration Audit	Describes audit procedures to confirm that a baseline meets the requirements targeted for the baseline.
Milestones	Identify the internal and customer milestones related to the project or product CM effort. This section should include details on when the CM Plan itself is to be updated.
Subcontractor and Vendor Software Control	Describe how software from outside of application environment will be incorporated and reference any third party CM plans.