Configuration Managent Plan AS9100 & AS9006 Checklist

AS9100 Requirement Description AS9006

4.3 Configuration Management: 9100
Does the organization have a documented and maintained
configuration management process that is appropriate to the
product?
a Does the configuration management process identify: 9006
The organization(s) involved in CM and responsibilities?
b the CM activities? 9006
c the CM tools, techniques, and methodologies? 9006
d the point at which configuration items should be brought under 9006
CM control?
5.4.2 Quality Management System Planning: 9100
a Does top management ensure that:

The planning of the QMS is carried out in order to meet the

requirements given in 4.1 and quality objectives?
g conventions (coding standards, naming conventions, etc.)? 9006
6.4 Work Environment: 9100

Does the organization determine and manage the work

environment needed to achieve conformity to product
requirements?
7.1 The organization shall plan and develop the processes 9100
needed for product realization.
In plannig product realization, the organization shall determine 9100
the following, as appropriate:

a Quality objectives and requirements for the product?

e Identification of configuration management procedures to be 9006
carried out?
f Detailed planning (including schedules, procedures, 9006
resources, and approval) and specific responsibilities and
authorities for: CM, SQE, V&V of developed products, V&V of
purchased products, verification of customer supplied
products, analysis of risks, cost and progress tracking, control
of nonconformance's and corrective action, and ensuring that
activities described in the plans are carried out?
7.3.1 Design and Development Planning: 9100
a Does the design and development planning include:

The design and development stages (with respect to

organization, task sequence, mandatory steps, significant
stages and CM)?

d Identification of standards, rules, practices, conventions, tools, 9006

and techniques for development; configuration controls placed
on tools; configuration management practices; method of
controlling nonconforming products; methods of controlling
software used to support development; procedures for
archiving, backup, and recovery, including contingency
planning; and methods of control for virus protection?

e Planning such as quality, risk management, configuration 9006

management, integration, test, installation, migration, training,
maintenance, and reuse?
7.3.3 Design and Development Outputs: 9100
The outputs of design and development shall be provided ina
form that enables verification against the design and
development input and shall be approved prior to release.
c Source code? 9006
7.3.6.2 Design and/or Development Verification and Validation 9100
a Testing:
Did the test planning, controlling, reviewing, documenting of
V&V activities ensure and prove that:

Test plans or specifications identify the product being tested

and the resources being used, define test objectives and
conditions, parameters to be recorded, and relevant
acceptance criteria?

c The correct configuration standard of the product is submitted 9100

for the test?
7.4.3 Verification of Purchased Product: 9100
Has the organization established and implemented inspection
procedures for acceptance of the product?
Are controls in place to ensure that the product will not be 9100
used until it has been verified?
Have COTS software requirements been verified and 9006
validated?
Have COTS software been identified and put under 9006
configuration control to support conformity, certification, and
customer acceptance requirements?
7.5.1 Control of Production and Service Provision: 9006
Does the organization have documented processes for CM
controlled build & release, replication and installation of
products?
a1 Does the build & release process include: 9006

Identification of the software items that constitute each

release, including associated build instructions?
a2 Identification of the types (or classes) of release, depending 9006
on the frequency and/or impact on the customer's operations
and ability to implement changes at any point in time?

a3 Decision criteria and guidance to determine where localized 9006

temporary fixes may be incorporated or release of a complete
updated copy of the software product is necessary?

a4 Verification of the build process to ensure adequacy of 9006

process instructions?
b1 Does the process for replication include: 9006

Identification of the master and the copies, including format,

variant, and version?
b2 Disaster recovery plans? 9006
b3 The period of obligation of the organization to supply copies 9006
and the capability of reading master copies?
b4 Type of media for each software item and its associated 9006
labeling?
b5 How copyright and licensing concerns are addressed and 9006
agreed upon?
b6 Controlling the environment under which the replication is 9006
effected to ensure repeatability?
b7 Verification that each copy is a faithful replica of the master? 9006

c Are the roles, responsibilities and obligations agreed upon by 9006

the organization and customer, and documented?
7.5.1.1 Production Documentation: 9006

Does the production documentation for software consist of a

software definition drawing (sometimes called a version
description document, software version description, software
configuration index, etc.)?

Does it identify: 9006

The specific source code components by version?

The support software? 9006
Build instructions? 9006
A software loading procedure that assures a valid, repeatable 9006
load of the executable software into the target computer?

Include or reference a change or problem report summary? 9006

7.5.1.2 Control of Production Process Changes: 9006
Are changes to procedures that affect the loading, verification
of load, virus and data integrity checks (i.e., cyclic redundancy
checks (CRC) or checksums), labeling, internal part marking
(when required), etc., made in accordance with formal
configuration controlled procedures?

7.5.1.3 Control of Production Equipment: 9006

Have equipment and tools that transfer and verify executable
software data from computer sensible media (such as disk,
compact disc (CD) or server resident files) been validated to
ensure the integrity of the load operation and the ability to
initialize the target system after the load?

7.5.1.4 Control of Work Transferred: 9006

When factory load and verify operations are transferred from
the facility in which the software is developed, do processes
and procedures ensure the integrity of the transfer, archiving
and retrieval of the master media?
7.5.3 Identification and Traceability: 9006
Does the organization have established and maintained
procedures for identifying software items during all phases,
starting from specification, through development, test,
replication, and delivery?
Are there procedures to trace the components of the software 9006
item or product (for example, that each software requirement
is traced from systems requirements to software requirements,
design, code, and test) throughout the product lifecycle?

a Has the organization established and maintained a 9006

configuration management system for software products,
which provides the capability to:

Identify uniquely the versions of each software item?

b Identify the versions of each software item that together 9006
constitute a specific version of a complete product?
c Identify the build status of software products under 9006
development, delivered, or installed?
d Manage access and changes to controlled items? 9006
e Provide coordination for the updating of multiple products in 9006
one or more locations as required?
f Identify and track all actions and changes resulting from a 9006
change request, or problem, from initiation through release?

g Identify the approved production documentation for all 9006

software configuration items?
h Identify associated development tools and test suites? 9006
i Identify interfaces to other software items and to target 9006
computer hardware?
j Identify the development and target computer hardware and 9006
software environment?
k Identify the source code and executable code? 9006
Has the organization established and maintained configuration 9006
status accounting procedures to record, manage, and report
on the status of software, the support environment, and
related hardware items, change requests, and the
implementation of approved changes?
Has the identification and traceability of unique software 9006
releases to their targeted environment been maintained?
7.5.5 Preservation of Product: 9006
a Does the organization have documented procedures to
preserve and segregate software items that includes
requirements for:

Archive and retrieval of software?

b Ensuring the timely copying of software to replacement 9006

media?
c Storage of software media in a protected environment (e.g., 9006
temperature, humidity, electromagnetic, and electrostatic)?

d Handling of software media (e.g., temperature, humidity, 9006

electromagnetic, and electrostatic)?
e Encryption/decryption, compression/decompression? 9006
f Storage of software media in separate protected environments 9006
to ensure disaster recovery?
8.2.4.2 First Article Inspection: 9100/9006
The organization's system shall provide a process for the
inspection, verification, and documentation of the first
production article, or follow any subsequent change that
invalidates the previous first article inspection results.
a The organization shall ensure conformity of new or modified 9006
software versions before delivery by demonstrating that:

All life cycle data and documents are complete and records
retained.

c The deliverable object code can be recreated from the source 9006
code?
e The software can be loaded into the target computer and 9006
initialized?
i The source code is identified and under configuration control? 9006