National foreword

This British Standard is the UK implementation of ISO/IEC/IEEE 41062:2024. It supersedes BS ISO/IEC/IEEE 41062:2019, which is withdrawn.

The UK participation in its preparation was entrusted to Technical Committee IST/15, Software and systems engineering.

A list of organizations represented on this committee can be obtained on request to its committee manager.

Contractual and legal considerations

This publication has been prepared in good faith, however no representation, warranty, assurance or undertaking (express or implied) is or will be made, and no responsibility or liability is or will be accepted by BSI in relation to the adequacy, accuracy, completeness or reasonableness of this publication. All and any such responsibility and liability is expressly disclaimed to the full extent permitted by the law.

This publication is provided as is, and is to be used at the recipient’s own risk.

The recipient is advised to consider seeking professional guidance with respect to its use of this publication.

This publication is not intended to constitute a contract. Users are responsible for its correct application.

Compliance with a British Standard cannot confer immunity from legal obligations.

This British Standard was published under the authority of the Standards Policy and Strategy Committee on 31 October 2024.

Foreword

ISO (the International Organization for Standardization) and IEC (the International Electrotechnical Commission) form the specialized system for worldwide standardization. National bodies that are members of ISO or IEC participate in the development of International Standards through technical committees established by the respective organization to deal with particular fields of technical activity. ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations, governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.

The procedures used to develop this document and those intended for its further maintenance are described in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types of document should be noted. This document was drafted in accordance with the editorial rules of the ISO/IEC Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).

IEEE Standards documents are developed within the IEEE Societies and the Standards Coordinating Committees of the IEEE Standards Association (IEEE-SA) Standards Board. The IEEE develops its standards through a consensus development process, approved by the American National Standards Institute, which brings together volunteers representing varied viewpoints and interests to achieve the final product. Volunteers are not necessarily members of the Institute and serve without compensation. While the IEEE administers the process and establishes rules to promote fairness in the consensus development process, the IEEE does not independently evaluate, test, or verify the accuracy of any of the information contained in its standards.

ISO and IEC draw attention to the possibility that the implementation of this document may involve the use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not received notice of (a) patent(s) which may be required to implement this document. However, implementers are cautioned that this may not represent the latest information, which may be obtained from the patent database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held responsible for identifying any or all such patent rights.

Any trade name used in this document is information given for the convenience of users and does not constitute an endorsement.

For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions related to conformity assessment, as well as information about ISO's adherence to the World Trade Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html. In the IEC, see www.iec.ch/understanding-standards.

This document was prepared by Joint Technical Committee ISO/IEC JTC 1, Information Technology, Subcommittee SC 7, Software and systems engineering, in cooperation with the Systems and Software Engineering Standards Committee of the IEEE Computer Society, under the Partner Standards Development Organization cooperation agreement between ISO and IEEE.

This second edition cancels and replaces the first edition (ISO/IEC/IEEE 41062:2019), which has been technically revised.

The main changes are as follows:

the eight steps of software acquisition were replaced by four sub-processes of software acquisition;
discussion of the various forms of requirements and their implications was expanded;
additional attention was given to acquisitions of services;
alternatives to traditional methods were described for identifying prospective suppliers, structuring requests for proposals (RFPs), evaluating proposals, and negotiating contracts;
numerous insights and tips are provided to aid in avoiding common acquisition difficulties;
the acquisition of operations, maintenance and support services in conjunction with acquiring software products was added.

Any feedback or questions on this document should be directed to the user’s national standards body. A complete listing of these bodies can be found at www.iso.org/members.html and www.iec.ch/national-committees.

Introduction

This document describes the management and execution of software acquisition activities and is intended for:

individuals or organizations that acquire software or software services from external suppliers for operational use, including software implementation, support, and operations services;
individuals or organizations that acquire software from external suppliers for resale to other individuals or organizations;
individuals or organizations that influence how software and software services is acquired from suppliers or implemented, operated, and maintained by suppliers;
suppliers interested in providing high-quality software to acquirers.

This document is designed to help organizations and individuals:

incorporate quality considerations during the definition, evaluation, selection, implementation, acceptance, operation, and support of supplier software for operational use;
specify how the external supply of software and software services should be specified, selected, monitored, and accepted on behalf of end users.

This document is intended to satisfy the following objectives:

enable acquirers to more effectively acquire software that economically meets their needs;
enable external suppliers to more effectively and economically deliver software that meets acquirers’ needs;
enable acquirers and suppliers to establish fair, understandable, suitable, and sufficient agreements for the acquisition of software;
promote consistency within and among organizations in acquiring software from external suppliers;
provide guidance and useful practices for enhancing the quality of acquired software and the software acquisition process;
provide guidance and useful practices for evaluating and qualifying supplier capabilities to meet the acquirer’s business and technical requirements;
provide guidance and useful practices for evaluating, qualifying, and contracting for proposed supplier software;
provide guidance and useful practices for evaluating and determining acceptability of software implemented by external suppliers;
provide guidance and useful practices for specifying, evaluating, and controlling the acceptability of ongoing software services provided by external suppliers.

This document can be helpful if the software acquirer and supplier are both part of the same organization.

While many of the concepts and techniques for acquiring software from external suppliers can also be relevant for internal software development, this document is not intended to address techniques of software development, testing, or operation.

Each organization or individual using this document can identify the specific set of activities to include within the organization’s acquisition process, given its legal and regulatory environment, procurement guidelines, and life cycle processes.

1 Scope

This document describes a set of useful activities, tasks, methods, and practices that acquirers of software and related services from unrelated (external) suppliers can apply to help ensure an efficient and effective acquisition of software or software services. These practices can be applied in competitive and in sole source procurements, regardless of the type, size, complexity, and cost of the acquisition. The document can be applied to software that runs on any computer system regardless of its size, complexity, or criticality. The software supply chain can include integration of off-the-shelf (OTS), custom, software as a service (SaaS), or open-source software. Software services can include software development and sustainment (maintenance), integration, verification (testing) and operation. Security and safety are included as attributes to be considered during the acquisition. However, specific requirements for acquisition of information assurance (security), safety, and cloud services are not included.

2 Normative references

3 Terms, definitions and abbreviated terms

3.1 Terms and definitions

3.2 Abbreviated terms

4 Software acquisition process

4.1 General

4.2 Purpose

4.3 Outcomes

4.4 Structure of the software acquisition process

5 Software acquisition alternatives

5.1 General

5.2 Custom-developed software

5.3 Off-the-shelf (OTS) software

5.4 Software as a service (SaaS)

5.5 Free and open-source software (FOSS)

5.6 Services

6 Planning and RFP sub-process

6.1 Purpose

6.2 Outcomes

6.3 Planning the software acquisition strategy

6.4 Defining the acquisition and content requirements

6.5 Identifying potential suppliers

6.6 Preparing contract requirements

7 Evaluation, selection, and contracting sub-process

7.1 Purpose

7.2 Outcomes

7.3 Evaluating proposals

7.4 Selecting the supplier

7.5 Negotiating the contract

7.6 Assessing and managing risk

7.7 Performing verification and validation (V&V)

8 Implementation and acceptance sub-process

8.1 Purpose

8.2 Outcomes

8.3 Implementing software or services

8.4 Evaluating and accepting software and services

9 Acquisition of operations, maintenance and support sub-process

9.1 Purpose

9.2 Outcomes

9.3 Service transitions

9.4 Operations

9.5 Maintenance

9.6 Support

10 Quality assurance for software acquisition

10.1 Objectives of quality assurance in software acquisition

10.2 Implementing quality assurance in software acquisition

Bibliography

BS ISO/IEC/IEEE 41062:2024

Software engineering. Life cycle processes. Software acquisition

Current

Published:

31 Oct 2024