CBIIT Quality Assurance and Compliance Process August 8, 2012

Outline Overview Objectives Process flow Methodology Test Artifacts 2

Overview The CBIT Quality Assurance and Compliance process starts at the inception of a project and continues throughout the software development life cycle until the release of the application. Major tasks include: –reviewing requirements for testability –developing a QA test plan –writing test cases, requirement/test-case traceability matrix –executing the test plan and documenting the test results –validating the installation/upgrade process –ensuring 508 compliance and security scan –ensuring adherence to the CBIIT technology standard as well as the project specific standards –reporting test results 3

Objectives Validate the CBIIT system and specifications to ensure that they meet specific regulatory and CBIIT organizational-level directives Ensure that the system and specifications meet all of the functional and non-functional requirements Make sure software products are of high quality and meet users’ expectation 4

Process Flow Process for moving an application from Development, to QA, to Stage, and then to the Production * A snapshot from the CBIIT Software Development Process * Security scan is included in QA tier and Stage tier if applicabl 5

Process Flow (cont.) – for Non Release Candidate (1) QA Entry Criteria –Testable functional requirements and non-functional requirements, and design document for API testing –Test artifacts of unit/integration testing by development team as specified –QA candidate passes a smoke testing QA Testing –Prepare QA test plan as specified –Execute testing –Document and report test results 6

Process Flow (cont.) – for Release Candidate (2) QA Entry Criteria –Testable functional requirements and non-functional requirements, and design document for API testing –Test artifacts of unit/integration testing by development team –QA candidate passes a smoke testing –Release candidate passes the security scan and 508 compliance scan on Dev tier if applicable QA Testing –Prepare QA test plan –Execute the test plan –Document and report test results –Ensure the release candidate passes the security scan and 508 compliance scan on QA tier if applicable 7

Process Flow (cont.) – for Release candidate (3) QA Exit Criteria –High (Blocker, Critical, Major) severity defects are resolved, or defects are resolved to the satisfaction of the CBIIT business sponsor and project officer. –All test cases in scope have been executed; test results and defects for failed test cases have been documented. –All requirements in scope trace to test cases and test results –The application and services pass the security scan at the compliance level if applicable –The application and documentation pass a 508 scan and be compliant at the standard compliance level if applicable –The application passes project specific compliance and conformances validation if applicable –QA report for QA sign-off 8

Process Flow (cont.) – for Release Candidate (4) Stage Testing –Perform smoke test on stage tier –Make sure the release candidate passes the security scan on Stage tier at the compliance level if applicable –Check consistency of out-facing documentation –Perform installation/upgrade testing on stage tier –Provide final QA reports for approval of product release 9

Methodology Agile-Based Methodology – Iterative releases of groupings of deliverables, sprints, parallel work streams enable rapid execution and delivery of requirements, specifications, and software implementations of modularized business capabilities Integrated Toolset – QA is connected to all aspects of the system delivery lifecycle via a integrated set of tools. Test Management – HP Quality Center is now used for test case management, requirement traceability and quality metrics reporting. Other tools are also employed. 10

Test Artifacts (as specified) QA test plan document Test cases Requirement/test-case/test-result traceability matrix Test result reports Others –Use Case/Requirement Review – Requirements are reviewed by QA to make sure they provide sufficient details to write thorough test cases. –Document/Code Reviews – QA ensures reviews are completed on code and other deliverables. –Test Execution – The test plan is implemented and results are tracked and reviewed. –Stage Testing – QA executes a set of tests that touch major functionalities, and consistency of the documentation. –User acceptance testing report (if applicable) 11

Questions 12