A2LA IT Program Update 2008 Assessor Conclave

A2LA IT Accreditation Scope - Any aspect of a hardware and or software environment that is under test Scope - Any aspect of a hardware and or software environment that is under test Wanted a broad based program to cover more than just encryption Wanted a broad based program to cover more than just encryption

A2LA Background Originally tried to model our program around ISO TR “IT - Interpretation of accreditation requirements in ISO guide 25” Originally tried to model our program around ISO TR “IT - Interpretation of accreditation requirements in ISO guide 25” Language outdated most other programs were narrowly focused Language outdated most other programs were narrowly focused

A2LA Background Started over using as a baseline –Adapt the standard to a virtual test environment Mostly clarifications of the general requirements as they relate to IT testing. Mostly clarifications of the general requirements as they relate to IT testing.

IT Program References ISO/IEC 17000, “Conformity assessment – Vocabulary and general principles” ISO/IEC 17000, “Conformity assessment – Vocabulary and general principles” ISO/IEC 17025: 2005, “General requirements for the competence of testing and calibration laboratories” ISO/IEC 17025: 2005, “General requirements for the competence of testing and calibration laboratories” IEEE STD :1990 “IEEE Standard Glossary of Software Engineering Terminology” IEEE STD :1990 “IEEE Standard Glossary of Software Engineering Terminology”

The requirements Major areas of clarification Major areas of clarification –Testing environment Section 5.3 (and 4.4) Section 5.3 (and 4.4) –Test methods/method validation Section 5.4 Section 5.4 –Equipment Section 5.5 Section 5.5

Testing Environment (5.3) Clearly define the testing environment Clearly define the testing environment –Identify/document any special configurations –ASP services - document potential outside influences from other ASP users –

Test Methods (5.4) Define test methodologies Define test methodologies –Defined the minimum info that must be contained in the methodology –Including test plans, test specs, and test suites –Technical review/approval – validation

Test Equipment (5.5) Software test tools considered equipment Software test tools considered equipment –Describe minimum validation requirements for test tools –Configuration management of test tools –Clarified minimum requirements for equipment records

Other requirements Other clarification was also added for sections 4.6, 4.9, 4.13, 5.6, 5.8, 5.9 and 5.10 Other clarification was also added for sections 4.6, 4.9, 4.13, 5.6, 5.8, 5.9 and 5.10 Not all of these requirements will be applicable to all labs in the IT program Not all of these requirements will be applicable to all labs in the IT program

Major Sub-Categories MATHEMATICAL AND COMPUTATIONAL SCIENCE TESTING INFORMATION TECHNOLOGY COMMUNICATION & PROTOCOL TESTING SOFTWARE DIAGNOSTICS AND CONFORMANCE TESTING COMPUTER SECURITY TESTING SYSTEMS CONFORMANCE TESTING Software Program TESTING NETWORK TECHNOLOGY TESTING

Sub-Categories defined SOFTWARE CONFORMANCE TESTING SOFTWARE CONFORMANCE TESTING –Does software program conform to an external set of requirements or specifications outside of the software design. (example – regulatory or customer driven).

Sub-Categories defined COMPUTER SECURITY TESTING COMPUTER SECURITY TESTING –Does software application or computer system adequately conforms to specific documented security requirements or commonly recognized industry standard security requirements. –It also covers MALWARE TESTING to find malicious code.

Sub-Categories defined NETWORK TECHNOLOGY TESTING NETWORK TECHNOLOGY TESTING –Testing performed on network devices, components or applications to determine whether they conform to a recognized standard, customer requirements or other specifications.

Sub-Categories defined SOFTWARE PROGRAM TESTING SOFTWARE PROGRAM TESTING –Testing as part of a software lifecycle to confirm that software meets requirements.

Sub-Categories defined COMMUNICATION & PROTOCOL TESTING COMMUNICATION & PROTOCOL TESTING –Testing control to determine if a computer application or devices has the capability of accurately sending and receiving messages as defined in a documented specification.

Sub-Categories defined SYSTEMS CONFORMANCE TESTING SYSTEMS CONFORMANCE TESTING –Testing performed to determine if a system (consisting of hardware & software) conforms to an external set of requirements or specifications outside of the system design. (example – regulatory or customer driven).

Technical requirements General IT requirements generic enough to apply to many different types of labs General IT requirements generic enough to apply to many different types of labs Specific technical requirements captured on the scope of accreditation Specific technical requirements captured on the scope of accreditation

Special Thanks: Greg Gogates-this is his baby Greg Gogates-this is his baby Werner Schaefer, John Lynch for their work on the Criteria Council Werner Schaefer, John Lynch for their work on the Criteria Council

A2LA IT Program Today 8 Certificates in the system 8 Certificates in the system –6 accredited –1 in transition from electrical –2 in process (been assessed) –Couple in the wings

A2LA IT Program Today Current areas include Current areas include –Software testing –Gaming labs –Biometrics labs

Questions?

Questions? Thanks for listening.