CISQ Introduction and
Standards
Dr. Bill Curtis
Director, CISQ
www.it-cisq.org
1
CISQ History and Objectives
• Need standards for structural quality measures:
 Used as SLAs in contracts, not standardized
 ISO standards too high level
• Launched by OMG & SEI with Executive Forums:
 Frankfurt, Germany
 Washington, DC
 Bangalore, India
• Technical Work Groups established:
 Based on Executive Forum priorities
 Members contributed technical experts
 Deliverables are open documents
1
Consortium for IT Software Quality
Co-sponsorship
IT
Executives
CISQ
Technical
experts
3
Recent CISQ Products
2
CISQ & OMG Measurement Standards
CISQ specifications for
automated measures
Automated
Function Points
OMG Measure
Specifications
Reliability
CISQ
Exec
Forum
Performance
Efficiency
OMG
ISO
Fasttrack
Security
Deployment
Workshops
Maintainability
5
Automated FP Specification
• OMG approved Automated Function
Point specification
• Mirrors IFPUG counting guidelines,
but automatable
• Specification developed by
international team led by David
Herron of David Consulting Group
3
CISQ Security Measure
Team Lead
Robert
Martin
MITRE
Objective
Develop automated source
code measures that predict the
vulnerability of source code to
external attack. Base measure
on the Top 25 in the Common
Weakness Enumeration
7
CISQ Measures and ISO 25010
• Starting point for CISQ work
– Defines quality characteristics and sub-characteristics
– CISQ to define quality attributes and measurable elements
4
CISQ Automated Quality Metrics
Based on ISO 25010
• elaborates 4 out of the 8 defined quality characteristics
• defines Quality Issues as root causes of problems in each of the quality
characteristic domains
• defines Quality Rules and Measurable Elements that address these
issues for each quality characteristic
Quality Characteristic Hierarchy
Software Quality Characteristics
Maintainability
Quality Sub-Characteristics
Modularity, Changeability, etc.
Software Quality Attributes
Quality Measure Elements
Structural Elements
 Decision structure
 Object hierarchy
 Fan-in / Fan-out
Quality Rule Violations
 Dead code
 Copy/Paste
 Naming conventions
10
5
Managing Third Party Contracts
11
New CISQ Website — Free Membership
6