Contents

Foreword
Introduction

1 Scope

2 Normative references

3 Terms and definitions

4 Context of the organization

4.1 Understanding the organization and its context

4.2 Understanding the needs and expectations of interested parties

4.3 Determining the scope of the quality management system

4.4 Quality management system and its processes

• 4.4.1 Quality management system processes
  • 4.4.1.1 Process identification and application
  • 4.4.1.2 Process sequence and interaction
  • 4.4.1.3 Evidence of effective operation
• 4.4.2 Information Management

5 Leadership

5.1 Leadership and commitment

5.1.1 General
5.1.2 Customer focus

5.2 Policy

5.2.1 Establishing the quality policy
5.2.2 Communicating the quality policy

5.3 Organizational roles, responsibilities and authorities

6 Planning

6.1 Actions to address risks and opportunities

6.1.1 Risk identification
6.1.2 Risk treatment

6.2 Quality objectives and planning to achieve them

6.2.1 Establishing quality objectives
6.2.2 Implementation of quality objectives

6.3 Planning of changes

7 Support

7.1 Resources

7.1.1 General
7.1.2 People
7.1.3 Infrastructure
7.1.4 Environment for the operation of processes
7.1.5 Monitoring and measuring resources
7.1.5.1 General
7.1.5.2 Measurement traceability
7.1.6 Organizational knowledge

7.2 Competence

7.3 Awareness

7.4 Communication

7.5 Documented information

• 7.5.1 General
• 7.5.2 Creating and updating
• 7.5.3 Control of documented information
  • 7.5.3.1 Quality management system documentation
  • 7.5.3.2 Maintaining quality management system documentation
    7.5.3.2.1 Control of data and documentation
    7.5.3.2.2 Evidence of conformity
    7.5.3.2.3 Retention and disposition

8 Operation

8.1 Operational planning and control

• 8.1.1 General
• 8.1.2 Evidence of conformity to requirements

8.2 Requirements for products and services

• 8.2.1 Customer communication
  • 8.2.1.1 General
  • 8.2.1.2 Customer representative
  • 8.2.1.3 Customer communication during development
  • 8.2.1.4 Customer communication during operations and maintenance
• 8.2.2 Determining the requirements for products and services
• 8.2.3 Review of the requirements for products and services
  • 8.2.3.1 Requirements review
    8.2.3.1.1 Customer’s requirements
    8.2.3.1.2 Organization’s concerns
  • 8.2.3.2 Maintaining requirements records
• 8.2.4 Changes to requirements for products and services

8.3 Design and development of products and services

• 8.3.1 General
• 8.3.2 Design and development planning
  • 8.3.2.1 General
  • 8.3.2.2 Software life cycle
  • 8.3.2.3 Review, verification and validation
  • 8.3.2.4 Responsibilities and authorities
  • 8.3.2.5 Interfaces
• 8.3.3 Design and development inputs
• 8.3.4 Design and development controls
  • 8.3.4.1 Design and development review
  • 8.3.4.2 Design and development verification
  • 8.3.4.3 Design and development validation
  • 8.3.4.4 Testing
• 8.3.5 Design and development outputs
• 8.3.6 Design and development changes

8.4 Control of externally provided processes, products and services

• 8.4.1 General
  • 8.4.1.1 Purchased products
  • 8.4.1.2 Purchased product control
• 8.4.2 Type and extent of control
• 8.4.3 Information for external providers

8.5 Production and service provision

• 8.5.1 Control of production and service provision
  • 8.5.1.1 Production and service provision in software
  • 8.5.1.2 Build and release
  • 8.5.1.3 Replication
  • 8.5.1.4 Delivery
  • 8.5.1.5 Installation
  • 8.5.1.6 Post-delivery operations
  • 8.5.1.7 Maintenance
  • 8.5.1.8 Validation of processes for product and service provision
• 8.5.2 Identification and traceability
  • 8.5.2.1 Overview
  • 8.5.2.2 Traceability
  • 8.5.2.3 Configuration management process
  • 8.5.3 Property belonging to customers or external providers
• 8.5.4 Preservation
• 8.5.5 Post-delivery activities
• 8.5.6 Control of changes
• 8.6 Release of products and services

8.7 Control of nonconforming outputs

• 8.7.1 Identification and control of nonconforming outputs
• 8.7.2 Retaining documented information for nonconforming outputs

9 Performance evaluation

9.1 Monitoring, measurement, analysis and evaluation

• 9.1.1 General
• 9.1.2 Customer satisfaction
• 9.1.3 Analysis and evaluation

9.2 Internal audit

• 9.2.1 Conducting audits
• 9.2.2 Maintaining audit records

9.3 Management review

• 9.3.1 General
• 9.3.2 Management review inputs
• 9.3.3 Management review outputs

10 Improvement

10.1 General

10.2 Nonconformity and corrective action

• 10.2.1 Managing nonconformity
• 10.2.2 Maintaining nonconformity records

10.3 Continual improvement

Annex A (informative) - Summary of guidance on the implementation of DIN EN ISO 9001 available in ISO/ IEC JTC 1/SC 7 and ISO/TC 176 standards