CAN CSA Z243.180-89 amd2-1999: Software Configuration Management Standard – Amendment 2 Technical Overview

Scope and Purpose

CAN CSA Z243.180-89 amd2-1999 is the second amendment to the original Canadian standard for Software Configuration Management (SCM), first published in 1989 by the Canadian Standards Association (CSA). This amendment refines the baseline requirements of the original document to align with evolving industry practices, the ISO 9000 quality management framework, and contemporary IEEE SCM models. It applies to any organization that develops, maintains, or acquires software systems and seeks to establish a disciplined configuration management process covering the entire software lifecycle.

The primary purpose of this amendment is to clarify and enhance the original standard’s provisions on: configuration identification, change control, status accounting, configuration audits, and the management of software configuration items (SCIs). It also introduces updated terminology and cross-references to harmonize with international standards such as ISO 10007 (Configuration management) and IEEE Std 828-1990.

Technical Requirements

Configuration Identification

The amendment specifies a more rigorous approach to identifying software configuration items. Each SCI must be uniquely labeled with a version identifier, and baseline definitions must be documented for each major milestone (e.g., requirements baseline, design baseline, product baseline). The standard now requires that identification schemes be capable of representing branching and merging activities common in modern development environments.

Change Control

A formal change control process is central to the amendment. Organizations must establish a change control board (CCB) with defined authority levels. The process must include:

• Submission and evaluation of change requests
• Impact analysis covering cost, schedule, and technical effect
• Approval or rejection with documented rationale
• Verification and closure of implemented changes

Status Accounting & Auditing

Status accounting must provide timely and accurate reporting of all SCIs and their baselines. The amendment mandates periodic configuration audits to verify conformance of the product and process to defined baselines. Physical and functional configuration audits (FCA/PCA) are distinguished with specific reporting requirements.

Key Changes Introduced by amd2-1999

Implementation Highlights

Adopting CAN CSA Z243.180-89 amd2-1999 requires systematic integration of SCM activities into the development lifecycle. Key implementation steps include:

• Establish an SCM Plan: Document the scope, procedures, tools, and responsibilities. The plan must reference the amendment’s requirements and be approved by the CCB.
• Select Configuration Management Tools: While the standard is tool-agnostic, the amendment assumes automated support for version control, change tracking, and status reporting. Tools should support branching and merges as required.
• Train Personnel: All team members must understand the identification scheme, the change request workflow, and their roles within the CCB.
• Define Baselines: Baselines must be established at project initiation and updated at every phase transition. Each baseline must be frozen and subject to formal change control.
• Conduct Internal Audits: Periodic self-audits ensure ongoing conformance. The amendment provides audit checklists in an informative annex (not included in the core requirements).

Compliance Notes

Compliance with CAN CSA Z243.180-89 amd2-1999 may be assessed through internal or third-party audits. The following points are critical for demonstrating conformance:

• Documentation: Maintain records of all change requests, CCB decisions, baseline registers, and audit reports. Documentation must be retained for at least the lifecycle of the software product.
• Traceability: Each SCI must be traceable from its identification to its change history and to the baseline it belongs to. Bi-directional traceability is recommended.
• Automation: While not mandatory, automated tooling is strongly expected for version control, build management, and status reporting. Manual processes must be demonstrably equivalent in rigor.
• Supplier Flowing: If third-party software components are integrated, the standard’s supplier management clause requires that the same SCM controls be applied or contractually imposed.
• Audit Records: Evidence of both physical and functional configuration audits must be available. The amendment requires that audit findings be tracked to closure.

Frequently Asked Questions