Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
CAN CSA Z243.200-92 (1997): Software Configuration Management — A Cornerstone for IT Project Integrity
Understanding the scope, technical requirements, and compliance framework of the Canadian standard for software configuration management
Scope of CAN CSA Z243.200-92 (1997)
The standard CAN CSA Z243.200-92 (1997) – Software Configuration Management (SCM) – defines the minimum requirements for establishing and maintaining a systematic approach to control changes and manage the configuration of software items throughout their life cycle. As a Canadian adoption of international best practices, this standard applies to any organization that develops, maintains, or procures software, regardless of project size or domain.
Purpose
The primary purpose of this standard is to ensure that software products are identifiable, traceable, and that changes are managed in a controlled manner. It provides a framework for planning SCM activities, identifying configuration items, controlling changes, recording statuses, and auditing configurations. By adhering to the standard, organizations can improve product quality, reduce rework, and facilitate regulatory compliance.
Applicability
CAN CSA Z243.200-92 (1997) is intended for use by:
- Software project managers designing SCM plans.
- Configuration managers and change control boards.
- Auditors assessing SCM process maturity.
- Organizations seeking certification against the standard.
It covers all phases of the software life cycle, from initial concept through retirement.
Key Insight: This standard aligns closely with ISO/IEC 12207 and IEEE 828, but includes refinements specific to Canadian industry and regulatory practices.
Technical Requirements
CAN CSA Z243.200-92 (1997) specifies mandatory requirements in four core areas: configuration identification, configuration control, status accounting, and configuration audits.
Configuration Identification
Organizations must define a scheme for uniquely identifying software configuration items (CIs) and their versions. Each CI must have a unique identifier, a description, and a defined relationship to other CIs. The identification scheme must be documented in the Software Configuration Management Plan (SCMP).
Configuration Control
A formal change management process must be established. This includes:
- Change request submission and vetting.
- Evaluation of impact, cost, and risk.
- Approval or rejection by a Change Control Board (CCB).
- Implementation, verification, and release of approved changes.
Status Accounting
The standard requires that all actions on CIs be logged systematically. Status reports must capture: CI identifier, current version, date of last change, change request number, and current status (e.g., draft, approved, released).
Audits and Reviews
Periodic configuration audits must verify that the actual configuration matches the documented baseline. The standard mandates both functional configuration audits (FCA) and physical configuration audits (PCA).
| Requirement | Description | Mandatory Documentation |
|---|---|---|
| Configuration Identification | Assign unique IDs to all CIs; maintain a CI catalog. | Configuration Identification List |
| Configuration Control | Formal change request process with CCB approval. | Change Request Log, SCMP |
| Status Accounting | Record and report status of all CIs and their changes. | Status Report (periodic) |
| Configuration Audits | FCA and PCA at defined milestones. | Audit Reports |
Tip: Many organizations integrate these requirements into a single version control platform to automate identification, control, and status accounting.
Caution: The standard does not prescribe a specific tool; rather, it focuses on the processes. Over-customization of tools can lead to non-compliance if processes are not followed.
Implementation Highlights
Integration with Other Processes
Successful implementation requires SCM to be embedded within the broader software development and project management life cycle. The standard recommends that the SCM plan be coordinated with quality assurance, risk management, and delivery processes. Clear interfaces between configuration management and change management must be documented.
Tooling and Automation
While CAN CSA Z243.200-92 (1997) is technology-neutral, modern implementations leverage automated version control systems (e.g., Git, Subversion), continuous integration pipelines, and configuration management databases (CMDBs). The key is ensuring that tool outputs satisfy the standard’s evidence requirements (e.g., traceable audit logs, clearly labeled baselines).
Common Pitfall: Using a single repository without enforcing formal change control on baselines often fails the configuration control audits. Always use tags, branches, or labels to mark official baselines.
Compliance and Certification
Conformance Levels
The standard recognizes two levels of conformance: full conformance, where all mandatory requirements are satisfied, and tailored conformance, where a documented rationale exists for any non-applicable requirement. Organizations seeking certification must demonstrate full conformance through internal and external audits.
Auditing Process
Third-party audits follow the verification guidelines of CAN CSA Z243.200-92 (1997). Auditors examine:
- The existence and adequacy of the SCMP.
- Configuration identification records for completeness.
- Change request logs and evidence of CCB decisions.
- Status accounting reports and their timeliness.
- Audit reports from FCA and PCA events.
Certification Value: Compliance streamlines procurement for government and enterprise clients, reduces integration risk, and builds trust in the software supply chain.
Frequently Asked Questions
Q: Is CAN CSA Z243.200-92 (1997) still current?
A: The standard was reaffirmed in 1997. Although parts have been superseded by newer ISO/IEC SCM standards (e.g., ISO/IEC 19770-1), many Canadian organizations still reference it as a baseline for internal SCM practices. It should be checked against current contract requirements.
A: The standard was reaffirmed in 1997. Although parts have been superseded by newer ISO/IEC SCM standards (e.g., ISO/IEC 19770-1), many Canadian organizations still reference it as a baseline for internal SCM practices. It should be checked against current contract requirements.
Q: What is the relationship between this standard and IEEE 828?
A: IEEE 828 also addresses SCM, but CAN CSA Z243.200-92 (1997) is more prescriptive in areas like status accounting and audits. Organizations compliant with IEEE 828 often meet a large portion of this standard’s requirements with minor additions.
A: IEEE 828 also addresses SCM, but CAN CSA Z243.200-92 (1997) is more prescriptive in areas like status accounting and audits. Organizations compliant with IEEE 828 often meet a large portion of this standard’s requirements with minor additions.
Q: Can a small team adopt this standard?
A: Yes, the standard allows tailoring. A small team can simplify the change control board to a single person and combine status reports into existing communication channels, as long as the core elements (identification, control, status, audit) are documented and demonstrable.
A: Yes, the standard allows tailoring. A small team can simplify the change control board to a single person and combine status reports into existing communication channels, as long as the core elements (identification, control, status, audit) are documented and demonstrable.
Q: What is the role of the SCMP in compliance?
A: The Software Configuration Management Plan is the central document. It describes the SCM scheme, identifies all CIs, outlines the change control process, and defines the audit schedule. Without an approved SCMP, conformance to the standard cannot be claimed.
A: The Software Configuration Management Plan is the central document. It describes the SCM scheme, identifies all CIs, outlines the change control process, and defines the audit schedule. Without an approved SCMP, conformance to the standard cannot be claimed.
© 2026 – This article provides general guidance. For official compliance, refer to the full text of CAN CSA Z243.200-92 (1997) or the most recent Canadian standards body publications.