ISO/IEC 29110-3-2: Conformance Framework for Very Small Entity Software Profiles

1. Understanding ISO/IEC 29110-3-2 and the VSE Conformance Framework

ISO/IEC 29110-3-2 defines the conformance requirements for Very Small Entities (VSEs) implementing software engineering profiles as specified in the ISO/IEC 29110 series. A VSE is defined as an enterprise, organisation, department, or project with up to 25 people — a category that encompasses the vast majority of software development organisations worldwide. The 29110 series recognises that traditional software process standards (such as ISO/IEC 12207 or ISO/IEC 15288) are often too heavyweight for small teams, and therefore defines a set of progressively more capable profiles (Entry, Basic, Intermediate, Advanced) that VSEs can adopt incrementally. Part 3-2 establishes the conformance assessment framework that determines whether a VSE’s processes meet the requirements of a given profile.

The conformance framework defined in ISO/IEC 29110-3-2 is built upon three pillars: process outcomes, work products, and assessment methodology. Each profile specifies a set of process outcomes that must be demonstrably achieved. For example, the Basic profile (Profile 2) requires that the Software Implementation process demonstrate outcomes such as “software requirements are defined and agreed,” “software components are verified,” and “software is validated against customer requirements.” The conformance assessment examines objective evidence — documented work products, process records, and stakeholder interviews — to determine whether these outcomes are consistently achieved across the VSE’s projects.

A key innovation of ISO/IEC 29110-3-2 is its use of a tiered conformance model. Rather than a binary pass/fail assessment, the standard defines conformance levels that reflect the extent to which the VSE’s processes satisfy the profile requirements. This graduated approach allows VSEs to demonstrate progressive capability improvement over successive assessment cycles, which is particularly valuable when the entity is pursuing certification for procurement or regulatory purposes.

2. Conformance Requirements and Assessment Methodology

2.1 Process Outcomes and Work Products

ISO/IEC 29110-3-2 defines conformance requirements in terms of process outcomes rather than prescriptive procedures, giving VSEs the flexibility to implement processes that fit their specific context, culture, and project types. For each profile, the standard specifies a set of mandatory work products that provide objective evidence of process achievement. These include the Project Plan (defining scope, tasks, resources, and schedule), the Software Requirements Specification (capturing functional and non-functional requirements), the Verification Report (documenting testing results), and the Product Operation Guide (providing user and operational documentation). The conformance assessment examines these work products for completeness, consistency, and adherence to the format and content guidelines specified in the profile.

2.2 Assessment Methodology and Conformance Grades

The assessment methodology in ISO/IEC 29110-3-2 follows the principles of ISO/IEC 15504 (now ISO/IEC 33001 series) but is adapted for the VSE context. Assessments are performed by qualified assessors who review objective evidence, conduct interviews with project stakeholders, and evaluate the degree to which each process outcome is achieved. The standard defines four conformance grades: Full Conformance (all mandatory outcomes achieved), Substantial Conformance (most outcomes achieved with minor gaps), Partial Conformance (some outcomes achieved but significant gaps remain), and Non-Conformance (critical outcomes not achieved). This graded approach enables VSEs to receive recognition for their process achievements while identifying specific improvement areas.

3. Engineering and Organisational Insights for VSE Conformance

Implementing ISO/IEC 29110-3-2 conformance in a VSE requires a pragmatic, risk-based approach. Rather than attempting to deploy all processes simultaneously, successful VSEs typically adopt an iterative implementation strategy aligned with the profile progression. Start with the Entry profile to establish basic project management and software implementation disciplines. Once these are embedded in the team’s daily workflow, add the Basic profile’s verification and user documentation practices, followed by the quality assurance and validation practices of the Intermediate profile. This stepwise approach minimises disruption to ongoing project delivery and allows the team to internalise each set of practices before moving to the next.

Tooling can significantly reduce the overhead of maintaining conformance evidence. Many VSEs find that lightweight project management tools (such as Trello, Jira, or Redmine) can be configured to automatically generate work products in conformance with ISO/IEC 29110-3-2 requirements. For example, a Kanban board with appropriate custom fields can serve as both the Project Plan and the Status Tracking mechanism, eliminating the need for separate documentation while providing the objective evidence required for assessment. Similarly, version control systems (Git) with pull request templates can automate the capture of verification and validation evidence.

Finally, consider the human factors. Engineers in VSEs often wear multiple hats — developer, tester, project manager, support engineer — and process overhead is disproportionately burdensome when it falls on a small number of individuals. Successful VSEs distribute process responsibilities across the team and integrate process activities into the natural workflow rather than treating them as separate administrative tasks. This integration is the hallmark of a mature VSE process culture and is the ultimate goal of the ISO/IEC 29110 profile progression.

4. Frequently Asked Questions