Static Code Analysis

Complete Self-Assessment Guide

The guidance in this Self-Assessment is based on Static Code Analysis best practices and standards in business process architecture, design and quality management. The guidance is also based on the professional judgment of the individual collaborators listed in the Acknowledgments.

Notice of rights

You are licensed to use the Self-Assessment contents in your presentations and materials for internal use and customers without asking us - we are here to help.

All rights reserved for the book itself: this book may not be reproduced or transmitted in any form by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of the publisher.

The information in this book is distributed on an “As Is” basis without warranty. While every precaution has been taken in the preparation of he book, neither the author nor the publisher shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the instructions contained in this book or by the products described in it.

Trademarks

Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and the publisher was aware of a trademark claim, the designations appear as requested by the owner of the trademark. All other product names and services identified throughout this book are used in editorial fashion only and for the benefit of such companies with no intention of infringement of the trademark. No such use, or the use of any trade name, is intended to convey endorsement or other affiliation with this book.

Copyright © by The Art of Service

http://theartofservice.com

service@theartofservice.com

About The Art of Service

The Art of Service, Business Process Architects since 2000, is dedicated to helping stakeholders achieve excellence.

Defining, designing, creating, and implementing a process to solve a stakeholders challenge or meet an objective is the most valuable role… In EVERY group, company, organization and department.

Unless you’re talking a one-time, single-use project, there should be a process. Whether that process is managed and implemented by humans, AI, or a combination of the two, it needs to be designed by someone with a complex enough perspective to ask the right questions.

Someone capable of asking the right questions and step back and say, ‘What are we really trying to accomplish here? And is there a different way to look at it?’

With The Art of Service’s Standard Requirements Self-Assessments, we empower people who can do just that — whether their title is marketer, entrepreneur, manager, salesperson, consultant, Business Process Manager, executive assistant, IT Manager, CIO etc… —they are the people who rule the future. They are people who watch the process as it happens, and ask the right questions to make the process work better.

Contact us when you need any support with this Self-Assessment and any help with templates, blue-prints and examples of standard documents you might need:

http://theartofservice.com

service@theartofservice.com

Included Resources - how to access

Included with your purchase of the book is the Static Code Analysis Self-Assessment Spreadsheet Dashboard which contains all questions and Self-Assessment areas and auto-generates insights, graphs, and project RACI planning - all with examples to get you started right away.

How? Simply send an email to

access@theartofservice.com

with this books’ title in the subject to get the Static Code Analysis Self Assessment Tool right away.

You will receive the following contents with New and Updated specific criteria:

•The latest quick edition of the book in PDF

•The latest complete edition of the book in PDF, which criteria correspond to the criteria in…

•The Self-Assessment Excel Dashboard, and…

•Example pre-filled Self-Assessment Excel Dashboard to get familiar with results generation

•In-depth specific Checklists covering the topic

•Project management checklists and templates to assist with implementation

INCLUDES LIFETIME SELF ASSESSMENT UPDATES

Every self assessment comes with Lifetime Updates and Lifetime Free Updated Books. Lifetime Updates is an industry-first feature which allows you to receive verified self assessment updates, ensuring you always have the most accurate information at your fingertips.

Get it now- you will be glad you did - do it now, before you forget.

Send an email to access@theartofservice.com with this books’ title in the subject to get the Static Code Analysis Self Assessment Tool right away.

Purpose of this Self-Assessment

This Self-Assessment has been developed to improve understanding of the requirements and elements of Static Code Analysis, based on best practices and standards in business process architecture, design and quality management.

It is designed to allow for a rapid Self-Assessment to determine how closely existing management practices and procedures correspond to the elements of the Self-Assessment.

The criteria of requirements and elements of Static Code Analysis have been rephrased in the format of a Self-Assessment questionnaire, with a seven-criterion scoring system, as explained in this document.

In this format, even with limited background knowledge of Static Code Analysis, a manager can quickly review existing operations to determine how they measure up to the standards. This in turn can serve as the starting point of a ‘gap analysis’ to identify management tools or system elements that might usefully be implemented in the organization to help improve overall performance.

How to use the Self-Assessment

On the following pages are a series of questions to identify to what extent your Static Code Analysis initiative is complete in comparison to the requirements set in standards.

To facilitate answering the questions, there is a space in front of each question to enter a score on a scale of ‘1’ to ‘5’.

1 Strongly Disagree

2 Disagree

3 Neutral

4 Agree

5 Strongly Agree

Read the question and rate it with the following in front of mind:

‘In my belief,

the answer to this question is clearly defined’.

There are two ways in which you can choose to interpret this statement;

1.how aware are you that the answer to the question is clearly defined

2.for more in-depth analysis you can choose to gather evidence and confirm the answer to the question. This obviously will take more time, most Self-Assessment users opt for the first way to interpret the question and dig deeper later on based on the outcome of the overall Self-Assessment.

A score of ‘1’ would mean that the answer is not clear at all, where a ‘5’ would mean the answer is crystal clear and defined. Leave emtpy when the question is not applicable or you don’t want to answer it, you can skip it without affecting your score. Write your score in the space provided.

After you have responded to all the appropriate statements in each section, compute your average score for that section, using the formula provided, and round to the nearest tenth. Then transfer to the corresponding spoke in the Static Code Analysis Scorecard on the second next page of the Self-Assessment.

Your completed Static Code Analysis Scorecard will give you a clear presentation of which Static Code Analysis areas need attention.

Static Code Analysis

Scorecard Example

Example of how the finalized Scorecard can look like:

Static Code Analysis

Scorecard

Your Scores:

BEGINNING OF THE

SELF-ASSESSMENT:

Table of Contents

About The Art of Service7

Included Resources - how to access7

Purpose of this Self-Assessment9

How to use the Self-Assessment10

Static Code Analysis

Scorecard Example12

Static Code Analysis

Scorecard13

BEGINNING OF THE

SELF-ASSESSMENT:14

CRITERION #1: RECOGNIZE15

CRITERION #2: DEFINE:22

CRITERION #3: MEASURE:34

CRITERION #4: ANALYZE:50

CRITERION #5: IMPROVE:66

CRITERION #6: CONTROL:82

CRITERION #7: SUSTAIN:92

Static Code Analysis and Managing Projects, Criteria for Project Managers:128

1.0 Initiating Process Group: Static Code Analysis129

1.1 Project Charter: Static Code Analysis131

1.2 Stakeholder Register: Static Code Analysis133

1.3 Stakeholder Analysis Matrix: Static Code Analysis134

2.0 Planning Process Group: Static Code Analysis136

2.1 Project Management Plan: Static Code Analysis138

2.2 Scope Management Plan: Static Code Analysis140

2.3 Requirements Management Plan: Static Code Analysis142

2.4 Requirements Documentation: Static Code Analysis144

2.5 Requirements Traceability Matrix: Static Code Analysis146

2.6 Project Scope Statement: Static Code Analysis148

2.7 Assumption and Constraint Log: Static Code Analysis150

2.8 Work Breakdown Structure: Static Code Analysis152

2.9 WBS Dictionary: Static Code Analysis154

2.10 Schedule Management Plan: Static Code Analysis157

2.11 Activity List: Static Code Analysis159

2.12 Activity Attributes: Static Code Analysis161

2.13 Milestone List: Static Code Analysis163

2.14 Network Diagram: Static Code Analysis165

2.15 Activity Resource Requirements: Static Code Analysis167

2.16 Resource Breakdown Structure: Static Code Analysis168

2.17 Activity Duration Estimates: Static Code Analysis170

2.18 Duration Estimating Worksheet: Static Code Analysis172

2.19 Project Schedule: Static Code Analysis174

2.20 Cost Management Plan: Static Code Analysis176

2.21 Activity Cost Estimates: Static Code Analysis178

2.22 Cost Estimating Worksheet: Static Code Analysis180

2.23 Cost Baseline: Static Code Analysis182

2.24 Quality Management Plan: Static Code Analysis184

2.25 Quality Metrics: Static Code Analysis186

2.26 Process Improvement Plan: Static Code Analysis188

2.27 Responsibility Assignment Matrix: Static Code Analysis190

2.28 Roles and Responsibilities: Static Code Analysis192

2.29 Human Resource Management Plan: Static Code Analysis194

2.30 Communications Management Plan: Static Code Analysis196

2.31 Risk Management Plan: Static Code Analysis198

2.32 Risk Register: Static Code Analysis200

2.33 Probability and Impact Assessment: Static Code Analysis202

2.34 Probability and Impact Matrix: Static Code Analysis204

2.35 Risk Data Sheet: Static Code Analysis206

2.36 Procurement Management Plan: Static Code Analysis208

2.37 Source Selection Criteria: Static Code Analysis210

2.38 Stakeholder Management Plan: Static Code Analysis212

2.39 Change Management Plan: Static Code Analysis214

3.0 Executing Process Group: Static Code Analysis216

3.1 Team Member Status Report: Static Code Analysis218

3.2 Change Request: Static Code Analysis220

3.3 Change Log: Static Code Analysis222

3.4 Decision Log: Static Code Analysis224

3.5 Quality Audit: Static Code Analysis226

3.6 Team Directory: Static Code Analysis229

3.7 Team Operating Agreement: Static Code Analysis231

3.8 Team Performance Assessment: Static Code Analysis233

3.9 Team Member Performance Assessment: Static Code Analysis236

3.10 Issue Log: Static Code Analysis238

4.0 Monitoring and Controlling Process Group: Static Code Analysis239

4.1 Project Performance Report: Static Code Analysis241

4.2 Variance Analysis: Static Code Analysis243

4.3 Earned Value Status: Static Code Analysis245

4.4 Risk Audit: Static Code Analysis247

4.5 Contractor Status Report: Static Code Analysis249

4.6 Formal Acceptance: Static Code Analysis251

5.0 Closing Process Group: Static Code Analysis253

5.1 Procurement Audit: Static Code Analysis255

5.2 Contract Close-Out: Static Code Analysis257

5.3 Project or Phase Close-Out: Static Code Analysis259

5.4 Lessons Learned: Static Code Analysis261

Index263

CRITERION #1: RECOGNIZE

INTENT: Be aware of the need for change. Recognize that there is an unfavorable variation, problem or symptom.

In my belief, the answer to this question is clearly defined:

5 Strongly Agree

4 Agree

3 Neutral

2 Disagree

1 Strongly Disagree

1. How does project age and activity influence security issues?

<– Score

2. Does the tool allow the identification of a change (person)?

<– Score

3. Is it a single line of code that needs to be altered?

<– Score

4. Is all unauthorized mobile code prevented from executing?

<– Score

5. Are there any specific expectations or concerns about the Static Code Analysis team, Static Code Analysis itself?

<– Score

6. What does your organization actually need?

<– Score

7. What about when customers find issues in a production environment?

<– Score

8. Can you identify your most complex, volatile code what can you do about it?

<– Score

9. What are the stakeholder objectives to be achieved with Static Code Analysis?

<– Score

10. Are issues with architectural elements among the most significant sources of technical debt?

<– Score

11. Does the level of expected service meet your organizations needs?

<– Score

12. Is there any software that needs to be loaded onto local computers?

<– Score

13. Is the team able to use logging to diagnose build script issues?

<– Score

14. How much are sponsors, customers, partners, stakeholders involved in Static Code Analysis? In other words, what are the risks, if Static Code Analysis does not deliver successfully?

<– Score

15. Is there an identification of source code level modules with the architecture?

<– Score

16. Does the level of partnership between IT and business units meet your organizations needs?

<– Score

17. How are you going to measure success?

<– Score

18. Who else hopes to benefit from it?

<– Score

19. What information would better meet your needs and what would it take to get it?

<– Score

20. How much preliminary problem design must be done before one can use this tool?

<– Score

21. What problems have been encountered in trying to measure performance?

<– Score

22. Clarity: does the indicator name clearly identify what is being measured?

<– Score

23. Did you introduce any critical issues during the last iteration?

<– Score

24. What should users know if they need to activate additional functionality?

<– Score

25. How would a researcher inform you of a problem and confirm that you have fixed a vulnerability?

<– Score

26. How to detect architecture and code problems as soon as possible?

<– Score

27. Why do you need to address code quality?

<– Score

28. What problems are you facing and how do you consider Static Code Analysis will circumvent those obstacles?

<– Score

29. Training program effectiveness - do you need to do more or less?

<– Score

30. What situation(s) led to this Static Code Analysis Self Assessment?

<– Score

31. Is there a large clump of issues around a particular module or a particular feature?

<– Score

32. How are the Static Code Analysis’s objectives aligned to the group’s overall stakeholder strategy?

<– Score

33. What are the expected benefits of Static Code Analysis to the stakeholder?

<– Score

34. What are the activities or events that you do on a regular basis that are used to judge your work?

<– Score

35. How much time, effort, and expertise is needed to exploit the threat?

<– Score

36. Who do you need to convince to get the ball rolling?

<– Score

37. What does Static Code Analysis success mean to the stakeholders?

<– Score

38. Is there a relationship between code review coverage and the number of issues in a project?

<– Score

39. Regarding the reliability of the KPI, do you see any assumptions that would need to be clarified?

<– Score

40. What information do you routinely gather and does it fit your needs?

<– Score

41. What is the problem with the model?

<– Score

42. How many outstanding issues or problems exist and how long is it taking to resolve them?

<– Score

43. What would happen if Static Code Analysis weren’t done?

<– Score

44. How do issues get reviewed/audited?

<– Score

45. What problems have been encountered in trying to measure performance in the past year?

<– Score

46. How do you determine need-to-know?

<– Score

47. As a sponsor, customer or management, how important is it to meet goals, objectives?

<– Score

48. Is this the only reason why software security problem is growing?

<– Score

49. Do mitigating factors prevent the code from being vulnerable?

<– Score

50. Is is possible to edit issues status?

<– Score

Add up total points for this section: _____ = Total points for this section

Divided by: ______ (number of statements answered) = ______ Average score for this section

Transfer your score to the Static Code Analysis Index at the beginning of the Self-Assessment.

CRITERION #2: DEFINE:

INTENT: Formulate the stakeholder problem. Define the problem, needs and objectives.

In my belief, the answer to this question is clearly defined:

5 Strongly Agree

4 Agree

3 Neutral

2 Disagree

1 Strongly Disagree

1. What is required, what can be postponed?

<– Score

2. Are stakeholder processes mapped?

<– Score

3. Have the customer needs been translated into specific, measurable requirements? How?

<– Score

4. Has everyone on the team, including the team leaders, been properly trained?

<– Score

5. What constraints exist that might impact the team?

<– Score

6. What all details will be required by your organization for tracking the services?

<– Score

7. Does the review address the comprehensibility of the requirements?

<– Score

8. Is the improvement team aware of the different versions of a process: what they think it is vs. what it actually is vs. what it should be vs. what it could be?

<– Score

9. Has anyone else (internal or external to the group) attempted to solve this problem or a similar one before? If so, what knowledge can be leveraged from these previous efforts?

<– Score

10. Does the license permit this CASE tool to reside on more than one machine?

<– Score

11. Has a high-level ‘as is’ process map been completed, verified and validated?

<– Score

12. Is a role defined that is responsible for customer information?

<– Score

13. What are the Roles and Responsibilities for each team member and its leadership? Where is this documented?

<– Score

14. Is Static Code Analysis currently on schedule according to the plan?

<– Score

15. Are there system or user requirements or both?

<– Score

16. Do you have a policy that requires BYOD users to prohibit the usage of unapproved application stores?

<– Score

17. What key stakeholder process output measure(s) does Static Code Analysis leverage and how?

<– Score

18. Is a fully trained team formed, supported, and committed to work on the Static Code Analysis improvements?

<– Score

19. Is there a completed, verified, and validated high-level ‘as is’ (not ‘should be’ or ‘could be’) stakeholder process map?

<– Score

20. Can teams release products without ever having to complete some requirements?

<– Score

21. Consistency and reliability: which indicators are (or can be) gathered consistently year after year?

<– Score

22. What methods will you use to elicit requirements?

<– Score

23. How will the Static Code Analysis team and the group measure complete success of Static Code Analysis?

<– Score

24. Is role-based testing within scope?

<– Score

25. What critical content must be communicated – who, what, when, where, and how?

<– Score

26. Are there any constraints known that bear on the ability to perform Static Code Analysis work? How is the team addressing them?

<– Score

27. How was the ‘as is’ process map developed, reviewed, verified and validated?

<– Score

28. What are the rough order estimates on cost savings/opportunities that Static Code Analysis brings?

<– Score

29. Is there regularly 100% attendance at the team meetings? If not, have appointed substitutes attended to preserve cross-functionality and full representation?

<– Score

30. Do the problem and goal statements meet the SMART criteria (specific, measurable, attainable, relevant, and time-bound)?

<– Score

31. What is the context of this vulnerability/code?

<– Score

32. What specifically is the problem? Where does it occur? When does it occur? What is its extent?

<– Score

33. Has a team charter been developed and communicated?

<– Score

34. What are the boundaries of the scope? What is in bounds and what is not? What is the start point? What is the stop point?

<– Score

35. What are the dynamics of the communication plan?

<– Score

36. Are team charters developed?

<– Score

37. What would be the goal or target for a Static Code Analysis’s improvement team?

<– Score

38. What will happen in case a major open source project fails?

<– Score

39. Is there a critical path to deliver Static Code Analysis results?

<– Score

40. In what ways can it fail to provide the required functions?

<– Score

41. Are different versions of process maps needed to account for the different types of inputs?

<– Score

42. What is the proposed approach to make sure that applications do comply with the requirements?

<– Score

43. Who are the Static Code Analysis improvement team members, including Management Leads and Coaches?

<– Score

44. How will variation in the actual durations of each activity be dealt with to ensure that the expected Static Code Analysis results are met?

<– Score

45. Is the team formed and are team leaders (Coaches and Management Leads) assigned?

<– Score

46. Will team members regularly document their Static Code Analysis work?

<– Score

47. Scope: is the indicator aggregated or disaggregated?

<– Score

48. Are customers identified and high impact areas defined?

<– Score

49. Are customers required to cover all on-premises servers with active Software Assurance to get Extended Security Updates on-premises?

<– Score

50. Is Static Code Analysis linked to key stakeholder goals and objectives?

<– Score

51. Does the team have regular meetings?

<– Score

52. Is data collected and displayed to better understand customer(s) critical needs and requirements.

<– Score

53. What system do you use for gathering information?

<– Score

54. When is/was the Static Code Analysis start date?

<– Score

55. Is the team equipped with available and reliable resources?

<– Score

56. How does the Static Code Analysis manager ensure against scope creep?

<– Score

57. When are meeting minutes sent out? Who is on the distribution list?

<– Score

58. Does a code change normally require a code review before it can be checked in?

<– Score

59. Will team members perform Static Code Analysis work when assigned and in a timely fashion?

<– Score

60. When is the estimated completion date?

<– Score

61. How do you keep key subject matter experts in the loop?

<– Score

62. Will code review be in-scope for each application?

<– Score

63. Does the review address the completeness of the requirements?

<– Score

64. Are customer(s) identified and segmented according to their different needs and requirements?

<– Score

65. Are there different segments of customers?

<– Score

66. Is there a completed SIPOC representation, describing the Suppliers, Inputs, Process, Outputs, and Customers?

<– Score

67. Has the improvement team collected the ‘voice of the customer’ (obtained feedback – qualitative and quantitative)?

<– Score

68. Has a project plan, Gantt chart, or similar been developed/completed?

<– Score

69. Is the current ‘as is’ process being followed? If not, what are the discrepancies?

<– Score

70. Is the Static Code Analysis scope manageable?

<– Score

71. If substitutes have been appointed, have they been briefed on the Static Code Analysis goals and received regular communications as to the progress to date?

<– Score

72. Is full participation by members in regularly held team meetings guaranteed?

<– Score

73. What customer feedback methods were used to solicit their input?

<– Score

74. Has the Static Code Analysis work been fairly and/or equitably divided and delegated among team members who are qualified and capable to perform the work? Has everyone contributed?

<– Score

75. Are improvement team members fully trained on Static Code Analysis?

<– Score

76. What measures indicate that a system has met its security requirements for each SDLC phase?

<– Score

77. Is software assurance required to take advantage of extended security updates?

<– Score

78. How often are the team meetings?

<– Score

79. What are the compelling stakeholder reasons for embarking on Static Code Analysis?

<– Score

80. What is the context of the underlying observations?

<– Score

81. Has the direction changed at all during the course of Static Code Analysis? If so, when did it change and why?

<– Score

82. Does quality of requirements specifications matter?

<– Score

83. How did the Static Code Analysis manager receive input to the development of a Static Code Analysis improvement plan and the estimated completion dates/times of each activity?

<– Score

84. Is there a Static Code Analysis management charter, including stakeholder case, problem and goal statements, scope, milestones, roles and responsibilities, communication plan?

<– Score

85. Is the team adequately staffed with the desired cross-functionality? If not, what additional resources are available to the team?

<– Score

86. How is the team tracking and documenting its work?

<– Score

87. What is the code required to do under each test case?

<– Score

88. Is the team sponsored by a champion or stakeholder leader?

<– Score

89. Has/have the customer(s) been identified?

<– Score

Add up total points for this section: _____ = Total points for this section

Divided by: ______ (number of statements answered) = ______ Average score for this section

Transfer your score to the Static Code Analysis Index at the beginning of the Self-Assessment.

CRITERION #3: MEASURE:

INTENT: Gather the correct data. Measure the current performance and evolution of the situation.

In my belief, the answer to this question is clearly defined:

5 Strongly Agree

4 Agree

3 Neutral

2 Disagree

1 Strongly Disagree

1. What is the impact of the technical debt management model on the team development process?

<– Score

2. Have you ever used a static analysis tool in a team setting?

<– Score

3. Are your performance measures obsolete?

<– Score

4. Will you use the static code analysis tools?

<– Score

5. How do you perform static code analysis to detect software security vulnerabilities?

<– Score

6. What are the events that cause each failure?

<– Score

7. Why is dynamic analysis so widely used for javascript?

<– Score

8. Does the analysis succeed in identifying dead or unreachable code?

<– Score

9. What tools for static code analysis do you use?

<– Score

10. Is it possible to following the analysis progress?

<– Score

11. How much visualization and how much analytics ?

<– Score

12. Who is responsible for data collection, analysis, and quality?

<– Score

13. What improvements do developers want to see being made to static analysis tools?

<– Score

14. Does this static analysis tool aid in assessing what to do about a warning?

<– Score

15. What changes should be made in the way data are collected and analyzed?

<– Score

16. Who participated in the data collection for measurements?

<– Score

17. Publish or perish, and at what cost?

<– Score

18. How are imprecise tools measured and compared?

<– Score

19. What happens when you re-run the analysis?

<– Score

20. What is the point of analyzing programs?

<– Score

21. How is friction used in real time as a performance measure?

<– Score

22. What is dynamic analysis good for?

<– Score

23. Aspects of quality that can be measured by analyzing source code and other system information: What aspects of quality cannot be measured this way?

<– Score

24. What is practical static analysis?

<– Score

25. How could a static analysis tool evaluate the assertion?

<– Score

26. What are the inherent limitations of static code analysis?

<– Score

27. How to conduct a preliminary security analysis?

<– Score

28. What code analysis tools do you use?

<– Score

29. What to measure?

<– Score

30. Which measurements correlate well to software quality?

<– Score

31. What can static code analysis do?

<– Score

32. How do you measure a programs effectiveness?

<– Score

33. How long should an analysis take?

<– Score

34. Have you ever consciously avoided using a static analysis tool?

<– Score

35. What are the critical characteristics of a good static analysis tool?

<– Score

36. Is the requester competent to do the proposed analysis?

<– Score

37. Do static analysis tools really help?

<– Score

38. Does the kpi actually capture changes that occur in the service for which the measure is intended?

<– Score

39. How do you measure effectiveness?

<– Score

40. What particular quality tools did the team find helpful in establishing measurements?

<– Score

41. When is the security analysis testing complete?

<– Score

42. Are analytical methods for each parameter to be analyzed specified?

<– Score

43. What are the possible values of x and y inside the while-loop according to the value analysis?

<– Score

44. No matter which type of KPI you choose to measure with, does the KPI enable you to answer the pressing question: What is the business value?

<– Score

45. Validity: which indicators provide the most direct and accurate measure?

<– Score

46. Are there different measures that you think would more accurately demonstrate the work that you do?

<– Score

47. Why not mandate a security spike; a sprint totally focused on security?

<– Score

48. Can particular attributes of software be subjected to similar measurements?

<– Score

49. Who will communicate the conclusions drawn after the data has been analyzed?

<– Score

50. Do you think that having a predictive analytics tool could help provide better outcomes for your organization?

<– Score

51. What other traceability can static code analysis assist?

<– Score

52. Did you use any static analysis tools or penetration testing tools?

<– Score

53. What is the main cause of failure/delay in rolling out your code to production?

<– Score

54. Are all of the entry points and trust boundaries identified by the design and are in risk analysis report?

<– Score

55. Has the completeness of the risk analysis been checked systematic approach or review?

<– Score

56. How can testing with static code analysis help?

<– Score

57. What is static analysis good for?

<– Score

58. How can you measure progress/advancement to the goal?

<– Score

59. Do code review practices impact design quality?

<– Score

60. What dynamic analysis approaches are used on the platform and how can they be evaluated?

<– Score

61. Do you use an automated source code analysis tool to detect security defects in code prior to production?

<– Score

62. What are static analysis tools used for?

<– Score

63. Why do you need static code analysis?

<– Score

64. To what extent can a static code analysis tool find flaws in your systems architecture?

<– Score

65. What is static analysis used for?

<– Score

66. Who will be responsible for checking the code analysis report?

<– Score

67. What type of application will you be analyzing?

<– Score

68. Is the team thoroughly analyzing assemblies using one or more static code analysis tools?

<– Score

69. What key measures identified indicate the performance of the stakeholder process?

<– Score

70. Why would you use Static Analysis?

<– Score

71. Do you use manual source-code analysis to detect security defects in code prior to production?

<– Score

72. What are the challenges facing static analysis tool deployments and how can the already stated challenges be overcome?

<– Score

73. What will be the result of static analysis?

<– Score

74. If there are mental processes that impact maintainability, what is measured for them?

<– Score

75. Where in the development process shall static code analysis be integrated?

<– Score

76. What has the team done to assure the stability and accuracy of the measurement process?

<– Score

77. Do you perform static code analysis?

<– Score

78. Are the build processes and system architecture that software updates are as best as possible modular in nature to minimise the impact on earlier versions?

<– Score

79. Has the statistical analysis been performed appropriately?

<– Score

80. What is static code analysis to your organization?

<– Score

81. Is the waste analysis data that the generator agrees to provide specified?

<– Score

82. How effective are static analysis tools in detecting Java multithreaded bugs and bug patterns?

<– Score

83. How much pain would a buffer overflow vulnerability cause in your program?

<– Score

84. Why do you use Static Code Analysis?

<– Score

85. Which analysis technique do you use to answer which question?

<– Score

86. Which business processes are impacting on improving (deteriorating) profit margin (or cash flow) and why?

<– Score

87. How often are the reports from the analysis reviewed?

<– Score

88. What is soundness (in static analysis)?

<– Score

89. Have static source code analysis tools been used to identify weaknesses that could lead to exploitable vulnerabilities in the software?

<– Score

90. Are the semantics of the language defined sufficiently for static code analysis to be feasible?

<– Score

91. How do you currently do static analysis?

<– Score

92. How can analysis search all paths?

<– Score

93. How shall static code analysis be integrated into the development process?

<– Score

94. Do static source code analysis tools really work?

<– Score

95. Do you still automate application analysis?

<– Score

96. Is the team able to run the automated tests with a code coverage analysis tool?

<– Score

97. How would a static analysis tool detect that the authorization service of the application can be bypassed?

<– Score

98. Which components will be analyzed?

<– Score

99. How effective are static analysis tools in detecting Java concurrency bugs and bug patterns?

<– Score

100. What are the impacts of current management decisions on future options?

<– Score

101. Does your analysis strategy compute a correct result?

<– Score

102. What is the overall security budget and the priorities of that budget?

<– Score

103. Does the kpi provide a consistent measure?

<– Score

104. Is source code sufficiently legible and structured to permit static code analysis and for the review of its functionality to be conducted with confidence?

<– Score

105. What types of reporting and analytics capabilities does the product provide?

<– Score

106. What is more important: code review or architecture risk analysis?

<– Score

107. Do you improve the usefulness of static analysis tools with models trained on historic data?

<– Score

108. How to analyze functions source code of existing systems and decompose them into metrics?

<– Score

109. What tools and methods should be used to measure the defects?

<– Score

110. Can good or poor design be measured?

<– Score

111. What can you measure by looking at the source code and system objects?

<– Score

112. Why do practical static analysis tools both miss problems and report false problems?

<– Score

113. Will an undue focus on the KPI lead to potential adverse effects on other aspects of quality and safety?

<– Score

114. Do you have a set of KPIs that measure different aspects of the service?

<– Score

115. Identify impacts to future deliverables/value: How will it look at different project stages and closure ?

<– Score

116. How do you measure your progress?

<– Score

117. What is the impact on the team when technical debt is explicitly considered?

<– Score

118. How well do current static analysis tools fit into the workflows of developers?

<– Score

119. What are the possible values of x and y according to the value analysis?

<– Score

120. What is the find-and-fix cost, per defect type, of defects injected during Code?

<– Score

121. What are the impacts on IT and businesses of this maintenance challenge?

<– Score

122. How do you prioritize a code review effort when you have thousands of lines of source code, and perhaps object code to review?

<– Score

123. What methods of static code analysis are available?

<– Score

124. What are static analyzer operational requirements?

<– Score

125. Does the build fail when there are violations of required static code analysis rules?

<– Score

126. Will it be possible to perform an analysis of 100% of enterprise web applications?

<– Score

127. How much effort is required to manually start an analysis?

<– Score

128. Does this impact the willingness to take (security) risks and/or the risk assessment?

<– Score

129. Financial: how do you improve cost efficiency?

<– Score

Add up total points for this section: _____ = Total points for this section

Divided by: ______ (number of statements answered) = ______ Average score for this section

Transfer your score to the Static Code Analysis Index at the beginning of the Self-Assessment.

CRITERION #4: ANALYZE:

INTENT: Analyze causes, assumptions and hypotheses.

In my belief, the answer to this question is clearly defined:

5 Strongly Agree

4 Agree

3 Neutral

2 Disagree

1 Strongly Disagree

1. Is your review process really repeatable and easy to audit?

<– Score

2. Is the traceability of requirements verified in a review process?

<– Score

3. Is there any pre-defined format in which the user will upload Service and Service Provider data?

<– Score

4. Does your team review and reflect on code review process?

<– Score

5. Did any value-added analysis or ‘lean thinking’ take place to identify some of the gaps shown on the ‘as is’ process map?

<– Score

6. Should there be a time limit or license for data access?

<– Score

7. What kpis will help you prove you deliver on business and it drivers?

<– Score

8. Internal business processes: how good you are in performing the core business processes?

<– Score

9. Is the data sent on encrypted channel?

<– Score

10. Do you provide the physical location/geography of storage of a tenants data upon request?

<– Score

11. Do you have documented code review process?

<– Score

12. How long do data need to be kept in the operational database?

<– Score

13. What tools were used to generate the list of possible causes?

<– Score

14. Why Security in the Development Processes?

<– Score

15. Which employees drive revenues (profits) and why?

<– Score

16. How are users blocked from accessing other users data?

<– Score

17. What is the cost of poor quality as supported by the team’s analysis?

<– Score

18. Where does customer data reside?

<– Score

19. What are the constraints to change in data collection?

<– Score

20. If inputs are electronically accepted by your organization, is this process secure?

<– Score

21. How is the term security defined in the context of secure development processes?

<– Score

22. What if your performance data show poor performance?

<– Score

23. How was the detailed process map generated, verified, and validated?

<– Score

24. Where are the data center and storage facilities?

<– Score

25. Can the data be used to improve performance in areas other than the already stated that are assessed?

<– Score

26. How can tests based on this data be kept expressive and maintainable?

<– Score

27. What did the team gain from developing a sub-process map?

<– Score

28. Do you have technical control capabilities to enforce tenant data retention policies?

<– Score

29. How do you represent the physical data model?

<– Score

30. Loss of integrity: how much of the data can be damaged?

<– Score

31. What does the data say about the performance of the stakeholder process?

<– Score

32. Do you have a policy that requires BYOD users to perform backups of specified corporate data?

<– Score

33. What conclusions were drawn from the team’s data collection and analysis? How did the team reach these conclusions?

<– Score

34. Was a detailed process map created to amplify critical steps of the ‘as is’ stakeholder process?

<– Score

35. What were the crucial ‘moments of truth’ on the process map?

<– Score

36. Do you document how you grant and approve access to tenant data?

<– Score

37. Does your organization utilize a consistent process for incident reporting and handling?

<– Score

38. Who will collect data?

<– Score

39. Does the service specify data durability?

<– Score

40. Is there any sensitive data in configuration files?

<– Score

41. All software releases referenced in the What Products and Services Are Required to Adopt the Security Development Lifecycle Process?

<– Score

42. Use: how will the indicator be used in management decision making and other organization processes?

<– Score

43. What database structure does your system utilize?

<– Score

44. When you are done with the risk assessment what does the output look like?

<– Score

45. Where does this information/data go?

<– Score

46. Are the research outputs publicly available?

<– Score

47. Do you conduct risk assessments associated with data governance requirements at least once a year?

<– Score

48. Is the Static Code Analysis process severely broken such that a re-design is necessary?

<– Score

49. Which data types are available in JavaScript?

<– Score

50. What were the financial benefits resulting from any ‘ground fruit or low-hanging fruit’ (quick fixes)?

<– Score

51. How do you make sure your data is secure and maintains compliance with legal regulations?

<– Score

52. Does the size of the project or the database play a role in smell density?

<– Score

53. What does the latest vulnerability data suggest?

<– Score

54. Are data based on unrealistic organization conditions?

<– Score

55. Does data from this method/code travel to the database?

<– Score

56. Is it possible to collect the required data and is it worth the resources?

<– Score

57. Are procedures to determine how well the generators data represents the waste to be managed provided?

<– Score

58. Does it drive the right behavior?

<– Score

59. Were Pareto charts (or similar) used to portray the ‘heavy hitters’ (or key sources of variation)?

<– Score

60. Do you feel that quick fixes or code suggestions would be helpful if they were available?

<– Score

61. How long do data need to be kept on removable media, if at all?

<– Score

62. What tools were used to narrow the list of possible causes?

<– Score

63. How does the Vendors proposed training process support the application?

<– Score

64. Is the performance gap determined?

<– Score

65. Regarding minimum tool requirements and related policy; How Are New Recommendations and New Requirements Added to the Security Development Life Cycle Process?

<– Score

66. Does your it provide remote wipe or corporate data wipe for all organization-accepted byod devices?

<– Score

67. What is the printed output program?

<– Score

68. Is this data object ever range-checked before being passed to an OS function?

<– Score

69. What else do you do with this attack surface model / database?

<– Score

70. What are the cloud providers rights over customer data?

<– Score

71. Does your organization keep the active and inactive clients in the same database?

<– Score

72. Do you provide your tenants with documentation that describes your quality assurance process?

<– Score

73. What are the service management processes and tools in place today?

<– Score

74. Does the team data drive the test methods when there are multiple test cases?

<– Score

75. What is the process of the code review when code during the code review needs to be changed?

<– Score

76. Did they use the workbench to check and/or modify data schema?

<– Score

77. Is sensitive data being handled?

<– Score

78. Are third parties allowed access to the cloud provider data centers?

<– Score

79. Does the app read external data from the channels that you have identified?

<– Score

80. What quality tools were used to get through the analyze phase?

<– Score

81. What are the revised rough estimates of the financial savings/opportunity for Static Code Analysis improvements?

<– Score

82. How are you determining your data needs?

<– Score

83. Have any additional benefits been identified that will result from closing all or most of the gaps?

<– Score

84. Do you provide the physical location/geography of storage of a tenants data in advance?

<– Score

85. Data flow - what are the files and fields that are input, how are they transformed, how are they output?

<– Score

86. Did any additional data need to be collected?

<– Score

87. Do you allow tenants to opt out of having data/metadata accessed via inspection technologies?

<– Score

88. Were there any improvement opportunities identified from the process analysis?

<– Score

89. Who controls the data distribution?

<– Score

90. Specifically what data is needed and how much data should be collected?

<– Score

91. Have the problem and goal statements been updated to reflect the additional knowledge gained from the analyze phase?

<– Score

92. How are new recommendations and new requirements added to the security development lifecycle process?

<– Score

93. How does the Agile software development process work?

<– Score

94. What are the most significant performance metrics that drive your program?

<– Score

95. Which poses a threat to data privacy?

<– Score

96. How do interdependencies play into this process oriented view?

<– Score

97. How do you get the convert between code units and physical units for your dataset?

<– Score

98. Is a new method of data collection needed?

<– Score

99. What data should be collected?

<– Score

100. How long do data need to be kept in the archive database, if at all?

<– Score

101. Are gaps between current performance and the goal performance identified?

<– Score

102. Are there specific tools or techniques you use for cleansing registration and title data?

<– Score

103. What resources would be available for working with the data?

<– Score

104. Which api enables you to exchange data strings between a client and server?

<– Score

105. What lines of the program can affect the output?

<– Score

106. Do you have capability to recover data for a specific customer in the case of a failure or data loss?

<– Score

107. Do you review all agreements, policies and processes at least annually?

<– Score

108. Do you collect capacity and use data for all relevant components of your cloud service offering?

<– Score

109. Do you regularly receive data reports and metrics showing the work that is done?

<– Score

110. Is data and process analysis, root cause analysis and quantifying the gap/opportunity in place?

<– Score

111. Can the data stored with a service provider be exported by customer request?

<– Score

112. Are conclusions supported by presented data?

<– Score

113. Is the gap/opportunity displayed and communicated in financial terms?

<– Score

114. What drives the software development workflow?

<– Score

115. Why is historical population data important?

<– Score

116. Is the build script able to read and write XML data?

<– Score

117. How do you more quickly understand and evolve an application that you have never seen?

<– Score

118. Were any designed experiments used to generate additional insight into the data analysis?

<– Score

119. What data is needed and where is it?

<– Score

120. Do you encrypt tenant data at rest (on disk/storage) within your environment?

<– Score

121. What is the role of the host process in managing apps?

<– Score

122. What are the data or details needed and how is the kpi calculated?

<– Score

123. Does your it provide remote wipe or corporate data wipe for all organization-assigned mobile devices?

<– Score

124. Are there validity and reliability issues in relation to data collection?

<– Score

125. Are you adding confidential/sensitive data?

<– Score

126. How to assess the success of the open data ecosystem?

<– Score

127. Are data center tours by customers allowed by the cloud provider?

<– Score

128. Are there historical data from which to inform target setting?

<– Score

129. Can existing data sources be enhanced?

<– Score

130. Are you using data to help improve performance at the program or individual case level?

<– Score

131. Was a cause-and-effect diagram used to explore the different types of causes (or sources of variation)?

<– Score

Add up total points for this section: _____ = Total points for this section

Divided by: ______ (number of statements answered) = ______ Average score for this section

Transfer your score to the Static Code Analysis Index at the beginning of the Self-Assessment.

CRITERION #5: IMPROVE:

INTENT: Develop a practical solution. Innovate, establish and test the solution and to measure the results.

In my belief, the answer to this question is clearly defined:

5 Strongly Agree

4 Agree

3 Neutral

2 Disagree

1 Strongly Disagree

1. How is software risk managed?

<– Score

2. What types of technical debt items do the agile software development teams incur?

<– Score

3. What if you could further manipulate the program code to achieve performance improvements?

<– Score

4. How are developers trying to squeeze AWS out of code as they write it?

<– Score

5. Where are risks that your programmers are not seeing?

<– Score

6. Does the sdlc requirements or design documentation capture what would constitute a security alert?

<– Score

7. What is the Decision this KPI is to Support?

<– Score

8. How do you improve your project management, estimating, scheduling, budgeting, testing, etc., through the use of this information?

<– Score

9. What tools were used to evaluate the potential solutions?

<– Score

10. What is the security experts view of security development amongst midsized ISVs today?

<– Score

11. How did the team generate the list of possible solutions?

<– Score

12. Is there a cost/benefit analysis of optimal solution(s)?

<– Score

13. Do faster releases improve software quality?

<– Score

14. What risks would a successful attack pose to your organization?

<– Score

15. Innovation: where can you improve and create new value?

<– Score

16. What is Static Code Analysis’s impact on utilizing the best solution(s)?

<– Score

17. Do developers care about code smells?

<– Score

18. Are the best solutions selected?

<– Score

19. Does bug prediction support human developers?

<– Score

20. Do you use any special development tool for the mobile software developments?

<– Score

21. Does implementing code review improve software quality?

<– Score

22. What coding style do most developers follow?

<– Score

23. What is one of the biggest bang-for-the-buck actions that your organization can take to improve cybersecurity posture?

<– Score

24. What parts of the source should you document?

<– Score

25. Are you satisfied regarding security matter for your developed application / services?

<– Score

26. Is the information available within an acceptable period of time to inform decision-makers?

<– Score

27. Can the kpis contribute to improved service and quality of care?

<– Score

28. Are possible solutions generated and tested?

<– Score

29. Where does security fit into the software development lifecycle?

<– Score

30. Are issues and escalation documented?

<– Score

31. How do you minimize risk of failed remediation functions?

<– Score

32. Is this a document review, design review, or code review?

<– Score

33. How easy is it to integrate your solution with open source solutions?

<– Score

34. Is it possible to assign issues to developers?

<– Score

35. What is the status of your initiative to develop key performance indicators?

<– Score

36. Do you currently implement Continuous Integration in your development cycle ?

<– Score

37. If web or mobile app is used, has the website been developed in accordance with hopkins and or OWASP guidance and is it actively maintained and updated (see hopkins web checklist)?

<– Score

38. Do you make available documentation of your organization-wide risk management program?

<– Score

39. What are effective techniques to improve the quality of academic tools?

<– Score

40. Is the implementation plan designed?

<– Score

41. Is operating system matters in developing mobile services?

<– Score

42. How to integrate and combine independently developed tools?

<– Score

43. How do you address the risks and harness the benefits for security in AI software?

<– Score

44. How do you keep developers up to date on security risks?

<– Score

45. What about improvements and missing approaches in this research area?

<– Score

46. Are developers encouraged to develop secure code?

<– Score

47. Were any criteria developed to assist the team in testing and evaluating potential solutions?

<– Score

48. Is documentation describing known issues with certain products/services available?

<– Score

49. Does using automated code review services improve software quality?

<– Score

50. Do you have documented ownership for each stage of the lifecycle of encryption keys?

<– Score

51. Is this problem known by developers?

<– Score

52. What tools were most useful during the improve phase?

<– Score

53. Is the information obtained from the KPI of use in decision-making?

<– Score

54. Is there a small-scale pilot for proposed improvement(s)? What conclusions were drawn from the outcomes of a pilot?

<– Score

55. What attendant changes will need to be made to ensure that the solution is successful?

<– Score

56. Is the optimal solution selected based on testing and analysis?

<– Score

57. What types of technical debt items did the agile software development team incur?

<– Score

58. What about understanding legacy code?

<– Score

59. Are you achieving results that matter?

<– Score

60. What types of measures are needed for different decisions?

<– Score

61. Are new and improved process (‘should be’) maps developed?

<– Score

62. How do professional developers comprehend software?

<– Score

63. Describe the design of the pilot and what tests were conducted, if any?

<– Score

64. What really is the item being measured by the kpi why/how does this item matter to the decision ?

<– Score

65. Is a solution implementation plan established, including schedule/work breakdown structure, resources, risk management plan, cost/budget, and control plan?

<– Score

66. What can be done to improve maintenance value delivery?

<– Score

67. How will the team or the process owner(s) monitor the implementation plan to see that it is working as intended?

<– Score

68. Do you have any automated system to report new warnings to developers?

<– Score

69. Will your organization host the solution or will this be managed by a third party?

<– Score

70. Is there a mapping from issue to source code position?

<– Score

71. Are untested web applications putting your business at risk?

<– Score

72. How do developers promote open source projects?

<– Score

73. Do developers read compiler error messages?

<– Score

74. What do sast, dast, iast and rasp mean to your developers?

<– Score

75. Do the developers changes align to the system-level requirements and architecture?

<– Score

76. Does the solution deliver actionable diagnostics to help developers fix defects?

<– Score

77. How much variation is there between developers?

<– Score

78. What is the first phase (starting point) of software development?

<– Score

79. What communications are necessary to support the implementation of the solution?

<– Score

80. What does the ‘should be’ process map/design look like?

<– Score

81. To what degree have your KPIs changed behavior and improved performance in your organization?

<– Score

82. What problems do developers encounter during program comprehension?

<– Score

83. What error proofing will be done to address some of the discrepancies observed in the ‘as is’ process?

<– Score

84. Has the application security industry improved?

<– Score

85. What is the team’s contingency plan for potential problems occurring in implementation?

<– Score

86. Why is it difficult to understand existing code?

<– Score

87. Can all programmers improve code?

<– Score

88. How does your organization use performance results to improve operations (using each method)?

<– Score

89. How do developers use dynamic features?

<– Score

90. Is a contingency plan established?

<– Score

91. How does the solution remove the key sources of issues discovered in the analyze phase?

<– Score

92. Is there a guideline for code documentation?

<– Score

93. What lessons, if any, from a pilot were incorporated into the design of the full-scale solution?

<– Score

94. What useful decisions can be made from the KPI?

<– Score

95. What tools were used to tap into the creativity and encourage ‘outside the box’ thinking?

<– Score

96. How do developers and managers view technical debt?

<– Score

97. Are all requirements and trust levels for customers access defined and documented?

<– Score

98. What developments in the past year will influence current performance indicators?

<– Score

99. Can the application revert back to normal operation when the security risk score drops to normal levels?

<– Score

100. What is a bad evaluation method for your organization?

<– Score

101. What about development that cannot be broadly adopted across research communities or beyond?

<– Score

102. What are the software development models available ?

<– Score

103. Is your development environment holding you back?

<– Score

104. How can you significantly improve it?

<– Score

105. What is the implementation plan?

<– Score

106. How will the group know that the solution worked?

<– Score

107. How are java software developers using the eclipse ide?

<– Score

108. Does implementing code review improve software security?

<– Score

109. Are tools listed that are used during development?

<– Score

110. Is pilot data collected and analyzed?

<– Score

111. What is the development pace of web applications?

<– Score

112. How do you reduce risk without killing the benefits of agility?

<– Score

113. Can the result be written to various file-types?

<– Score

114. Map real world actions, feature location and beacons - what is the quality of names assigned to program tokens and the level of commenting?

<– Score

115. What were the underlying assumptions on the cost-benefit analysis?

<– Score

116. Has time been built in to account for design review, code review, documentation, and testing?

<– Score

117. Does the solution include full-featured reporting and decision-making modules to help your team make the most of the results?

<– Score

118. Does the solution deliver actionable diagnostics to help developers x defects?

<– Score

119. Are improved process (‘should be’) maps modified based on pilot data and analysis?

<– Score

120. How is the result presented to the auditor?

<– Score

121. Where are there risks that your programmers are not seeing?

<– Score

122. Was a pilot designed for the proposed solution(s)?

<– Score

123. Are some developers significantly more effective than others?

<– Score

124. How do software engineers understand code changes?

<– Score

125. What tools do you use during the experiment to help with the development?

<– Score

126. How is software development different?

<– Score

127. Who owns the residual risk attributable to exploitable software?

<– Score

128. Will you make the results of vulnerability scans available to tenants at request?

<– Score

129. Are there any constraints (technical, political, cultural, or otherwise) that would inhibit certain solutions?

<– Score

Add up total points for this section: _____ = Total points for this section

Divided by: ______ (number of statements answered) = ______ Average score for this section

Transfer your score to the Static Code Analysis Index at the beginning of the Self-Assessment.

CRITERION #6: CONTROL:

INTENT: Implement the practical solution. Maintain the performance and correct possible complications.

In my belief, the answer to this question is clearly defined:

5 Strongly Agree

4 Agree

3 Neutral

2 Disagree

1 Strongly Disagree

1. Do you have plans for any future Proof of Concept projects?

<– Score

2. Is reporting being used or needed?

<– Score

3. Is there a control plan in place for sustaining improvements (short and long-term)?

<– Score

4. Does the tool run on a standard system for the machines supported?

<– Score

5. Is your organization planning to build a data warehouse or BI solution?

<– Score

6. What lessons learned from prior implementations of your system do you provide around staffing?

<– Score

7. Is your privacy policy aligned with industry standards?

<– Score

8. Is all xml input data validated against an agreed schema?

<– Score

9. What key inputs and outputs are being measured on an ongoing basis?

<– Score

10. What application security monitoring requirements have been defined?

<– Score

11. How will the process owner and team be able to hold the gains?

<– Score

12. What other areas of the group might benefit from the Static Code Analysis team’s improvements, knowledge, and learning?

<– Score

13. Are operating procedures consistent?

<– Score

14. Is the complexity of the code under control?

<– Score

15. Are you meeting accessibility standards?

<– Score

16. Is there a documented and implemented monitoring plan?

<– Score

17. Can traditional web application security controls fit in a disruptive devops environment?

<– Score

18. Do you determine the monitor resolution that most users will have?

<– Score

19. How will report readings be checked to effectively monitor performance?

<– Score

20. Control flow - what conditions control the programs operations and what is sequence?

<– Score

21. What adjustments, if any, should be made to the indicators currently used?

<– Score

22. Which pieces of input to the program can an attacker control?

<– Score

23. Will any special training be provided for results interpretation?

<– Score

24. How will new or emerging customer needs/requirements be checked/communicated to orient the process toward meeting the new specifications and continually reducing variation?

<– Score

25. What should the next improvement project be that is related to Static Code Analysis?

<– Score

26. Has the improved process and its steps been standardized?

<– Score

27. What types of machine learning approaches do you typically use?

<– Score

28. How might the group capture best practices and lessons learned so as to leverage improvements?

<– Score

29. Is a response plan in place for when the input, process, or output measures indicate an ‘out-of-control’ condition?

<– Score

30. Is a response plan established and deployed?

<– Score

31. Do you disclose which controls, standards, certifications and/or regulations you comply with?

<– Score

32. How will the day-to-day responsibilities for monitoring and continual improvement be transferred from the improvement team to the process owner?

<– Score

33. Are system owners willing to adjust logging polices to meet SOC needs?

<– Score

34. Is new knowledge gained imbedded in the response plan?

<– Score

35. Are there any established standards for implementing Privacy by Design?

<– Score

36. Does a troubleshooting guide exist or is it needed?

<– Score

37. Is the owasp application security verification standard (asvs) met?

<– Score

38. Is there a transfer of ownership and knowledge to process owner and process team tasked with the responsibilities.

<– Score

39. How will input, process, and output variables be checked to detect for sub-optimal conditions?

<– Score

40. Are there documented procedures?

<– Score

41. Does job training on the documented procedures need to be part of the process team’s education and training?

<– Score

42. What are the features needed by the machine learner and which learner fits best to the problem?

<– Score

43. What quality tools were useful in the control phase?

<– Score

44. What developments (internal or external) occurring the past year will influence the strategic plan?

<– Score

45. Besides owasp, what other industry standards do you adapt for application security?

<– Score

46. What is the recommended frequency of auditing?

<– Score

47. Does the vendor monitor, administer or manage the computers that store or process your data?

<– Score

48. Are objects and documentation policies & standards compliant?

<– Score

49. Is there a recommended audit plan for routine surveillance inspections of Static Code Analysis’s gains?

<– Score

50. What is the control/monitoring plan?

<– Score

51. Does the software protect itself and its data against unauthorized access and use?

<– Score

52. Besides owasp, what other industry standards do you adapt for web app security?

<– Score

53. Are new process steps, standards, and documentation ingrained into normal operations?

<– Score

54. How will the process owner verify improvement in present and future sigma levels, process capabilities?

<– Score

55. What are the critical parameters to watch?

<– Score

56. Does the team perform architecture and design analysis to compare as-planned to as-built designs?

<– Score

57. Who is the Static Code Analysis process owner?

<– Score

58. What future developments (internal or external) are anticipated and how will they affect the strategic plan?

<– Score

59. Is knowledge gained on process shared and institutionalized?

<– Score

60. Is there a standardized process?

<– Score

61. How accurate is the resulting application depending on the machine learning algorithm used?

<– Score

62. Does the Static Code Analysis performance meet the customer’s requirements?

<– Score

63. Do you use open standards to delegate authentication capabilities to your tenants?

<– Score

64. Is code up to quality standards?

<– Score

65. Are documented procedures clear and easy to follow for the operators?

<– Score

66. What other systems, operations, processes, and infrastructures (hiring practices, staffing, training, incentives/rewards, metrics/dashboards/scorecards, etc.) need updates, additions, changes, or deletions in order to facilitate knowledge transfer and improvements?

<– Score

67. Are you changing the technology stack or application security controls?

<– Score

68. Does the system incorporate a flexible logging solution to monitor and diagnose the system?

<– Score

69. Have new or revised work instructions resulted?

<– Score

70. Are the monitoring analysis and full analysis performed together or separately?

<– Score

71. Is there documentation that will support the successful operation of the improvement?

<– Score

72. Are suggested corrective/restorative actions indicated on the response plan for known causes to problems that might surface?

<– Score

73. Does the team use a tool to help everyone comply with coding standards?

<– Score

74. Does the response plan contain a definite closed loop continual improvement scheme (e.g., plan-do-check-act)?

<– Score

75. How does the provider monitor applications?

<– Score

Add up total points for this section: _____ = Total points for this section

Divided by: ______ (number of statements answered) = ______ Average score for this section

Transfer your score to the Static Code Analysis Index at the beginning of the Self-Assessment.

CRITERION #7: SUSTAIN:

INTENT: Retain the benefits.

In my belief, the answer to this question is clearly defined:

5 Strongly Agree

4 Agree

3 Neutral

2 Disagree

1 Strongly Disagree

1. Who is responsible for your KPIs?

<– Score

2. How many defects are in your code?

<– Score

3. Are there secrets or critical IP embedded in the code?

<– Score

4. Are all requested assessment tools in production today?

<– Score

5. Is the code reviewer knowledgeable about the domain knowledge of the code that is being reviewed?

<– Score

6. Does the tool provide for any code generation?

<– Score

7. How much duplicate code was added last week?

<– Score

8. Can static code analysis in the development process be automated?

<– Score

9. Will the supplier perform static code analysis as part of its code development and/or code integration processes?

<– Score

10. Can an attacker crash the system?

<– Score

11. What is the existing Privacy by Design principles?

<– Score

12. Is the team able to find and address all inappropriate duplication of source code?

<– Score

13. Does the build script update the assembly version to tie it back to the build and revision number?

<– Score

14. What type of audit, log, or alert information will the provider send to the customer?

<– Score

15. Does the code follow the coding style guide?

<– Score

16. What is your organization-of-the-art of concurrent software testing in shared memory systems?

<– Score

17. How do you know what part of your application to examine first?

<– Score

18. What are the topics you research?

<– Score

19. What resources does the application protect?

<– Score

20. How do you know your code is secure?

<– Score

21. How many professionals work in your team and how many years of experience each one has?

<– Score

22. Why should you use this alternative method/approach to fix the vulnerability?

<– Score

23. What would happen if your organization cut its security budget in half?

<– Score

24. Rationale: what is the rationale for the indicator?

<– Score

25. What makes an application a candidate for automation?

<– Score

26. How and when is this code executed?

<– Score

27. Does this application talk to other entities (machines/services)?

<– Score

28. How often does your organization deploy code?

<– Score

29. Why is it important to continuously and frequently adapt software in the production environment?

<– Score

30. How specifically would you write the better code?

<– Score

31. Is the code coverage increasing?

<– Score

32. Does your application support an older and less-secure authentication scheme?

<– Score

33. Where are the weaknesses in your system that the COTS items introduce?

<– Score

34. Where does your organization stand strategically?

<– Score

35. Can an attacker completely take over and manipulate the system?

<– Score

36. How much of your business logic code is tested?

<– Score

37. What language do people write code in?

<– Score

38. What types of defects are really discovered in code reviews?

<– Score

39. Is the component giving dependencies too much trust?

<– Score

40. Does this software satisfy all situations?

<– Score

41. Do application security programs have a return on investment?

<– Score

42. How does the quality of client-side code change over time?

<– Score

43. What is the preliminary project schedule and budget?

<– Score

44. Does organization project estimation allot time for code reviews?

<– Score

45. What is the likelihood that it will go wrong?

<– Score

46. What is your software attack surface?

<– Score

47. What is meant by software quality?

<– Score

48. What tools are readily available?

<– Score

49. Why do something statically when you can manage it more easily on the fly?

<– Score

50. What information is already available?

<– Score

51. Is open source really more secure?

<– Score

52. What is the basic architecture of each application?

<– Score

53. What automated testing tools do you use?

<– Score

54. What are the motivations for code review at Google?

<– Score

55. Do you have proper code review practices in place?

<– Score

56. How do you choose the program inputs?

<– Score

57. Does the application support password expiration?

<– Score

58. Is the software acceptable or insufficient?

<– Score

59. Is one variable name used to represent different logical or physical entities in the program?

<– Score

60. What will you try with your own team?

<– Score

61. How will your code and applications react when something has gone wrong?

<– Score

62. Is the application going to be used on the Internet, intranet, or locally on individual computers?

<– Score

63. Are there apis and services associated with the application?

<– Score

64. Do you manager care about code quality ?

<– Score

65. Does less dynamic testing mean less quality?

<– Score

66. Are there any useful tool building patterns for software engineering tools?

<– Score

67. Can on-line help be accessed from within the graphics system?

<– Score

68. Is the tested parameter considered by the application?

<– Score

69. How will a real attacker break into your organization?

<– Score

70. What is the return-on-investment of agile methods?

<– Score

71. How much time is this team working together?

<– Score

72. Why and how should open source projects adopt time-based releases?

<– Score

73. What does success look like?

<– Score

74. What are the Structure-based (white-box) testing techniques ?

<– Score

75. Are parts of the team vocabulary used only by team individuals?

<– Score

76. Does the code review address the functional correctness of the code?

<– Score

77. Is a code review performed on all open source software used by the component?

<– Score

78. Are the validation tools comparable?

<– Score

79. Have you ever wanted quality reports on just the code changes made last month?

<– Score

80. How many kpis exist in your organization?

<– Score

81. How do you check that the code worked correctly on the test input?

<– Score

82. How long does it take to fix a vulnerability?

<– Score

83. What are some limiting factors in your organizations ecosystem?

<– Score

84. Does your application support undo or recovery operations?

<– Score

85. Are you making a difference?

<– Score

86. Where does your traditional model fail?

<– Score

87. How deep into the infrastructure can a threat agent go?

<– Score

88. What other tools integrate well with them?

<– Score

89. Do you integrate with a build management system?

<– Score

90. How hard is it to apply a fix to this code?

<– Score

91. How does this unnecessary code get in there?

<– Score

92. Does the program terminate on every input?

<– Score

93. Does your application exhibit any symptoms?

<– Score

94. What is the purpose of packaging an application?

<– Score

95. Which of the xxx metrics tells the story about how well you are managing your services?

<– Score

96. What does this buy in terms of reliability of life-critical software?

<– Score

97. How internally complex is the average file in your system?

<– Score

98. Is there any evidence that having the technical debt items visible has any influence on the team?

<– Score

99. Why are web applications so vulnerable?

<– Score

100. Do you regularly participate in code reviews?

<– Score

101. Does the target level put the program on a path to success or completion?

<– Score

102. Which common coding errors apply to the code you are reviewing?

<– Score

103. Are code elements, like types and methods, larger and more complex than the already stated of the average code base?

<– Score

104. Do you find a shared vocabulary used by all team members?

<– Score

105. How is the software built?

<– Score

106. How much does your organization presently spend on dynamic testing versus static testing?

<– Score

107. How many security code reviews have you performed on web applications?

<– Score

108. Can the difference be observed?

<– Score

109. Is open source more or less secure?

<– Score

110. Is open source software about innovation?

<– Score

111. Does the software give sensible error messages?

<– Score

112. Are there some parts of this program that always are executed together?

<– Score

113. Which is the most common way to code JavaScript with a delayed effect?

<– Score

114. Is your application going to be faster?

<– Score

115. Which web application language does the web server support?

<– Score

116. What type of applications are to be tested?

<– Score

117. Is the code dependable and secure?

<– Score

118. What is the current software inventory of your corporate assets?

<– Score

119. What is your white-box testing?

<– Score

120. Is it practical to compute the QMS of a C program through purely static code analysis?

<– Score

121. Are there practices and tools for managing technical debt?

<– Score

122. Does the system track how many failed login attempts a user has experienced?

<– Score

123. Is there a security architecture implemented in this application?

<– Score

124. Is your team at the top of its game?

<– Score

125. How can software support be integrated into employees workflow?

<– Score

126. Have there been any code audit / code review done?

<– Score

127. Can the security code review be conducted remotely?

<– Score

128. Does your software have a positive reputation?

<– Score

129. Is open source software a panacea?

<– Score

130. What, exactly, is software plagiarism?

<– Score

131. Why does some new piece of code break an existing test?

<– Score

132. What is the System Workload Mix?

<– Score

133. Have employees been trained in appropriate job skills?

<– Score

134. Does your application support a null credential or an account with no password?

<– Score

135. What is wrong with the current approach to software security?

<– Score

136. What does it mean to scale an element?

<– Score

137. Does the team write test helper classes to promote reuse?

<– Score

138. Is it possible to ensure traceability between defects and design?

<– Score

139. How does a workforce introduce the security skills to implement a secure code review methodology?

<– Score

140. Is the code being integrated into the project fully vetted by IT management and approved?

<– Score

141. What is the Application Workload Mix of each application component?

<– Score

142. Is a rebuild triggered after every source code push?

<– Score

143. Are field calibration procedures for sampling equipment specified (as applicable)?

<– Score

144. Which tools would return more number of potential errors?

<– Score

145. Where will the application reside?

<– Score

146. What areas of the code did your penetration tests hit?

<– Score

147. Where does the application host sit?

<– Score

148. Is code reviews are relevant to the software testing?

<– Score

149. How do you protect your users, regardless where they are located, from an evolving threat landscape?

<– Score

150. Does your team subscribe to rules or policies for conducting code reviews?

<– Score

151. What is the practice of code review at Google?

<– Score

152. Does the application use roles or profiles?

<– Score

153. Are there guidelines for using tools?

<– Score

154. What test design techniques should you use?

<– Score

155. How many security code reviews have you performed?

<– Score

156. What does this have to do with code?

<– Score

157. How can others gain expertise in your specialty?

<– Score

158. What other criteria would you like to have on Query specification screen for Hot Spot Review?

<– Score

159. Does it link to strategy?

<– Score

160. What are the employer branding reviews?

<– Score

161. What do mobile app users complain about?

<– Score

162. How difficult is it for an individual with a computer science background to use the tool?

<– Score

163. Do you have all of the facts?

<– Score

164. Is the static structure comprehensible?

<– Score

165. Is the software straightforward to use or is it cumbersome?

<– Score

166. What factors (internal or external) were instrumental to success or lack of success?

<– Score

167. Is the team able to profile the systems performance?

<– Score

168. Can the system accommodate updating left hand to left-handed and right hand to right-handed?

<– Score

169. Who wants to make a career of maintaining massive amounts of software written by others?

<– Score

170. Are there web services within the application?

<– Score

171. Do you find the new code fixes useful?

<– Score

172. How does it fit into your organization?

<– Score

173. Is the software being built with predictability or irregularity?

<– Score

174. Does the team write test code as short test methods?

<– Score

175. Are current approaches sufficient for measuring software quality?

<– Score

176. What kind of security threats mobile services or software could face?

<– Score

177. Does the team avoid explicit typing of local variables in test code?

<– Score

178. Will the trend towards open source software in areas other than the operating system continue?

<– Score

179. What if it is your organization that is at stake?

<– Score

180. What code do you expect to get and what does it do?

<– Score

181. How are electronic and credit card payments handled in the system?

<– Score

182. Is the kpi supported by scientific evidence or the consensus of experts?

<– Score

183. Does anyone know what a canary in the code is?

<– Score

184. How do you effectively manage new types of devices and your mobile/remote users?

<– Score

185. How do your customers see you?

<– Score

186. What are your experiences when reusing code from other researchers?

<– Score

187. What is your experience with reusing your own code?

<– Score

188. Should the indicator be reported as a key, supporting or general performance information indicator?

<– Score

189. Which technologies do you suggest your organization explore?

<– Score

190. Which code fragment do you prefer?

<– Score

191. Does talking about the software bring forth bliss or upset?

<– Score

192. What if you could access it from shared code?

<– Score

193. Do you use the tools more effectively and efficiently?

<– Score

194. How is static code analysis best integrated into the development process of embedded software?

<– Score

195. Is it externally facing or internal to trusted users?

<– Score

196. How do you secure your services and applications?

<– Score

197. Are you being fair and honest?

<– Score

198. In what way does each failure matter?

<– Score

199. Do you think there are aspects that are missing in this model?

<– Score

200. Do p and q point to disjoint structures in the heap?

<– Score

201. Has consideration been given to other projects or initiatives?

<– Score

202. Why does code have vulnerabilities?

<– Score

203. What parts of your apps are loved by users?

<– Score

204. Are users made aware of responsibilities for maintaining a safe and secure working environment?

<– Score

205. Is more information better?

<– Score

206. How does program size affect the effectiveness of code coverage tools?

<– Score

207. How often do you reuse code of other researchers?

<– Score

208. Does the system have the desired structure?

<– Score

209. Has every edge in the program been executed?

<– Score

210. How can this knowledge be transformed into attack insights?

<– Score

211. Does the team profile the systems performance on a regular basis?

<– Score

212. Is it a simple or derived KPI?

<– Score

213. What type of connectivity will most users have?

<– Score

214. How important are the given quality report properties?

<– Score

215. Does the team use stub objects to test in isolation?

<– Score

216. What are the consequences of this system failing?

<– Score

217. How do you know how much code to put in one function before it gets too large?

<– Score

218. Which continuous integration or continuous delivery tools do you support?

<– Score

219. What is software engineering excellence?

<– Score

220. How do you test your source code?

<– Score

221. Is clean code more important than efficient code?

<– Score

222. Who does what during a code review?

<– Score

223. How often do you release new versions or update the software?

<– Score

224. Does the value of variable x depend on the program input?

<– Score

225. How important is this application to the enterprise?

<– Score

226. How does javascript make an application dynamic and interactive?

<– Score

227. What happens when you publish source code?

<– Score

228. What are the characteristics of the target architecture on which this code was written to run?

<– Score

229. Which is most likely to help you code this?

<– Score

230. What is the average number of levels the KPIs cascade down?

<– Score

231. Can an attacker gain administration access to the system?

<– Score

232. What is the main objective of a specific review (meeting)?

<– Score

233. Is the program designed to fail gracefully?

<– Score

234. How do you ensure application teams are aware of security vulnerabilities?

<– Score

235. Where does each team perform most of work and how often do multiple teams have to work on the same service or module?

<– Score

236. Does your program have a double free?

<– Score

237. Has the team adopted an effective naming convention for test code?

<– Score

238. What security tools and/or services do you as your organization currently own/use?

<– Score

239. What can be done and what options are available?

<– Score

240. Is the code itself a stated deliverable (primary) or does it generate a deliverable (secondary)?

<– Score

241. Does the same checker run on different languages source code?

<– Score

242. Do you have formal management expertise, and are new to agile methods?

<– Score

243. What are the application features?

<– Score

244. How to compare or benchmark tools?

<– Score

245. How many think that quality can be effectively tested in ?

<– Score

246. What languages are used for each application?

<– Score

247. Do you permit tenants to perform independent vulnerability assessments?

<– Score

248. What do you want to accomplish?

<– Score

249. What symbol is declared at the specific location in the source?

<– Score

250. Did that ids alert hit a system that was actually vulnerable?

<– Score

251. Why was this code written this way?

<– Score

252. Do you have an internal audit program that allows for cross-functional audit of assessments?

<– Score

253. Which automatic programming system should be used?

<– Score

254. What management practices and tools are used in industry to deal with debt?

<– Score

255. What kind of software should be fuzzed?

<– Score

256. Does your application expose sensitive information via user session?

<– Score

257. Does users perception of trust varies with age?

<– Score

258. Are software code reviews conducted?

<– Score

259. What if you want to switch to another model?

<– Score

260. Is the software elegant or is it ugly?

<– Score

261. What does static code analysis do?

<– Score

262. Is this application usable for the user?

<– Score

263. Does the application rely on client side validation?

<– Score

264. What exactly are you able to make the application do?

<– Score

265. How often do you reuse code from your own experiments on average?

<– Score

266. Is there a preference between commercial or free tools?

<– Score

267. Where do you want to be?

<– Score

268. How to teach clean code at organization?

<– Score

269. How to implement Continuous Integration?

<– Score

270. Are there any modifications necessary to the KPI specifications?

<– Score

271. How do you track your progress?

<– Score

272. Does the service provider organization have long term sustainability potential?

<– Score

273. What are you all doing to address application security concerns in your organization?

<– Score

274. Does your application performance slow down over time or when you perform certain operations?

<– Score

275. Who are the applications users and what are patterns and sequences of input?

<– Score

276. What is good software architecture or design?

<– Score

277. Value: is what you are doing making a difference?

<– Score

278. What questions do programmers ask about configuration as code?

<– Score

279. How is this system or application put together?

<– Score

280. Have you looked at your source code lately?

<– Score

281. Is there any software out there that is going to be able to check that kind of source code?

<– Score

282. How secure is it to host applications in Docker?

<– Score

283. Utility: how are indicators used for internal management and accountability?

<– Score

284. How serious is this vulnerability?

<– Score

285. What system/application availability and response time will your proposed system meet?

<– Score

286. What does the team do about quality?

<– Score

287. Which types of applications use Web Workers?

<– Score

288. What do you want to verify?

<– Score

289. Where are the application properties/configuration parameters stored?

<– Score

290. What challenges do you face when using GNU Make to build and unit test your code?

<– Score

291. Who added code line X, when and why?

<– Score

292. What sorts of techniques might an attacker use to subvert the application?

<– Score

293. How many paths are in a program?

<– Score

294. What progress toward accomplishing strategic goals and objectives was made last year?

<– Score

295. Are parts of the team vocabulary used only temporarily?

<– Score

296. How this application work in a mobile factor?

<– Score

297. Where does your organization stand operationally?

<– Score

298. What happens when you start minimizing threats from system and application bugs?

<– Score

299. Does your organization provide the list of different user types who will be accessing the system?

<– Score

300. Does your organization want to use single sign on for your organization and external users?

<– Score

301. Are you meeting targets?

<– Score

302. Is the evolving design going to work?

<– Score

303. Do many eyeballs on the code make it secure?

<– Score

304. Are you using a less popular framework which provides user input to the application?

<– Score

305. How to use Open Web Application Security Project (OWASP) for ISO 27001?

<– Score

306. How do you acquire the code or experiment from other researchers?

<– Score

307. Is the program intended to be run with privileges?

<– Score

308. Does the team use only one mock object within a test method when testing interaction?

<– Score

309. What if you knew which source files were already covered by unit tests?

<– Score

310. How would using the vendors cloud infrastructure weaken your organizations existing network security posture?

<– Score

311. What weaknesses in your software could be exploited?

<– Score

312. When, where and how to use automated tools?

<– Score

313. What is your organization security scheme?

<– Score

314. How frequently do you perform network and server vulnerability scans?

<– Score

315. Where do you get the code to assess?

<– Score

316. What is the relationship between the notification text and the code?

<– Score

317. Is there a piece of program code used repetitively?

<– Score

318. What is essential to test automation design?

<– Score

319. Does your team members/resources provide you with more information?

<– Score

320. How big is duplication of code in current code base?

<– Score

321. Are complex structures employed in the code?

<– Score

322. What parts of the code are left in the wild?

<– Score

323. How much of your code do you actually use?

<– Score

324. Are the kpis acceptable?

<– Score

325. Are all the vulnerabilities related in your code?

<– Score

326. How do you protect mobile and remote users effectively and efficiently?

<– Score

327. Why is application security important?

<– Score

328. Do you use any tools to automatically test the security of your application?

<– Score

329. Is the application internal or external facing?

<– Score

330. Is there a piece of code used repetitively?

<– Score

331. Are automated security scans included as part of continuous integration for each code commit?

<– Score

332. Performance accountability, at its highest level, should point toward fulfillment of your organizations leadership vision and core mission part of Who are you? Is that true in your organization?

<– Score

333. Has the security design been implemented correctly in the application components?

<– Score

334. What have similar software packages done and how has that worked out for you?

<– Score

335. What tools do you use to model threats to the application?

<– Score

Add up total points for this section: _____ = Total points for this section

Divided by: ______ (number of statements answered) = ______ Average score for this section

Transfer your score to the Static Code Analysis Index at the beginning of the Self-Assessment.

Static Code Analysis and Managing Projects, Criteria for Project Managers:

1.0 Initiating Process Group: Static Code Analysis

1. Do you understand all business (operational), technical, resource and vendor risks associated with the Static Code Analysis project?

2. Which six sigma dmaic phase focuses on why and how defects and errors occur?

3. Although the Static Code Analysis project manager does not directly manage procurement and contracting activities, who does manage procurement and contracting activities in your organization then if not the PM?

4. When must it be done?

5. At which cmmi level are software processes documented, standardized, and integrated into a standard to-be practiced process for your organization?

6. When will the Static Code Analysis project be done?

7. First of all, should any action be taken?

8. How can you make your needs known?

9. What will you do to minimize the impact should a risk event occur?

10. How will you know you did it?

11. Who is involved in each phase?

12. What were things that you did well, and could improve, and how?

13. Were sponsors and decision makers available when needed outside regularly scheduled meetings?

14. Are you properly tracking the progress of the Static Code Analysis project and communicating the status to stakeholders?

15. Who supports, improves, and oversees standardized processes related to the Static Code Analysis projects program?

16. Do you know the Static Code Analysis projects goal, purpose and objectives?

17. Mitigate. what will you do to minimize the impact should the risk event occur?

18. Do you know all the stakeholders impacted by the Static Code Analysis project and what needs are?

19. Are there resources to maintain and support the outcome of the Static Code Analysis project?

20. Are the changes in your Static Code Analysis project being formally requested, analyzed, and approved by the appropriate decision makers?

1.1 Project Charter: Static Code Analysis

21. Why Outsource?

22. Why use a Static Code Analysis project charter?

23. What date will the task finish?

24. Major high-level milestone targets: what events measure progress?

25. Name and describe the elements that deal with providing the detail?

26. How do you manage integration?

27. Is it an improvement over existing products?

28. What are the assigned resources?

29. What are the assumptions?

30. Are you building in-house ?

31. Why is a Static Code Analysis project Charter used?

32. Assumptions: what factors, for planning purposes, are you considering to be true?

33. Who are the stakeholders?

34. Where does all this information come from?

35. Does the Static Code Analysis project need to consider any special capacity or capability issues?

36. Is time of the essence?

37. Environmental stewardship and sustainability considerations: what is the process that will be used to ensure compliance with the environmental stewardship policy?

38. Where and how does the team fit within your organization structure?

39. Who is the sponsor?

1.2 Stakeholder Register: Static Code Analysis

40. Who wants to talk about Security?

41. How should employers make voices heard?

42. How big is the gap?

43. Who is managing stakeholder engagement?

44. What & Why?

45. What opportunities exist to provide communications?

46. What are the major Static Code Analysis project milestones requiring communications or providing communications opportunities?

47. How much influence do they have on the Static Code Analysis project?

48. What is the power of the stakeholder?

49. How will reports be created?

50. Is your organization ready for change?

1.3 Stakeholder Analysis Matrix: Static Code Analysis

51. What is the stakeholders name, what is function?

52. Has there been a similar initiative in the region?

53. What are the key services, contractual arrangements, or other relationships between stakeholder groups?

54. How can you fill the need to show progress?

55. Volumes, production, economies?

56. Cultural, attitudinal, behavioural?

57. Geographical, export, import?

58. Do any safeguard policies apply to the Static Code Analysis project?

59. What is your Risk Management?

60. New markets, vertical, horizontal?

61. What is the relationship among stakeholders?

62. Where are the good opportunities facing your organizations development?

63. Own known vulnerabilities?

64. Why do you care?

65. Industry or lifestyle trends?

66. Arena: in what fields are the actors active, where are they present?

67. Which conditions out of the control of the management are crucial to contribute for the achievement of the development objective?

68. Would it be fair to say that cost is a controlling criteria?

69. What is accountability in relation to the Static Code Analysis project?

2.0 Planning Process Group: Static Code Analysis

70. Why do it Static Code Analysis projects fail?

71. To what extent and in what ways are the Static Code Analysis project contributing to progress towards organizational reform?

72. In what way has the program contributed towards the issue culture and development included on the public agenda?

73. Are the necessary foundations in place to ensure the sustainability of the results of the Static Code Analysis project?

74. When will the Static Code Analysis project be done?

75. How will it affect you?

76. Explanation: is what the Static Code Analysis project intents to solve a hard question?

77. If a task is partitionable, is this a sufficient condition to reduce the Static Code Analysis project duration?

78. Static Code Analysis project assessment; why did you do this Static Code Analysis project?

79. Have operating capacities been created and/or reinforced in partners?

80. What business situation is being addressed?

81. How well will the chosen processes produce the expected results?

82. Will the products created live up to the necessary quality?

83. To what extent have public/private national resources and/or counterparts been mobilized to contribute to the programs objective and produce results and impacts?

84. When developing the estimates for Static Code Analysis project phases, you choose to add the individual estimates for the activities that comprise each phase. What type of estimation method are you using?

85. The Static Code Analysis project charter is created in which Static Code Analysis project management process group?

86. Does it make any difference if you are successful?

87. What are the different approaches to building the WBS?

88. Professionals want to know what is expected from them; what are the deliverables?

2.1 Project Management Plan: Static Code Analysis

89. Has the selected plan been formulated using cost effectiveness and incremental analysis techniques?

90. Who manages integration?

91. Are the existing and future without-plan conditions reasonable and appropriate?

92. What data/reports/tools/etc. do program managers need?

93. Is the budget realistic?

94. If the Static Code Analysis project is complex or scope is specialized, do you have appropriate and/or qualified staff available to perform the tasks?

95. What if, for example, the positive direction and vision of your organization causes expected trends to change resulting in greater need than expected?

96. Why Change?

97. Are there non-structural buyout or relocation recommendations?

98. How well are you able to manage your risk?

99. What are the constraints?

100. Are there any windfall benefits that would accrue to the Static Code Analysis project sponsor or other parties?

101. Why do you manage integration?

102. Is there an incremental analysis/cost effectiveness analysis of proposed mitigation features based on an approved method and using an accepted model?

103. Is mitigation authorized or recommended?

104. Is the appropriate plan selected based on your organizations objectives and evaluation criteria expressed in Principles and Guidelines policies?

105. What went right?

106. What data/reports/tools/etc. do your PMs need?

2.2 Scope Management Plan: Static Code Analysis

107. Does the Static Code Analysis project have a Quality Culture?

108. Are the payment terms being followed?

109. Do you document disagreements and work towards resolutions?

110. Has your organization done similar tasks before?

111. Organizational unit (e.g., department, team, or person) who will accept responsibility for satisfactory completion of the item?

112. Do Static Code Analysis project teams & team members report on status / activities / progress?

113. Is there an onboarding process in place?

114. Are there procedures in place to effectively manage interdependencies with other Static Code Analysis projects, systems, Vendors and your organizations work effort?

115. Are Static Code Analysis project team members committed fulltime?

116. Have stakeholder accountabilities & responsibilities been clearly defined?

117. Are risk triggers captured?

118. What work performance data will be captured?

119. Is there a formal process for updating the Static Code Analysis project baseline?

120. Has a sponsor been identified?

121. Do Static Code Analysis project managers participating in the Static Code Analysis project know the Static Code Analysis projects true status first hand?

122. Were Static Code Analysis project team members involved in detailed estimating and scheduling?

123. Have the personnel with the necessary skills and competence been identified and has agreement for participation in the Static Code Analysis project been reached with the appropriate management?

124. Are software metrics formally captured, analyzed and used as a basis for other Static Code Analysis project estimates?

2.3 Requirements Management Plan: Static Code Analysis

125. How will bidders price evaluations be done, by deliverables, phases, or in a big bang?

126. When and how will a requirements baseline be established in this Static Code Analysis project?

127. How knowledgeable is the primary Stakeholder(s) in the proposed application area?

128. Are actual resource expenditures versus planned still acceptable?

129. Controlling Static Code Analysis project requirements involves monitoring the status of the Static Code Analysis project requirements and managing changes to the requirements. Who is responsible for monitoring and tracking the Static Code Analysis project requirements?

130. Are all the stakeholders ready for the transition into the user community?

131. How detailed should the Static Code Analysis project get?

132. Why manage requirements?

133. Is requirements work dependent on any other specific Static Code Analysis project or non-Static Code Analysis project activities (e.g. funding, approvals, procurement)?

134. Is stakeholder risk tolerance an important factor for the requirements process in this Static Code Analysis project?

135. What is a problem?

136. Could inaccurate or incomplete requirements in this Static Code Analysis project create a serious risk for the business?

137. Is the system software (non-operating system) new to the IT Static Code Analysis project team?

138. How will you communicate scheduled tasks to other team members?

139. Who will approve the requirements (and if multiple approvers, in what order)?

140. Is the user satisfied?

141. The wbs is developed as part of a joint planning session. and how do you know that youhave done this right?

142. Who will do the reporting and to whom will reports be delivered?

143. Is there formal agreement on who has authority to request a change in requirements?

144. How will you develop the schedule of requirements activities?

2.4 Requirements Documentation: Static Code Analysis

145. Completeness. are all functions required by the customer included?

146. What are current process problems?

147. What are the attributes of a customer?

148. How does what is being described meet the business need?

149. What is a show stopper in the requirements?

150. Where are business rules being captured?

151. What is the risk associated with the technology?

152. Do your constraints stand?

153. What kind of entity is a problem ?

154. Have the benefits identified with the system being identified clearly?

155. What is your Elevator Speech?

156. How does the proposed Static Code Analysis project contribute to the overall objectives of your organization?

157. How do you get the user to tell you what they want?

158. What will be the integration problems?

159. Verifiability. can the requirements be checked?

160. Are there any requirements conflicts?

161. Can you check system requirements?

162. Does the system provide the functions which best support the customers needs?

163. Does your organization restrict technical alternatives?

164. What if the system wasn t implemented?

2.5 Requirements Traceability Matrix: Static Code Analysis

165. How do you manage scope?

166. Will you use a Requirements Traceability Matrix?

167. What are the chronologies, contingencies, consequences, criteria?

168. How small is small enough?

169. What percentage of Static Code Analysis projects are producing traceability matrices between requirements and other work products?

170. Describe the process for approving requirements so they can be added to the traceability matrix and Static Code Analysis project work can be performed. Will the Static Code Analysis project requirements become approved in writing?

171. Is there a requirements traceability process in place?

172. Why use a WBS?

173. Do you have a clear understanding of all subcontracts in place?

174. What is the WBS?

175. Why do you manage scope?

176. How will it affect the stakeholders personally in career?

2.6 Project Scope Statement: Static Code Analysis

177. Relevant - ask yourself can you get there; why are you doing this Static Code Analysis project?

178. Is the scope of your Static Code Analysis project well defined?

179. Will there be a Change Control Process in place?

180. Have you been able to easily identify success criteria and create objective measurements for each of the Static Code Analysis project scopes goal statements?

181. Is the Static Code Analysis project manager qualified and experienced in Static Code Analysis project management?

182. Any new risks introduced or old risks impacted. Are there issues that could affect the existing requirements for the result, service, or product if the scope changes?

183. What process would you recommend for creating the Static Code Analysis project scope statement?

184. Will the Static Code Analysis project risks be managed according to the Static Code Analysis projects risk management process?

185. Is the plan for your organization of the Static Code Analysis project resources adequate?

186. Has a method and process for requirement tracking been developed?

187. How often will scope changes be reviewed?

188. Elements of scope management that deal with concept development ?

189. Are there completion/verification criteria defined for each task producing an output?

190. Does the scope statement still need some clarity?

191. Will the risk status be reported to management on a regular and frequent basis?

192. How will you verify the accuracy of the work of the Static Code Analysis project, and what constitutes acceptance of the deliverables?

193. Is the Static Code Analysis project organization documented and on file?

194. What is change?

2.7 Assumption and Constraint Log: Static Code Analysis

195. Are formal code reviews conducted?

196. Are there cosmetic errors that hinder readability and comprehension?

197. If it is out of compliance, should the process be amended or should the Plan be amended?

198. Is the process working, and people are not executing in compliance of the process?

199. Does a documented Static Code Analysis project organizational policy & plan (i.e. governance model) exist?

200. What if failure during recovery?

201. Does the plan conform to standards?

202. Are there processes in place to ensure that all the terms and code concepts have been documented consistently?

203. Were the system requirements formally reviewed prior to initiating the design phase?

204. Have you eliminated all duplicative tasks or manual efforts, where appropriate?

205. When can log be discarded?

206. Does the Static Code Analysis project have a formal Static Code Analysis project Plan?

207. Has the approach and development strategy of the Static Code Analysis project been defined, documented and accepted by the appropriate stakeholders?

208. What strengths do you have?

209. What weaknesses do you have?

210. Do documented requirements exist for all critical components and areas, including technical, business, interfaces, performance, security and conversion requirements?

211. Should factors be unpredictable over time?

212. Can the requirements be traced to the appropriate components of the solution, as well as test scripts?

213. Are there processes defining how software will be developed including development methods, overall timeline for development, software product standards, and traceability?

214. Is this model reasonable?

2.8 Work Breakdown Structure: Static Code Analysis

215. How will you and your Static Code Analysis project team define the Static Code Analysis projects scope and work breakdown structure?

216. Do you need another level?

217. Is it still viable?

218. What is the probability of completing the Static Code Analysis project in less that xx days?

219. Is the work breakdown structure (wbs) defined and is the scope of the Static Code Analysis project clear with assigned deliverable owners?

220. When does it have to be done?

221. Why would you develop a Work Breakdown Structure?

222. Why is it useful?

223. Is it a change in scope?

224. Where does it take place?

225. How big is a work-package?

226. Who has to do it?

227. Can you make it?

228. When do you stop?

229. How far down?

230. What is the probability that the Static Code Analysis project duration will exceed xx weeks?

2.9 WBS Dictionary: Static Code Analysis

231. Are records maintained to show how management reserves are used?

232. Contemplated overhead expenditure for each period based on the best information currently available?

233. Does the contractor require sufficient detailed planning of control accounts to constrain the application of budget initially allocated for future effort to current effort?

234. Are procedures in existence that control replanning of unopened work packages, and are corresponding procedures adhered to?

235. Identify potential or actual overruns and underruns?

236. Is work progressively subdivided into detailed work packages as requirements are defined?

237. Are retroactive changes to direct costs and indirect costs prohibited except for the correction of errors and routine accounting adjustments?

238. Are internal budgets for authorized, and not priced changes based on the contractors resource plan for accomplishing the work?

239. Is each control account assigned to a single organizational element directly responsible for the work and identifiable to a single element of the CWBS?

240. Are all elements of indirect expense identified to overhead cost budgets of Static Code Analysis projections?

241. Are estimates of costs at completion generated in a rational, consistent manner?

242. Is cost performance measurement at the point in time most suitable for the category of material involved, and no earlier than the time of actual receipt of material?

243. Are data elements summarized through the functional organizational structure for progressively higher levels of management?

244. Where learning is used in developing underlying budgets is there a direct relationship between anticipated learning and time phased budgets?

245. Is all contract work included in the CWBS?

246. Is the entire contract planned in time-phased control accounts to the extent practicable?

247. Are current work performance indicators and goals relatable to original goals as modified by contractual changes, replanning, and reprogramming actions?

248. Are overhead budgets and costs being handled according to the disclosure statement when applicable, or otherwise properly classified (for example, engineering overhead, IR&D)?

249. The anticipated business volume?

250. Is cost and schedule performance measurement done in a consistent, systematic manner?

2.10 Schedule Management Plan: Static Code Analysis

251. Are non-critical path items updated and agreed upon with the teams?

252. Are assumptions being identified, recorded, analyzed, qualified and closed?

253. Has process improvement efforts been completed before requirements efforts begin?

254. Are tasks tracked by hours?

255. Define units of measurement for each resource. For example, are you referencing gallons or liters?

256. Are vendor contract reports, reviews and visits conducted periodically?

257. Are vendor invoices audited for accuracy before payment?

258. Have Static Code Analysis project team accountabilities & responsibilities been clearly defined?

259. Why time management?

260. Sensitivity analysis?

261. Do Static Code Analysis project managers participating in the Static Code Analysis project know the Static Code Analysis projects true status first hand?

262. Have all team members been part of identifying risks?

263. What happens if a warning is triggered?

264. Is a process defined for baseline approval and control?

265. Has your organization readiness assessment been conducted?

266. Does the detailed work plan match the complexity of tasks with the capabilities of personnel?

267. Are risk oriented checklists used during risk identification?

268. Are the Static Code Analysis project plans updated on a frequent basis?

269. Is there a formal set of procedures supporting Stakeholder Management?

270. Is the correct WBS element identified for each task and milestone in the IMS?

2.11 Activity List: Static Code Analysis

271. How can the Static Code Analysis project be displayed graphically to better visualize the activities?

272. What did not go as well?

273. What went well?

274. How do you determine the late start (LS) for each activity?

275. What is the LF and LS for each activity?

276. What went wrong?

277. In what sequence?

278. What will be performed?

279. How difficult will it be to do specific activities on this Static Code Analysis project?

280. Is infrastructure setup part of your Static Code Analysis project?

281. What are you counting on?

282. When will the work be performed?

283. How will it be performed?

284. What is your organizations history in doing similar activities?

285. How detailed should a Static Code Analysis project get?

286. When do the individual activities need to start and finish?

287. What is the probability the Static Code Analysis project can be completed in xx weeks?

288. Should you include sub-activities?

2.12 Activity Attributes: Static Code Analysis

289. Can more resources be added?

290. Time for overtime?

291. Is there anything planned that does not need to be here?

292. What activity do you think you should spend the most time on?

293. Activity: fair or not fair?

294. Have constraints been applied to the start and finish milestones for the phases?

295. What is missing?

296. Where else does it apply?

297. Resources to accomplish the work?

298. Were there other ways you could have organized the data to achieve similar results?

299. Resource is assigned to?

300. What is the general pattern here?

301. Is there a trend during the year?

302. How do you manage time?

303. Activity: what is Missing?

304. Activity: what is In the Bag?

305. How else could the items be grouped?

306. Does your organization of the data change its meaning?

307. Are the required resources available or need to be acquired?

2.13 Milestone List: Static Code Analysis

308. Level of the Innovation?

309. How will you get the word out to customers?

310. Reliability of data, plan predictability?

311. What is the market for your technology, product or service?

312. Gaps in capabilities?

313. What specific improvements did you make to the Static Code Analysis project proposal since the previous time?

314. Milestone pages should display the UserID of the person who added the milestone. Does a report or query exist that provides this audit information?

315. When will the Static Code Analysis project be complete?

316. What has been done so far?

317. How will the milestone be verified?

318. Which path is the critical path?

319. Environmental effects?

320. Timescales, deadlines and pressures?

321. How late can the activity finish?

322. Vital contracts and partners?

323. How late can each activity be finished and started?

324. Sustainable financial backing?

2.14 Network Diagram: Static Code Analysis

325. Exercise: what is the probability that the Static Code Analysis project duration will exceed xx weeks?

326. What job or jobs precede it?

327. Will crashing x weeks return more in benefits than it costs?

328. Review the logical flow of the network diagram. Take a look at which activities you have first and then sequence the activities. Do they make sense?

329. What activities must follow this activity?

330. What controls the start and finish of a job?

331. What job or jobs could run concurrently?

332. If the Static Code Analysis project network diagram cannot change and you have extra personnel resources, what is the BEST thing to do?

333. Which type of network diagram allows you to depict four types of dependencies?

334. Where do you schedule uncertainty time?

335. What can be done concurrently?

336. Are the required resources available?

337. If a current contract exists, can you provide the vendor name, contract start, and contract expiration date?

338. What are the tools?

339. What activities must occur simultaneously with this activity?

340. What is the lowest cost to complete this Static Code Analysis project in xx weeks?

341. What are the Key Success Factors?

342. What are the Major Administrative Issues?

343. What is the completion time?

2.15 Activity Resource Requirements: Static Code Analysis

344. Other support in specific areas?

345. How do you handle petty cash?

346. How many signatures do you require on a check and does this match what is in your policy and procedures?

347. Which logical relationship does the PDM use most often?

348. Are there unresolved issues that need to be addressed?

349. Organizational Applicability?

350. Why do you do that?

351. What is the Work Plan Standard?

352. What are constraints that you might find during the Human Resource Planning process?

353. Anything else?

354. Do you use tools like decomposition and rolling-wave planning to produce the activity list and other outputs?

355. When does monitoring begin?

2.16 Resource Breakdown Structure: Static Code Analysis

356. What is the difference between % Complete and % work?

357. Which resources should be in the resource pool?

358. What is the purpose of assigning and documenting responsibility?

359. Is predictive resource analysis being done?

360. Why do you do it?

361. Changes based on input from stakeholders?

362. What is the primary purpose of the human resource plan?

363. Which resource planning tool provides information on resource responsibility and accountability?

364. Who is allowed to perform which functions?

365. Who will be used as a Static Code Analysis project team member?

366. What is each stakeholders desired outcome for the Static Code Analysis project?

367. What is the number one predictor of a groups productivity?

368. Any changes from stakeholders?

369. Why is this important?

370. How difficult will it be to do specific activities on this Static Code Analysis project?

371. Who is allowed to see what data about which resources?

372. The list could probably go on, but, the thing that you would most like to know is, How long & How much?

373. Who needs what information?

2.17 Activity Duration Estimates: Static Code Analysis

374. Consider the history of modern quality management. How have experts such as Deming, Juran, Crosby, and Taguchi affected the quality movement and todays use of Six Sigma?

375. Why do you need a good WBS to use Static Code Analysis project management software?

376. Are procedures defined by which the Static Code Analysis project scope may be changed?

377. What is wrong with this scenario?

378. What do corresponding sources say about Static Code Analysis project management?

379. Who will provide training for the new application?

380. Briefly describe some key events in the history of Static Code Analysis project management. What Static Code Analysis project was the first to use modern Static Code Analysis project management?

381. Are activity duration estimates documented?

382. What is pmp certification, and why do you think the number of people earning it has grown so much in the past ten years?

383. Is a work breakdown structure created to organize and to confirm the scope of each Static Code Analysis project?

384. Does a process exist to determine the probability of risk events?

385. Are changes to the scope managed according to defined procedures?

386. When would a milestone chart be used instead of a bar char?

387. Do checklists exist that list frequently performed activities?

388. What does it mean to take a systems view of a Static Code Analysis project?

389. How difficult will it be to complete specific activities on this Static Code Analysis project?

390. Is the work performed reviewed against contractual objectives?

391. Which is a benefit of an analogous Static Code Analysis project estimate?

392. Who will promote it?

393. What is involved in the solicitation process?

2.18 Duration Estimating Worksheet: Static Code Analysis

394. What is cost and Static Code Analysis project cost management?

395. Do any colleagues have experience with your organization and/or RFPs?

396. Why estimate costs?

397. For other activities, how much delay can be tolerated?

398. When, then?

399. Why estimate time and cost?

400. Is the Static Code Analysis project responsive to community need?

401. What info is needed?

402. What is an Average Static Code Analysis project?

403. What are the critical bottleneck activities?

404. Can the Static Code Analysis project be constructed as planned?

405. What is next?

406. When does your organization expect to be able to complete it?

407. Will the Static Code Analysis project collaborate with the local community and leverage resources?

408. Science = process: remember the scientific method?

409. What is your role?

410. Does the Static Code Analysis project provide innovative ways for stakeholders to overcome obstacles or deliver better outcomes?

411. What utility impacts are there?

412. What questions do you have?

413. What is the total time required to complete the Static Code Analysis project if no delays occur?

2.19 Project Schedule: Static Code Analysis

414. How can slack be negative?

415. How effectively were issues able to be resolved without impacting the Static Code Analysis project Schedule or Budget?

416. What documents, if any, will the subcontractor provide (eg Static Code Analysis project schedule, quality plan etc)?

417. How many levels?

418. How can you fix it?

419. It allows the Static Code Analysis project to be delivered on schedule. How Do you Use Schedules?

420. Why do you need to manage Static Code Analysis project Risk?

421. Eliminate unnecessary activities. Are there activities that came from a template or previous Static Code Analysis project that are not applicable on this phase of this Static Code Analysis project?

422. Why is software Static Code Analysis project disaster so common?

423. Have all Static Code Analysis project delays been adequately accounted for, communicated to all stakeholders and adjustments made in overall Static Code Analysis project schedule?

424. Are there activities that came from a template or previous Static Code Analysis project that are not applicable on this phase of this Static Code Analysis project?

425. Month Static Code Analysis project take?

426. Verify that the update is accurate. Are all remaining durations correct?

427. How can you address that situation?

428. How can you shorten the schedule?

429. Are all remaining durations correct?

430. Are procedures defined by which the Static Code Analysis project schedule may be changed?

431. What is risk?

432. If there are any qualifying green components to this Static Code Analysis project, what portion of the total Static Code Analysis project cost is green?

2.20 Cost Management Plan: Static Code Analysis

433. Are meeting objectives identified for each meeting?

434. Are metrics used to evaluate and manage Vendors?

435. Who should write the PEP?

436. What is the work breakdown structure for the Static Code Analysis project?

437. Is Static Code Analysis project work proceeding in accordance with the original Static Code Analysis project schedule?

438. Is there anything unique in this Static Code Analysis projects scope statement that will affect resources?

439. Is current scope of the Static Code Analysis project substantially different than that originally defined?

440. Are all resource assumptions documented?

441. Staffing Requirements?

442. Have key stakeholders been identified?

443. Has the scope management document been updated and distributed to help prevent scope creep?

444. Is the steering committee active in Static Code Analysis project oversight?

445. Is there a formal set of procedures supporting Issues Management?

446. Exclusions – is there scope to be performed or provided by others?

447. Are all payments made according to the contract(s)?

448. Is there an on-going process in place to monitor Static Code Analysis project risks?

449. Are Static Code Analysis project contact logs kept up to date?

2.21 Activity Cost Estimates: Static Code Analysis

450. Does the activity serve a common type of customer?

451. What makes a good expected result statement?

452. Were the tasks or work products prepared by the consultant useful?

453. What is the estimators estimating history?

454. How do you fund change orders?

455. How do you do activity recasts?

456. What skill level is required to do the job?

457. Based on your Static Code Analysis project communication management plan, what worked well?

458. What happens if you cannot produce the documentation for the single audit?

459. Why do you manage cost?

460. Can you change your activities?

461. Is there anything unique in this Static Code Analysis projects scope statement that will affect resources?

462. In which phase of the acquisition process cycle does source qualifications reside?

463. If you are asked to lower your estimate because the price is too high, what are your options?

464. Will you need to provide essential services information about activities?

465. What communication items need improvement?

466. Can you delete activities or make them inactive?

467. How quickly can the task be done with the skills available?

468. What makes a good activity description?

469. How do you manage cost?

2.22 Cost Estimating Worksheet: Static Code Analysis

470. What can be included?

471. What additional Static Code Analysis project(s) could be initiated as a result of this Static Code Analysis project?

472. How will the results be shared and to whom?

473. Will the Static Code Analysis project collaborate with the local community and leverage resources?

474. Value pocket identification & quantification what are value pockets?

475. What happens to any remaining funds not used?

476. What costs are to be estimated?

477. Ask: are others positioned to know, are others credible, and will others cooperate?

478. What is the estimated labor cost today based upon this information?

479. Identify the timeframe necessary to monitor progress and collect data to determine how the selected measure has changed?

480. Is it feasible to establish a control group arrangement?

481. Who is best positioned to know and assist in identifying corresponding factors?

482. What will others want?

483. What is the purpose of estimating?

484. Does the Static Code Analysis project provide innovative ways for stakeholders to overcome obstacles or deliver better outcomes?

485. Can a trend be established from historical performance data on the selected measure and are the criteria for using trend analysis or forecasting methods met?

486. Is the Static Code Analysis project responsive to community need?

2.23 Cost Baseline: Static Code Analysis

487. Is request in line with priorities?

488. On budget?

489. Has the Static Code Analysis project (or Static Code Analysis project phase) been evaluated against each objective established in the product description and Integrated Static Code Analysis project Plan?

490. What is cost and Static Code Analysis project cost management?

491. Have the resources used by the Static Code Analysis project been reassigned to other units or Static Code Analysis projects?

492. For what purpose ?

493. Escalation criteria met?

494. What deliverables come first?

495. What is the reality?

496. Review your risk triggers -have your risks changed?

497. Are you meeting with your team regularly?

498. Are there contingencies or conditions related to the acceptance?

499. When should cost estimates be developed?

500. At which frequency ?

501. Have the actual milestone completion dates been compared to the approved schedule?

502. Have all approved changes to the schedule baseline been identified and impact on the Static Code Analysis project documented?

503. Have all approved changes to the Static Code Analysis project requirement been identified and impact on the performance, cost, and schedule baselines documented?

2.24 Quality Management Plan: Static Code Analysis

504. What data do you gather/use/compile?

505. Meet how often?

506. How do you ensure that your sampling methods and procedures meet your data quality objectives?

507. How is staff informed of proper reporting methods?

508. Is this a Requirement?

509. Results Available?

510. How does your organization make it easy for customers to seek assistance or complain?

511. What are your results for key measures/indicators of accomplishment of organizational strategy?

512. What are the appropriate test methods to be used?

513. Do you keep back-up copies of any data?

514. Contradictory information between document sections?

515. Does the program conduct field testing?

516. What is positive about the current process?

517. Has a Static Code Analysis project Communications Plan been developed?

518. What type of in-house testing do you conduct?

519. Are there standards for code development?

520. What is the Difference Between a QMP and QAPP?

521. Are requirements management tracking tools and procedures in place?

522. Account for the procedures used to verify the data quality of the data being reviewed?

523. What worked well?

2.25 Quality Metrics: Static Code Analysis

524. What approved evidence based screening tools can be used?

525. Has risk analysis been adequately reviewed?

526. What is the benchmark?

527. Where is quality now?

528. Are applicable standards referenced and available?

529. What metrics do you measure?

530. Was material distributed on time?

531. What can manufacturing professionals do to ensure quality is seen as an integral part of the entire product lifecycle?

532. Are there already quality metrics available that detect nonlinear embeddings and trends similar to the users perception?

533. When will the Final Guidance will be issued?

534. Product Availability ?

535. What are you trying to accomplish?

536. Was the overall quality better or worse than previous products?

537. Have alternatives been defined in the event that failure occurs?

538. Where did complaints, returns and warranty claims come from?

539. Which are the right metrics to use?

540. Is quality culture a competitive advantage?

541. Are quality metrics defined?

542. Do you stratify metrics by product or site?

543. What is the timeline to meet your goal?

2.26 Process Improvement Plan: Static Code Analysis

544. Have the supporting tools been developed or acquired?

545. What personnel are the coaches for your initiative?

546. Have the frequency of collection and the points in the process where measurements will be made been determined?

547. Has the time line required to move measurement results from the points of collection to databases or users been established?

548. Are there forms and procedures to collect and record the data?

549. What lessons have you learned so far?

550. Modeling current processes is great, and will you ever see a return on that investment?

551. Are you meeting the quality standards?

552. The motive is determined by asking, Why do you want to achieve this goal?

553. Are you making progress on your improvement plan?

554. To elicit goal statements, do you ask a question such as, What do you want to achieve?

555. Are you following the quality standards?

556. Purpose of goal: the motive is determined by asking, why do you want to achieve this goal?

557. Where do you want to be?

558. Has a process guide to collect the data been developed?

559. How do you measure?

560. Where are you now?

561. Where do you focus?

562. What personnel are the sponsors for that initiative?

2.27 Responsibility Assignment Matrix: Static Code Analysis

563. Is accountability placed at the lowest-possible level within the Static Code Analysis project so that decisions can be made at that level?

564. How do you manage remotely to staff in other Divisions?

565. Are the bases and rates for allocating costs from each indirect pool consistently applied?

566. Do you know how your people are allocated?

567. Are indirect costs charged to the appropriate indirect pools and incurring organization?

568. Are people afraid to let you know when others are under allocated?

569. Are management actions taken to reduce indirect costs when there are significant adverse variances?

570. Direct labor dollars and/or hours?

571. Does a missing responsibility indicate that the current Static Code Analysis project is not yet fully understood?

572. Budgets assigned to major functional organizations?

573. Is work properly classified as measured effort, LOE, or apportioned effort and appropriately separated?

574. Are others working on the right things?

575. What expertise is not available in your department?

576. Are overhead cost budgets established for each organization which has authority to incur overhead costs?

577. What do you need to implement earned value management?

578. Do managers and team members provide helpful suggestions during review meetings?

579. Are detailed work packages planned as far in advance as practicable?

580. If a role has only Signing-off, or only Communicating responsibility and has no Performing, Accountable, or Monitoring responsibility, is it necessary?

581. What are the deliverables?

2.28 Roles and Responsibilities: Static Code Analysis

582. Once the responsibilities are defined for the Static Code Analysis project, have the deliverables, roles and responsibilities been clearly communicated to every participant?

583. What should you highlight for improvement?

584. What is working well?

585. What areas of supervision are challenging for you?

586. Who: who is involved?

587. What expectations were NOT met?

588. Key conclusions and recommendations: Are conclusions and recommendations relevant and acceptable?

589. Required skills, knowledge, experience?

590. What specific behaviors did you observe?

591. Are governance roles and responsibilities documented?

592. Influence: what areas of organizational decision making are you able to influence when you do not have authority to make the final decision?

593. Be specific; avoid generalities. Thank you and great work alone are insufficient. What exactly do you appreciate and why?

594. What areas would you highlight for changes or improvements?

595. Have you ever been a part of this team?

596. Are your budgets supportive of a culture of quality data?

597. Attainable / achievable: the goal is attainable; can you actually accomplish the goal?

598. What should you do now to ensure that you are exceeding expectations and excelling in your current position?

599. What expectations were met?

600. Is feedback clearly communicated and non-judgmental?

2.29 Human Resource Management Plan: Static Code Analysis

601. Is it possible to track all classes of Static Code Analysis project work (e.g. scheduled, un-scheduled, defect repair, etc.)?

602. Are quality inspections and review activities listed in the Static Code Analysis project schedule(s)?

603. Is Static Code Analysis project work proceeding in accordance with the original Static Code Analysis project schedule?

604. Have activity relationships and interdependencies within tasks been adequately identified?

605. Are the schedule estimates reasonable given the Static Code Analysis project?

606. Has the business need been clearly defined?

607. What were things that you need to improve?

608. Are milestone deliverables effectively tracked and compared to Static Code Analysis project plan?

609. Are all key components of a Quality Assurance Plan present?

610. Has a quality assurance plan been developed for the Static Code Analysis project?

611. Are enough systems & user personnel assigned to the Static Code Analysis project?

612. Have adequate resources been provided by management to ensure Static Code Analysis project success?

613. What areas were overlooked on this Static Code Analysis project?

614. Are the results of quality assurance reviews provided to affected groups & individuals?

615. Identify who is needed on the core Static Code Analysis project team to complete Static Code Analysis project deliverables and achieve its goals and objectives. What skills, knowledge and experiences are required?

616. Are the right people being attracted and retained to meet the future challenges?

617. What commitments have been made?

618. Who is evaluated?

2.30 Communications Management Plan: Static Code Analysis

619. What is the stakeholders level of authority?

620. Conflict resolution -which method when?

621. Who are the members of the governing body?

622. Who is involved as you identify stakeholders?

623. Who did you turn to if you had questions?

624. What communications method?

625. How will the person responsible for executing the communication item be notified?

626. In your work, how much time is spent on stakeholder identification?

627. Are there common objectives between the team and the stakeholder?

628. Which team member will work with each stakeholder?

629. What are the interrelationships?

630. Timing: when do the effects of the communication take place?

631. What steps can you take for a positive relationship?

632. Which stakeholders can influence others?

633. Are there potential barriers between the team and the stakeholder?

634. Do you ask; can you recommend others for you to talk with about this initiative?

635. Are the stakeholders getting the information others need, are others consulted, are concerns addressed?

636. Where do team members get information?

637. How do you manage communications?

638. Who needs to know and how much?

2.31 Risk Management Plan: Static Code Analysis

639. Risks should be identified during which phase of Static Code Analysis project management life cycle?

640. How can the process be made more effective or less cumbersome (process improvements)?

641. For software; does the software interface with new or unproven hardware or unproven vendor products?

642. Have you worked with the customer in the past?

643. Does the Static Code Analysis project have the authority and ability to avoid the risk?

644. How are risk analvsis and prioritization performed?

645. Are testing tools available and suitable?

646. Market risk -will the new service or product be useful to your organization or marketable to others?

647. Does the Static Code Analysis project team have experience with the technology to be implemented?

648. Is security a central objective?

649. Are you on schedule?

650. What are the chances the risk event will occur?

651. How is the audit profession changing?

652. People risk -are people with appropriate skills available to help complete the Static Code Analysis project?

653. Do benefits and chances of success outweigh potential damage if success is not attained?

654. Are you working on the right risks?

655. What will the damage be?

656. How much risk protection can you afford?

657. What are some questions that should be addressed in a risk management plan?

658. Risk categories: what are the main categories of risks that should be addressed on this Static Code Analysis project?

2.32 Risk Register: Static Code Analysis

659. Preventative actions - planned actions to reduce the likelihood a risk will occur and/or reduce the seriousness should it occur. What should you do now?

660. Schedule impact/severity estimated range (workdays) assume the event happens, what is the potential impact?

661. Assume the risk event or situation happens, what would the impact be?

662. How are risks identified?

663. What may happen or not go according to plan?

664. Methodology: how will risk management be performed on this Static Code Analysis project?

665. Which key risks have ineffective responses or outstanding improvement actions?

666. What is your current and future risk profile?

667. What is a Risk?

668. Budget and schedule: what are the estimated costs and schedules for performing risk-related activities?

669. What will be done?

670. When would you develop a risk register?

671. What should you do now?

672. Who is accountable?

673. Have other controls and solutions been implemented in other services which could be applied as an alternative to additional funding?

674. What would the impact to the Static Code Analysis project objectives be should the risk arise?

675. Do you require further engagement?

676. Is further information required before making a decision?

677. Who needs to know about this?

2.33 Probability and Impact Assessment: Static Code Analysis

678. Which of corresponding risk factors can be avoided altogether?

679. What risks are necessary to achieve success?

680. Have decisions that should be left open because of inadequate information on technology been identified and responsibility assigned for reducing the uncertainty?

681. Who should be responsible for the monitoring and tracking of the indicators youhave identified?

682. How is the risk management process used in practice?

683. Would avoiding any of corresponding impact the Static Code Analysis projects chance of success?

684. Risks should be identified during which phase of Static Code Analysis project management life cycle?

685. Who will be responsible for a slippage?

686. What can you do about it?

687. How will economic events and trends likely affect the Static Code Analysis project?

688. Can it be enlarged by drawing people from other areas of your organization?

689. Mitigation -how can you avoid the risk?

690. Are tool mentors available?

691. Are team members trained in the use of the tools?

692. Is a software Static Code Analysis project management tool available?

693. Do you use any methods to analyze risks?

694. How risk averse are you?

695. Will new information become available during the Static Code Analysis project?

696. Are the risk data timely and relevant?

697. What are the tools and techniques used in managing the challenges faced?

2.34 Probability and Impact Matrix: Static Code Analysis

698. Do you need a risk management plan?

699. What changes in the regulation are forthcoming?

700. Can you handle the investment risk?

701. What will be cost of redeployment of the personnel?

702. Number of users of the product?

703. How solid is the Static Code Analysis projection of competitive reaction?

704. What are the current demands of the customer?

705. Are formal technical reviews part of this process?

706. Brain storm – mind maps, what if?

707. Workarounds are determined during which step of risk management?

708. Do you have specific methods that you use for each phase of the process?

709. What is the industrial relations prevailing in this organization?

710. During Static Code Analysis project executing, a major problem occurs that was not included in the risk register. What should you do FIRST?

711. How do you analyze the risks in the different types of Static Code Analysis projects?

712. Which is the BEST thing to do?

713. Prioritized components/features?

714. Who should be notified of the occurrence of each of the risk indicators?

715. Why do you need to manage Static Code Analysis project Risk?

716. Is the Static Code Analysis project cutting across the entire organization?

2.35 Risk Data Sheet: Static Code Analysis

717. What are you trying to achieve (Objectives)?

718. Risk of what?

719. What are you weak at and therefore need to do better?

720. What can happen?

721. What if client refuses?

722. How do you handle product safely?

723. What is the likelihood of it happening?

724. What do people affected think about the need for, and practicality of preventive measures?

725. Has the most cost-effective solution been chosen?

726. Are new hazards created?

727. What is the environment within which you operate (social trends, economic, community values, broad based participation, national directions etc.)?

728. What were the Causes that contributed?

729. What will be the consequences if the risk happens?

730. Whom do you serve (customers)?

731. Potential for recurrence?

732. What is the chance that it will happen?

733. What are your core values?

734. Has a sensitivity analysis been carried out?

735. What are you here for (Mission)?

736. What are the main threats to your existence?

2.36 Procurement Management Plan: Static Code Analysis

737. Have process improvement efforts been completed before requirements efforts begin?

738. Have all documents been archived in a Static Code Analysis project repository for each release?

739. Is it standard practice to formally commit stakeholders to the Static Code Analysis project via agreements?

740. Are Static Code Analysis project contact logs kept up to date?

741. Have the key elements of a coherent Static Code Analysis project management strategy been established?

742. Is the communication plan being followed?

743. Are procurement deliverables arriving on time and to specification?

744. What types of contracts will be used?

745. Does the Static Code Analysis project have a Quality Culture?

746. Does a documented Static Code Analysis project organizational policy & plan (i.e. governance model) exist?

747. Has a provision been made to reassess Static Code Analysis project risks at various Static Code Analysis project stages?

748. Has the Static Code Analysis project manager been identified?

749. Is there a set of procedures defining the scope, procedures, and deliverables defining quality control?

750. Are there checklists created to determine if all quality processes are followed?

751. If standardized procurement documents are needed, where can others be found?

2.37 Source Selection Criteria: Static Code Analysis

752. What information may not be provided?

753. Is this a cost contract?

754. Are responses to considerations adequate?

755. How should oral presentations be evaluated?

756. What documentation should be used to support the selection decision?

757. What aspects should the contracting officer brief the Static Code Analysis project on prior to evaluation of proposals?

758. What documentation is needed for a tradeoff decision?

759. What are open book debriefings?

760. What is price analysis and when should it be performed?

761. How will you decide an evaluators write up is sufficient?

762. What management structure does your organization consider as optimal for performing the contract?

763. Which contract type places the most risk on the seller?

764. Can you identify proposed teaming partners and/or subcontractors and consider the nature and extent of proposed involvement in satisfying the Static Code Analysis project requirements?

765. What is the basis of an estimate and what assumptions were made?

766. When is it appropriate to issue a DRFP?

767. Can you reasonably estimate total organization requirements for the coming year?

768. What are the steps in performing a cost/tech tradeoff?

769. Comparison of each offers prices to the estimated prices -are there significant differences?

770. When must you conduct a debriefing?

771. What instructions should be provided regarding oral presentations?

2.38 Stakeholder Management Plan: Static Code Analysis

772. Are written status reports provided on a designated frequent basis?

773. Are multiple estimation methods being employed?

774. Are the quality tools and methods identified in the Quality Plan appropriate to the Static Code Analysis project?

775. Are enough systems & user personnel assigned to the Static Code Analysis project?

776. Why would you develop a Static Code Analysis project Business Plan?

777. Have Static Code Analysis project management standards and procedures been established and documented?

778. Are adequate resources provided for the quality assurance function?

779. Was trending evident between reviews?

780. Will all relevant stakeholders be included within the review process?

781. Are Static Code Analysis project team members involved in detailed estimating and scheduling?

782. Were Static Code Analysis project team members involved in detailed estimating and scheduling?

783. Is the performance of the supplier to be rated and documented?

784. Which impacts could serve as impediments?

785. Are staff skills known and available for each task?

786. Have all necessary approvals been obtained?

787. Will Static Code Analysis project success require up to date information at a moments notice?

788. Are trade-offs between accepting the risk and mitigating the risk identified?

789. Have all involved Static Code Analysis project stakeholders and work groups committed to the Static Code Analysis project?

790. Have Static Code Analysis project team accountabilities & responsibilities been clearly defined?

2.39 Change Management Plan: Static Code Analysis

791. What are the needs, priorities and special interests of the audience?

792. What risks may occur upfront?

793. Who in the business it includes?

794. Does this change represent a completely new process for your organization, or a different application of an existing process?

795. What new behaviours are required?

796. How do you know the requirements you documented are the right ones?

797. Who will do the training?

798. What type of materials/channels will be available to leverage?

799. What tasks are needed?

800. What are the specific target groups / audience that will be impacted by this change?

801. Has this been negotiated with the customer and sponsor?

802. Will the culture embrace or reject this change?

803. What provokes organizational change?

804. What new competencies will be required for the roles?

805. Who is responsible for which tasks?

806. Has the target training audience been identified and nominated?

807. Has the relevant business unit been notified of installation and support requirements?

808. How will the stakeholders share information and transfer knowledge?

809. Will the readiness criteria be met prior to the training roll out?

810. Has the training provider been established?

3.0 Executing Process Group: Static Code Analysis

811. After how many days will the lease cost be the same as the purchase cost for the equipment?

812. How does a Static Code Analysis project life cycle differ from a product life cycle?

813. What are the main parts of the scope statement?

814. Just how important is your work to the overall success of the Static Code Analysis project?

815. Is the Static Code Analysis project performing better or worse than planned?

816. What Static Code Analysis projects and services are in the portfolio of your organization?

817. Are decisions made in a timely manner?

818. Do your results resemble a normal distribution?

819. Does the Static Code Analysis project team have enough people to execute the Static Code Analysis project plan?

820. What factors are contributing to progress or delay in the achievement of products and results?

821. Are escalated issues resolved promptly?

822. What are the critical steps involved in selecting measures and initiatives?

823. What is the difference between using brainstorming and the Delphi technique for risk identification?

824. What are the key components of the Static Code Analysis project communications plan?

825. When is the appropriate time to bring the scorecard to Board meetings?

826. How do you control progress of your Static Code Analysis project?

827. Contingency planning. if a risk event occurs, what will you do?

828. Specific - is the objective clear in terms of what, how, when, and where the situation will be changed?

829. Are the necessary foundations in place to ensure the sustainability of the results of the programme?

830. When do you share the scorecard with managers?

3.1 Team Member Status Report: Static Code Analysis

831. What is to be done?

832. Are your organizations Static Code Analysis projects more successful over time?

833. Does your organization have the means (staff, money, contract, etc.) to produce or to acquire the product, good, or service?

834. The problem with Reward & Recognition Programs is that the truly deserving people all too often get left out. How can you make it practical?

835. Why is it to be done?

836. Does the product, good, or service already exist within your organization?

837. How can you make it practical?

838. Will the staff do training or is that done by a third party?

839. How much risk is involved?

840. When a teams productivity and success depend on collaboration and the efficient flow of information, what generally fails them?

841. Do you have an Enterprise Static Code Analysis project Management Office (EPMO)?

842. Does every department have to have a Static Code Analysis project Manager on staff?

843. How will resource planning be done?

844. Are the attitudes of staff regarding Static Code Analysis project work improving?

845. Are the products of your organizations Static Code Analysis projects meeting customers objectives?

846. Is there evidence that staff is taking a more professional approach toward management of your organizations Static Code Analysis projects?

847. How does this product, good, or service meet the needs of the Static Code Analysis project and your organization as a whole?

848. How it is to be done?

849. What specific interest groups do you have in place?

3.2 Change Request: Static Code Analysis

850. Who is responsible for the implementation and monitoring of all measures?

851. Has the change been highlighted and documented in the CSCI?

852. How is the change documented (format, content, storage)?

853. Are there requirements attributes that are strongly related to the complexity and size?

854. How are the measures for carrying out the change established?

855. What kind of information about the change request needs to be captured?

856. How does a team identify the discrete elements of a configuration?

857. Is it feasible to use requirements attributes as predictors of reliability?

858. What are the duties of the change control team?

859. What are the requirements for urgent changes?

860. Should a more thorough impact analysis be conducted?

861. Where do changes come from?

862. Why do you want to have a change control system?

863. What is the purpose of change control?

864. What is the function of the change control committee?

865. Describe how modifications, enhancements, defects and/or deficiencies shall be notified (e.g. Problem Reports, Change Requests etc) and managed. Detail warranty and/or maintenance periods?

866. Will this change conflict with other requirements changes (e.g., lead to conflicting operational scenarios)?

867. When do you create a change request?

868. Who needs to approve change requests?

869. For which areas does this operating procedure apply?

3.3 Change Log: Static Code Analysis

870. How does this relate to the standards developed for specific business processes?

871. Do the described changes impact on the integrity or security of the system?

872. When was the request submitted?

873. Is the change backward compatible without limitations?

874. Will the Static Code Analysis project fail if the change request is not executed?

875. Is the change request within Static Code Analysis project scope?

876. Is the change request open, closed or pending?

877. Who initiated the change request?

878. Does the suggested change request seem to represent a necessary enhancement to the product?

879. Is the requested change request a result of changes in other Static Code Analysis project(s)?

880. How does this change affect scope?

881. Is this a mandatory replacement?

882. When was the request approved?

883. Does the suggested change request represent a desired enhancement to the products functionality?

884. Is the submitted change a new change or a modification of a previously approved change?

885. How does this change affect the timeline of the schedule?

3.4 Decision Log: Static Code Analysis

886. Who is the decisionmaker?

887. How does an increasing emphasis on cost containment influence the strategies and tactics used?

888. How effective is maintaining the log at facilitating organizational learning?

889. Is your opponent open to a non-traditional workflow, or will it likely challenge anything you do?

890. How consolidated and comprehensive a story can you tell by capturing currently available incident data in a central location and through a log of key decisions during an incident?

891. It becomes critical to track and periodically revisit both operational effectiveness; Are you noticing all that you need to, and are you interpreting what you see effectively?

892. How do you define success?

893. What is the average size of your matters in an applicable measurement?

894. Decision-making process; how will the team make decisions?

895. What eDiscovery problem or issue did your organization set out to fix or make better?

896. What are the cost implications?

897. How does the use a Decision Support System influence the strategies/tactics or costs?

898. How do you know when you are achieving it?

899. What is the line where eDiscovery ends and document review begins?

900. Do strategies and tactics aimed at less than full control reduce the costs of management or simply shift the cost burden?

901. At what point in time does loss become unacceptable?

902. What alternatives/risks were considered?

903. Who will be given a copy of this document and where will it be kept?

904. Adversarial environment. is your opponent open to a non-traditional workflow, or will it likely challenge anything you do?

905. Meeting purpose; why does this team meet?

3.5 Quality Audit: Static Code Analysis

906. What does an analysis of your organizations staff profile suggest in terms of its planning, and how is this being addressed?

907. How does your organization know that its staff embody the core knowledge, skills and characteristics for which it wishes to be recognized?

908. How does your organization know that its range of activities are being reviewed as rigorously and constructively as they could be?

909. How does your organization know that it is appropriately effective and constructive in preparing its staff for organizational aspirations?

910. How does your organization know that its staff have appropriate access to a fair and effective grievance process?

911. How does your organization know that its system for governing staff behaviour is appropriately effective and constructive?

912. How does your organization know that its system for recruiting the best staff possible are appropriately effective and constructive?

913. Quality is about improvement and accountability. The immediate questions that arise out of that statement are: (i) improvement on what, and (ii) accountable to whom?

914. How does your organization know that its systems for assisting staff with career planning and employment placements are appropriately effective and constructive?

915. Are all employees made aware of device defects which may occur from the improper performance of specific jobs?

916. How does your organization know that its research planning and management systems are appropriately effective and constructive in enabling quality research outcomes?

917. How does your organization know that its Mission, Vision and Values Statements are appropriate and effectively guiding your organization?

918. Does the supplier use a formal quality system?

919. How does your organization know that its general support services planning and management systems are appropriately effective and constructive?

920. How do you indicate the extent to which your personnel would be expected to contribute to the work effort?

921. How does your organization know that the support for its staff is appropriately effective and constructive?

922. What will the Observer get to Observe?

923. Does everyone know what they are supposed to be doing, how and why?

924. How does your organization know that its public relations and marketing systems are appropriately effective and constructive?

925. What experience do staff have in the type of work that the audit entails?

3.6 Team Directory: Static Code Analysis

926. Who are your stakeholders (customers, sponsors, end users, team members)?

927. Timing: when do the effects of communication take place?

928. Process decisions: how well was task order work performed?

929. What are you going to deliver or accomplish?

930. How will the team handle changes?

931. Process decisions: are all start-up, turn over and close out requirements of the contract satisfied?

932. How does the team resolve conflicts and ensure tasks are completed?

933. Decisions: what could be done better to improve the quality of the constructed product?

934. Process decisions: which organizational elements and which individuals will be assigned management functions?

935. Process decisions: is work progressing on schedule and per contract requirements?

936. Who are the Team Members?

937. Is construction on schedule?

938. How will you accomplish and manage the objectives?

939. What needs to be communicated?

940. Who will write the meeting minutes and distribute?

941. Does a Static Code Analysis project team directory list all resources assigned to the Static Code Analysis project?

942. Process decisions: are there any statutory or regulatory issues relevant to the timely execution of work?

943. Do purchase specifications and configurations match requirements?

3.7 Team Operating Agreement: Static Code Analysis

944. Are there more than two functional areas represented by your team?

945. Seconds for members to respond?

946. Do team members need to frequently communicate as a full group to make timely decisions?

947. Do you determine the meeting length and time of day?

948. What is your unique contribution to your organization?

949. Have you established procedures that team members can follow to work effectively together, such as a team operating agreement?

950. Do you post meeting notes and the recording (if used) and notify participants?

951. Did you delegate tasks such as taking meeting minutes, presenting a topic and soliciting input?

952. Do you send out the agenda and meeting materials in advance?

953. To whom do you deliver your services?

954. What administrative supports will be put in place to support the team and the teams supervisor?

955. What are the safety issues/risks that need to be addressed and/or that the team needs to consider?

956. Resource allocation: how will individual team members account for time and expenses, and how will this be allocated in the team budget?

957. Did you recap the meeting purpose, time, and expectations?

958. What resources can be provided for the team in terms of equipment, space, time for training, protected time and space for meetings, and travel allowances?

959. Did you prepare participants for the next meeting?

960. Did you determine the technology methods that best match the messages to be communicated?

961. Do you use a parking lot for any items that are important and outside of the agenda?

962. Communication protocols: how will the team communicate?

963. Are there differences in access to communication and collaboration technology based on team member location?

3.8 Team Performance Assessment: Static Code Analysis

964. To what degree are fresh input and perspectives systematically caught and added (for example, through information and analysis, new members, and senior sponsors)?

965. How do you keep key people outside the group informed about its accomplishments?

966. To what degree does the teams work approach provide opportunity for members to engage in open interaction?

967. How do you manage human resources?

968. To what degree do all members feel responsible for all agreed-upon measures?

969. To what degree can team members vigorously define the teams purpose in considerations with others who are not part of the functioning team?

970. To what degree will the team adopt a concrete, clearly understood, and agreed-upon approach that will result in achievement of the teams goals?

971. What structural changes have you made or are you preparing to make?

972. To what degree do team members frequently explore the teams purpose and its implications?

973. Can team performance be reliably measured in simulator and live exercises using the same assessment tool?

974. Individual task proficiency and team process behavior: what is important for team functioning?

975. To what degree do team members agree with the goals, relative importance, and the ways in which achievement will be measured?

976. To what degree are the members clear on what they are individually responsible for and what they are jointly responsible for?

977. To what degree do team members articulate the teams work approach?

978. What do you think is the most constructive thing that could be done now to resolve considerations and disputes about method variance?

979. To what degree will new and supplemental skills be introduced as the need is recognized?

980. To what degree are the relative importance and priority of the goals clear to all team members?

981. To what degree do the goals specify concrete team work products?

982. To what degree are corresponding categories of skills either actually or potentially represented across the membership?

983. To what degree does the teams purpose constitute a broader, deeper aspiration than just accomplishing short-term goals?

3.9 Team Member Performance Assessment: Static Code Analysis

984. What are the staffs preferences for training on technology-based platforms?

985. Are any validation activities performed?

986. What are the standards or expectations for success?

987. What is the Business Management Oversight Process?

988. How are evaluation results utilized?

989. Is there reluctance to join a team?

990. For what period of time is a member rated?

991. To what degree does the team possess adequate membership to achieve its ends?

992. Who should attend?

993. How do you work together to improve teaching and learning?

994. Who they are?

995. What happens if a team member disagrees with the Job Expectations?

996. How effective is training that is delivered through technology-based platforms?

997. Why were corresponding selected?

998. What are acceptable governance changes?

999. How do you currently use the time that is available?

1000. To what degree is the team cognizant of small wins to be celebrated along the way?

1001. To what degree does the teams purpose contain themes that are particularly meaningful and memorable?

3.10 Issue Log: Static Code Analysis

1002. What does the stakeholder need from the team?

1003. Is the issue log kept in a safe place?

1004. Are they needed?

1005. Why multiple evaluators?

1006. Do you prepare stakeholder engagement plans?

1007. Are you constantly rushing from meeting to meeting?

1008. Who reported the issue?

1009. Do you have members of your team responsible for certain stakeholders?

1010. Persistence; will users learn a work around or will they be bothered every time?

1011. Why do you manage human resources?

1012. Is access to the Issue Log controlled?

1013. How is this initiative related to other portfolios, programs, or Static Code Analysis projects?

1014. How were past initiatives successful?

1015. What approaches to you feel are the best ones to use?

4.0 Monitoring and Controlling Process Group: Static Code Analysis

1016. How is agile program management done?

1017. How well defined and documented were the Static Code Analysis project management processes you chose to use?

1018. What are the goals of the program?

1019. What areas were overlooked on this Static Code Analysis project?

1020. What is the expected monetary value of the Static Code Analysis project?

1021. What do they need to know about the Static Code Analysis project?

1022. Do the partners have sufficient financial capacity to keep up the benefits produced by the programme?

1023. Accuracy: what design will lead to accurate information?

1024. Just how important is your work to the overall success of the Static Code Analysis project?

1025. Who needs to be engaged upfront to ensure use of results?

1026. What good practices or successful experiences or transferable examples have been identified?

1027. Propriety: who needs to be involved in the evaluation to be ethical?

1028. How well did the chosen processes produce the expected results?

1029. Feasibility: how much money, time, and effort can you put into this?

1030. Were escalated issues resolved promptly?

1031. How to ensure validity, quality and consistency?

1032. Change, where should you look for problems?

4.1 Project Performance Report: Static Code Analysis

1033. What is the degree to which rules govern information exchange between individuals within your organization?

1034. To what degree does the informal organization make use of individual resources and meet individual needs?

1035. To what degree can team members meet frequently enough to accomplish the teams ends?

1036. To what degree are the skill areas critical to team performance present?

1037. To what degree will the approach capitalize on and enhance the skills of all team members in a manner that takes into consideration other demands on members of the team?

1038. To what degree does the teams approach to its work allow for modification and improvement over time?

1039. To what degree are the goals realistic?

1040. To what degree can all members engage in open and interactive considerations?

1041. To what degree does the funding match the requirement?

1042. To what degree will team members, individually and collectively, commit time to help themselves and others learn and develop skills?

1043. Next Steps?

1044. To what degree do the structures of the formal organization motivate taskrelevant behavior and facilitate task completion?

1045. To what degree can team members frequently and easily communicate with one another?

1046. To what degree do members articulate the goals beyond the team membership?

4.2 Variance Analysis: Static Code Analysis

1047. What is the actual cost of work performed?

1048. How are material, labor, and overhead standards set?

1049. How are variances affected by multiple material and labor categories?

1050. What is the expected future profitability of each customer?

1051. Is budgeted cost for work performed calculated in a manner consistent with the way work is planned?

1052. Are all cwbs elements specified for external reporting?

1053. Are the wbs and organizational levels for application of the Static Code Analysis projected overhead costs identified?

1054. What is your organizations rationale for sharing expenses and services between business segments?

1055. Do the rates and prices remain constant throughout the year?

1056. Are procedures for variance analysis documented and consistently applied at the control account level and selected WBS and organizational levels at least monthly as a routine task?

1057. Are overhead costs budgets established on a basis consistent with the anticipated direct business base?

1058. What types of services and expense are shared between business segments?

1059. Why do variances exist?

1060. Favorable or unfavorable variance?

1061. Are there quarterly budgets with quarterly performance comparisons?

1062. Does the scheduling system identify in a timely manner the status of work?

1063. Does the accounting system provide a basis for auditing records of direct costs chargeable to the contract?

1064. Contemplated overhead expenditure for each period based on the best information currently is available?

1065. Are there changes in the direct base to which overhead costs are allocated?

1066. Is the anticipated (firm and potential) business base Static Code Analysis projected in a rational, consistent manner?

4.3 Earned Value Status: Static Code Analysis

1067. Earned value can be used in almost any Static Code Analysis project situation and in almost any Static Code Analysis project environment. it may be used on large Static Code Analysis projects, medium sized Static Code Analysis projects, tiny Static Code Analysis projects (in cut-down form), complex and simple Static Code Analysis projects and in any market sector. some people, of course, know all about earned value, they have used it for years - but perhaps not as effectively as they could have?

1068. How does this compare with other Static Code Analysis projects?

1069. Where are your problem areas?

1070. What is the unit of forecast value?

1071. If earned value management (EVM) is so good in determining the true status of a Static Code Analysis project and Static Code Analysis project its completion, why is it that hardly any one uses it in information systems related Static Code Analysis projects?

1072. When is it going to finish?

1073. Where is evidence-based earned value in your organization reported?

1074. Validation is a process of ensuring that the developed system will actually achieve the stakeholders desired outcomes; Are you building the right product? What do you validate?

1075. Verification is a process of ensuring that the developed system satisfies the stakeholders agreements and specifications; Are you building the product right? What do you verify?

1076. Are you hitting your Static Code Analysis projects targets?

1077. How much is it going to cost by the finish?

4.4 Risk Audit: Static Code Analysis

1078. Improving fraud detection: do auditors react to abnormal inconsistencies between financial and non-financial measures?

1079. Are risk assessments documented?

1080. Have permissions or required permits to use facilities managed by other parties been obtained?

1081. Is safety information provided to all involved?

1082. Are the best people available?

1083. What does internal control mean in the context of the audit process?

1084. When your organization is entering into a major contract, does it seek legal advice?

1085. Can analytical tests provide evidence that is as strong as evidence from traditional substantive tests?

1086. Does the implementation method matter?

1087. Does the customer have a solid idea of what is required?

1088. Strategic business risk audit methodologies; are corresponding an attempt to sell other services, and is management becoming the client of the audit rather than the shareholder?

1089. What is the effect of globalisation; is business becoming too complex and can the auditor rely on auditing standards?

1090. Do you manage the process through use of metrics?

1091. What are the strategic implications with clients when auditors focus audit resources based on business-level risks?

1092. Are all participants informed of safety issues?

1093. Risks with Static Code Analysis projects or new initiatives?

1094. How effective are your risk controls?

1095. Auditor independence: a burdensome constraint or a core value?

1096. Is a software Static Code Analysis project management tool available?

4.5 Contractor Status Report: Static Code Analysis

1097. If applicable; describe your standard schedule for new software version releases. Are new software version releases included in the standard maintenance plan?

1098. What is the average response time for answering a support call?

1099. How does the proposed individual meet each requirement?

1100. What was the budget or estimated cost for your organizations services?

1101. What process manages the contracts?

1102. Are there contractual transfer concerns?

1103. How long have you been using the services?

1104. What are the minimum and optimal bandwidth requirements for the proposed solution?

1105. Who can list a Static Code Analysis project as organization experience, your organization or a previous employee of your organization?

1106. How is risk transferred?

1107. What was the actual budget or estimated cost for your organizations services?

1108. What was the final actual cost?

1109. Describe how often regular updates are made to the proposed solution. Are corresponding regular updates included in the standard maintenance plan?

1110. What was the overall budget or estimated cost?

4.6 Formal Acceptance: Static Code Analysis

1111. Was business value realized?

1112. Who would use it?

1113. Was the client satisfied with the Static Code Analysis project results?

1114. Does it do what Static Code Analysis project team said it would?

1115. What was done right?

1116. What are the requirements against which to test, Who will execute?

1117. What can you do better next time?

1118. What function(s) does it fill or meet?

1119. What is the Acceptance Management Process?

1120. Is formal acceptance of the Static Code Analysis project product documented and distributed?

1121. Have all comments been addressed?

1122. Was the Static Code Analysis project managed well?

1123. Does it do what client said it would?

1124. General estimate of the costs and times to complete the Static Code Analysis project?

1125. Was the Static Code Analysis project goal achieved?

1126. Do you perform formal acceptance or burn-in tests?

1127. Did the Static Code Analysis project achieve its MOV?

1128. Did the Static Code Analysis project manager and team act in a professional and ethical manner?

1129. Was the sponsor/customer satisfied?

1130. How well did the team follow the methodology?

5.0 Closing Process Group: Static Code Analysis

1131. How will you do it?

1132. Is there a clear cause and effect between the activity and the lesson learned?

1133. What could have been improved?

1134. How well defined and documented were the Static Code Analysis project management processes you chose to use?

1135. If action is called for, what form should it take?

1136. Did you do things well?

1137. Does the close educate others to improve performance?

1138. What will you do?

1139. What can you do better next time, and what specific actions can you take to improve?

1140. What were the actual outcomes?

1141. What do you need to do?

1142. Were the outcomes different from the already stated planned?

1143. Did the Static Code Analysis project management methodology work?

1144. What is the Static Code Analysis project name and date of completion?

1145. Were cost budgets met?

5.1 Procurement Audit: Static Code Analysis

1146. Did the bidder comply with requests within the deadline set?

1147. Are open purchase orders with a fixed monetary limitation used for local purchases of small dollar value?

1148. Is electronic procurement applied to reduce transaction costs?

1149. Did the chosen procedure ensure competition and transparency?

1150. Is the procurement function/unit organized the most appropriate way taking into consideration the actual tasks which the department has to carry out?

1151. Are existing suppliers that have a special right to be consulted being contacted?

1152. Were results of the award procedures published?

1153. Are approvals needed if changes are made in the quantity or specification of the original purchase requisition?

1154. Are checks safeguarded against theft, loss, or misuse?

1155. How do you address the risk of fraud and corruption?

1156. Were the performance conditions under the contract comprehensive and unambiguous?

1157. Were any additional works or deliveries admissible without the need for a new procurement procedure?

1158. Are lease-purchase agreements drawn and processed in accordance with law and regulation?

1159. Did your organization state the minimum requirements to be met by the variants in the tender documents?

1160. Were all interested operators allowed the opportunity to participate?

1161. What are your ethical guidelines for public procurement?

1162. Are proper authorization and approval required prior to payment?

1163. Is there a system in place to handle partial delivery of orders, back orders, and partial payments?

1164. Which are necessary components of a financial audit report under the Single Audit Act?

1165. Are all purchase orders signed by the purchasing agent?

5.2 Contract Close-Out: Static Code Analysis

1166. Change in knowledge?

1167. Parties: who is involved?

1168. Has each contract been audited to verify acceptance and delivery?

1169. Was the contract sufficiently clear so as not to result in numerous disputes and misunderstandings?

1170. Parties: Authorized?

1171. Have all contracts been closed?

1172. What is capture management?

1173. How/when used ?

1174. Change in attitude or behavior?

1175. Have all contracts been completed?

1176. Was the contract complete without requiring numerous changes and revisions?

1177. How is the contracting office notified of the automatic contract close-out?

1178. Have all contract records been included in the Static Code Analysis project archives?

1179. Was the contract type appropriate?

1180. How does it work?

1181. Are the signers the authorized officials?

1182. What happens to the recipient of services?

1183. Have all acceptance criteria been met prior to final payment to contractors?

1184. Change in circumstances?

5.3 Project or Phase Close-Out: Static Code Analysis

1185. What hierarchical authority does the stakeholder have in your organization?

1186. What is in it for you?

1187. What information did each stakeholder need to contribute to the Static Code Analysis projects success?

1188. What information is each stakeholder group interested in?

1189. How much influence did the stakeholder have over others?

1190. What process was planned for managing issues/risks?

1191. Can the lesson learned be replicated?

1192. Have business partners been involved extensively, and what data was required for them?

1193. What are they?

1194. Was the user/client satisfied with the end product?

1195. Did the Static Code Analysis project management methodology work?

1196. What was expected from each stakeholder?

1197. Is the lesson significant, valid, and applicable?

1198. Planned completion date?

1199. Who is responsible for award close-out?

1200. Were messages directly related to the release strategy or phases of the Static Code Analysis project?

1201. Was the schedule met?

1202. Who exerted influence that has positively affected or negatively impacted the Static Code Analysis project?

1203. Did the delivered product meet the specified requirements and goals of the Static Code Analysis project?

5.4 Lessons Learned: Static Code Analysis

1204. How efficient were Static Code Analysis project team meetings conducted?

1205. Did the team work well together?

1206. What is the value of the deliverable?

1207. Were any strategies or activities unsuccessful?

1208. Did the delivered product meet the specified requirements and goals of the Static Code Analysis project?

1209. What skills are required for the task?

1210. What is the fiscal dependency?

1211. How was the Static Code Analysis project controlled?

1212. How well did the scope of the Static Code Analysis project match what was defined in the Static Code Analysis project Proposal?

1213. What did you put in place to ensure success?

1214. Was there enough support – guidance, clerical support, training?

1215. How smooth do you feel Integration has been?

1216. How timely were Progress Reports provided to the Static Code Analysis project Manager by Team Members?

1217. What regulatory constraints impact the case?

1218. How extensive is middle management?

1219. Are the lessons more complex and multivariate?

1220. How effective was the documentation that you received with the Static Code Analysis project product/service?

1221. Were quality procedures built into the Static Code Analysis project?

1222. How useful was the content of the training you received in preparation for the use of the product/service?

1223. What are the influence patterns?

Index

(Index page number references Only of use in Print Version)