Table of Contents

Table of Contents

About The Art of Service

Included Resources - how to access

Purpose of this Self-Assessment

How to use the Self-Assessment

Static Code AnalysisScorecard Example

Static Code AnalysisScorecard

BEGINNING OF THE SELF-ASSESSMENT

CRITERION #1: RECOGNIZE

CRITERION #2: DEFINE

CRITERION #3: MEASURE

CRITERION #4: ANALYZE

CRITERION #5: IMPROVE

CRITERION #6: CONTROL

CRITERION #7: SUSTAIN

Static Code Analysis and Managing Projects, Criteria for Project Managers:

1.0 Initiating Process Group: Static Code Analysis

1.1 Project Charter: Static Code Analysis

1.2 Stakeholder Register: Static Code Analysis

1.3 Stakeholder Analysis Matrix: Static Code Analysis

2.0 Planning Process Group: Static Code Analysis

2.1 Project Management Plan: Static Code Analysis

2.2 Scope Management Plan: Static Code Analysis

2.3 Requirements Management Plan: Static Code Analysis

2.4 Requirements Documentation: Static Code Analysis

2.5 Requirements Traceability Matrix: Static Code Analysis

2.6 Project Scope Statement: Static Code Analysis

2.7 Assumption and Constraint Log: Static Code Analysis

2.8 Work Breakdown Structure: Static Code Analysis

2.9 WBS Dictionary: Static Code Analysis

2.10 Schedule Management Plan: Static Code Analysis

2.11 Activity List: Static Code Analysis

2.12 Activity Attributes: Static Code Analysis

2.13 Milestone List: Static Code Analysis

2.14 Network Diagram: Static Code Analysis

2.15 Activity Resource Requirements: Static Code Analysis

2.16 Resource Breakdown Structure: Static Code Analysis

2.17 Activity Duration Estimates: Static Code Analysis

2.18 Duration Estimating Worksheet: Static Code Analysis

2.19 Project Schedule: Static Code Analysis

2.20 Cost Management Plan: Static Code Analysis

2.21 Activity Cost Estimates: Static Code Analysis

2.22 Cost Estimating Worksheet: Static Code Analysis

2.23 Cost Baseline: Static Code Analysis

2.24 Quality Management Plan: Static Code Analysis

2.25 Quality Metrics: Static Code Analysis

2.26 Process Improvement Plan: Static Code Analysis

2.27 Responsibility Assignment Matrix: Static Code Analysis

2.28 Roles and Responsibilities: Static Code Analysis

2.29 Human Resource Management Plan: Static Code Analysis

2.30 Communications Management Plan: Static Code Analysis

2.31 Risk Management Plan: Static Code Analysis

2.32 Risk Register: Static Code Analysis

2.33 Probability and Impact Assessment: Static Code Analysis

2.34 Probability and Impact Matrix: Static Code Analysis

2.35 Risk Data Sheet: Static Code Analysis

2.36 Procurement Management Plan: Static Code Analysis

2.37 Source Selection Criteria: Static Code Analysis

2.38 Stakeholder Management Plan: Static Code Analysis

2.39 Change Management Plan: Static Code Analysis

3.0 Executing Process Group: Static Code Analysis

3.1 Team Member Status Report: Static Code Analysis

3.2 Change Request: Static Code Analysis

3.3 Change Log: Static Code Analysis

3.4 Decision Log: Static Code Analysis

3.5 Quality Audit: Static Code Analysis

3.6 Team Directory: Static Code Analysis

3.7 Team Operating Agreement: Static Code Analysis

3.8 Team Performance Assessment: Static Code Analysis

3.9 Team Member Performance Assessment: Static Code Analysis

3.10 Issue Log: Static Code Analysis

4.0 Monitoring and Controlling Process Group: Static Code Analysis

4.1 Project Performance Report: Static Code Analysis

4.2 Variance Analysis: Static Code Analysis

4.3 Earned Value Status: Static Code Analysis

4.4 Risk Audit: Static Code Analysis

4.5 Contractor Status Report: Static Code Analysis

4.6 Formal Acceptance: Static Code Analysis

5.0 Closing Process Group: Static Code Analysis

5.1 Procurement Audit: Static Code Analysis

5.2 Contract Close-Out: Static Code Analysis

5.3 Project or Phase Close-Out: Static Code Analysis

5.4 Lessons Learned: Static Code Analysis

Index

“After utilizing toolkits from The Art of Service, I was able to identify threats within my organization to which I was completely unaware. Using my team’s knowledge as a competitive advantage, we now have superior systems that save time and energy.”

“As a new Chief Technology Officer, I was feeling unprepared and inadequate to be successful in my role. I ordered an IT toolkit Sunday night and was prepared Monday morning to shed light on areas of improvement within my organization. I no longer felt overwhelmed and intimidated, I was excited to share what I had learned.”

“I used the questionnaires to interview members of my team. I never knew how many insights we could produce collectively with our internal knowledge.”

“I usually work until at least 8pm on weeknights. The Art of Service questionnaire saved me so much time and worry that Thursday night I attended my son’s soccer game without sacrificing my professional obligations.”

“After purchasing The Art of Service toolkit, I was able to identify areas where my company was not in compliance that could have put my job at risk. I looked like a hero when I proactively educated my team on the risks and presented a solid solution.”

“I spent months shopping for an external consultant before realizing that The Art of Service would allow my team to consult themselves! Not only did we save time not catching a consultant up to speed, we were able to keep our company information and industry secrets confidential.”

“Everyday there are new regulations and processes in my industry. The Art of Service toolkit has kept me ahead by using AI technology to constantly update the toolkits and address emerging needs.”

“I customized The Art of Service toolkit to focus specifically on the concerns of my role and industry. I didn’t have to waste time with a generic self-help book that wasn’t tailored to my exact situation.”

“Many of our competitors have asked us about our secret sauce. When I tell them it’s the knowledge we have in-house, they never believe me. Little do they know The Art of Service toolkits are working behind the scenes.”

“One of my friends hired a consultant who used the knowledge gained working with his company to advise their competitor. Talk about a competitive disadvantage! The Art of Service allowed us to keep our knowledge from walking out the door along with a huge portion of our budget in consulting fees.”

“Honestly, I didn’t know what I didn’t know. Before purchasing The Art of Service, I didn’t realize how many areas of my business needed to be refreshed and improved. I am so relieved The Art of Service was there to highlight our blind spots.”

“Before The Art of Service, I waited eagerly for consulting company reports to come out each month. These reports kept us up to speed but provided little value because they put our competitors on the same playing field. With The Art of Service, we have uncovered unique insights to drive our business forward.”

“Instead of investing extensive resources into an external consultant, we can spend more of our budget towards pursuing our company goals and objectives…while also spending a little more on corporate holiday parties.”

“The risk of our competitors getting ahead has been mitigated because The Art of Service has provided us with a 360-degree view of threats within our organization before they even arise.”

Static Code Analysis

Complete Self-Assessment Guide

Notice of rights

You are licensed to use the Self-Assessment contents in your presentations and materials for internal use and customers without asking us - we are here to help.

All rights reserved for the book itself: this book may not be reproduced or transmitted in any form by any means, electronic, mechanical, photocopying, recording, or otherwise, without the prior written permission of the publisher.

The information in this book is distributed on an “As Is” basis without warranty. While every precaution has been taken in the preparation of the book, neither the author nor the publisher shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the instructions contained in this book or by the products described in it.

Trademarks

Many of the designations used by manufacturers and sellers to distinguish their products are claimed as trademarks. Where those designations appear in this book, and the publisher was aware of a trademark claim, the designations appear as requested by the owner of the trademark. All other product names and services identified throughout this book are used in editorial fashion only and for the benefit of such companies with no intention of infringement of the trademark. No such use, or the use of any trade name, is intended to convey endorsement or other affiliation with this book.

Copyright © by The Art of Service

https://theartofservice.com

support@theartofservice.com

About The Art of Service

The Art of Service, Business Process Architects since 2000, is dedicated to helping stakeholders achieve excellence.

Defining, designing, creating, and implementing a process to solve a stakeholders challenge or meet an objective is the most valuable role… In EVERY group, company, organization and department.

Unless you’re talking a one-time, single-use project, there should be a process. Whether that process is managed and implemented by humans, AI, or a combination of the two, it needs to be designed by someone with a complex enough perspective to ask the right questions.

Someone capable of asking the right questions and step back and say, ‘What are we really trying to accomplish here? And is there a different way to look at it?’

With The Art of Service’s Self-Assessments, we empower people who can do just that — whether their title is marketer, entrepreneur, manager, salesperson, consultant, Business Process Manager, executive assistant, IT Manager, CIO etc… —they are the people who rule the future. They are people who watch the process as it happens, and ask the right questions to make the process work better.

Contact us when you need any support with this Self-Assessment and any help with templates, blue-prints and examples of standard documents you might need:

https://theartofservice.com

support@theartofservice.com

Included Resources - how to access

Included with your purchase of the book is the Static Code Analysis Self-Assessment Spreadsheet Dashboard which contains all questions and Self-Assessment areas and auto-generates insights, graphs, and project RACI planning - all with examples to get you started right away.

How? Simply send an email to

access@theartofservice.com

with this books’ title in the subject to get the Static Code Analysis Self Assessment Tool right away.

The auto reply will guide you further, you will then receive the following contents with New and Updated specific criteria:

•The latest quick edition of the book in PDF

•The latest complete edition of the book in PDF, which criteria correspond to the criteria in…

•The Self-Assessment Excel Dashboard, and…

•Example pre-filled Self-Assessment Excel Dashboard to get familiar with results generation

•In-depth specific Checklists covering the topic

•Project management checklists and templates to assist with implementation

INCLUDES LIFETIME SELF ASSESSMENT UPDATES

Every self assessment comes with Lifetime Updates and Lifetime Free Updated Books. Lifetime Updates is an industry-first feature which allows you to receive verified self assessment updates, ensuring you always have the most accurate information at your fingertips.

Get it now- you will be glad you did - do it now, before you forget.

Send an email to access@theartofservice.com with this books’ title in the subject to get the Static Code Analysis Self Assessment Tool right away.

Purpose of this Self-Assessment

This Self-Assessment has been developed to improve understanding of the requirements and elements of Static Code Analysis, based on best practices and standards in business process architecture, design and quality management.

It is designed to allow for a rapid Self-Assessment to determine how closely existing management practices and procedures correspond to the elements of the Self-Assessment.

The criteria of requirements and elements of Static Code Analysis have been rephrased in the format of a Self-Assessment questionnaire, with a seven-criterion scoring system, as explained in this document.

In this format, even with limited background knowledge of Static Code Analysis, a manager can quickly review existing operations to determine how they measure up to the standards. This in turn can serve as the starting point of a ‘gap analysis’ to identify management tools or system elements that might usefully be implemented in the organization to help improve overall performance.

How to use the Self-Assessment

On the following pages are a series of questions to identify to what extent your Static Code Analysis initiative is complete in comparison to the requirements set in standards.

To facilitate answering the questions, there is a space in front of each question to enter a score on a scale of ‘1’ to ‘5’.

1 Strongly Disagree

2 Disagree

3 Neutral

4 Agree

5 Strongly Agree

Read the question and rate it with the following in front of mind:

‘In my belief,

the answer to this question is clearly defined’.

There are two ways in which you can choose to interpret this statement;

1.how aware are you that the answer to the question is clearly defined

2.for more in-depth analysis you can choose to gather evidence and confirm the answer to the question. This obviously will take more time, most Self-Assessment users opt for the first way to interpret the question and dig deeper later on based on the outcome of the overall Self-Assessment.

A score of ‘1’ would mean that the answer is not clear at all, where a ‘5’ would mean the answer is crystal clear and defined. Leave emtpy when the question is not applicable or you don’t want to answer it, you can skip it without affecting your score. Write your score in the space provided.

After you have responded to all the appropriate statements in each section, compute your average score for that section, using the formula provided, and round to the nearest tenth. Then transfer to the corresponding spoke in the Static Code Analysis Scorecard on the second next page of the Self-Assessment.

Your completed Static Code Analysis Scorecard will give you a clear presentation of which Static Code Analysis areas need attention.

Static Code Analysis

Scorecard Example

Example of how the finalized Scorecard can look like:

Static Code Analysis

Scorecard

Your Scores:

BEGINNING OF THE

SELF-ASSESSMENT:

CRITERION #1: RECOGNIZE

INTENT: Be aware of the need for change. Recognize that there is an unfavorable variation, problem or symptom.

In my belief, the answer to this question is clearly defined:

5 Strongly Agree

4 Agree

3 Neutral

2 Disagree

1 Strongly Disagree

1. Are system owners willing to adjust logging polices to meet SOC needs?

<– Score

2. Is there a relationship between code review coverage and the number of issues in a project?

<– Score

3. What situation(s) led to this Static Code Analysis Self Assessment?

<– Score

4. How are the Static Code Analysis’s objectives aligned to the group’s overall stakeholder strategy?

<– Score

5. Are you looking for an internationally recognized certification in agile software testing?

<– Score

6. How does project age and activity influence security issues?

<– Score

7. Why do you need to address code quality?

<– Score

8. Are there any specific expectations or concerns about the Static Code Analysis team, Static Code Analysis itself?

<– Score

9. Is there a mapping from issue to source code position?

<– Score

10. Are there regulatory / compliance issues?

<– Score

11. Is there a large clump of issues around a particular module or a particular feature?

<– Score

12. Does the tool allow the identification of a change (person)?

<– Score

13. What is the problem with the model?

<– Score

14. What about when customers find issues in a production environment?

<– Score

15. What does Static Code Analysis success mean to the stakeholders?

<– Score

16. How much preliminary problem design must be done before one can use this tool?

<– Score

17. How to detect architecture and code problems as soon as possible?

<– Score

18. Is all unauthorized mobile code prevented from executing?

<– Score

19. What is the relevance of identifying technical debt?

<– Score

20. Do you have/need 24-hour access to key personnel?

<– Score

21. What are the expected benefits of Static Code Analysis to the stakeholder?

<– Score

22. What is the mechanism for resolving issues?

<– Score

23. How much are sponsors, customers, partners, stakeholders involved in Static Code Analysis? In other words, what are the risks, if Static Code Analysis does not deliver successfully?

<– Score

24. Is there an identification of source code level modules with the architecture?

<– Score

25. Is a rebuild triggered after every source code push?

<– Score

26. How do you adapt the tools to your needs?

<– Score

27. Is the project useful for identifying health care needs and informing health care policy?

<– Score

28. How does team size play a role for security issues in Android apps?

<– Score

29. Has malicious code or security vulnerabilities been identified in your systems code?

<– Score

30. What are the stakeholder objectives to be achieved with Static Code Analysis?

<– Score

31. What are the minority interests and what amount of minority interests can be recognized?

<– Score

32. Do you do team auditing and assign issues?

<– Score

33. Is is possible to edit issues status?

<– Score

34. What would happen if Static Code Analysis weren’t done?

<– Score

35. Which of the threats identified in your threat model apply to the code you are reviewing?

<– Score

36. Is the team able to use logging to diagnose build script issues?

<– Score

37. Have you identified all the stakeholders?

<– Score

38. How many outstanding issues or problems exist and how long is it taking to resolve them?

<– Score

39. How much time, effort, and expertise is needed to exploit the threat?

<– Score

40. Does the identification and management of technical debt have any effect on software quality?

<– Score

41. Would you recognize a threat from the inside?

<– Score

42. How do you determine need-to-know?

<– Score

43. What problems are you facing and how do you consider Static Code Analysis will circumvent those obstacles?

<– Score

44. Why do you need a different set of complexity metrics?

<– Score

45. How are you going to measure success?

<– Score

46. How many trainings, in total, are needed?

<– Score

47. As a sponsor, customer or management, how important is it to meet goals, objectives?

<– Score

48. How do issues get reviewed/audited?

<– Score

49. Who else hopes to benefit from it?

<– Score

50. Is there any software that needs to be loaded onto local computers?

<– Score

51. Did you introduce any critical issues during the last iteration?

<– Score

52. Is it a single line of code that needs to be altered?

<– Score

53. What does your organization actually need?

<– Score

54. Are issues with architectural elements among the most significant sources of technical debt?

<– Score

55. What creative shifts do you need to take?

<– Score

Add up total points for this section: _____ = Total points for this section

Divided by: ______ (number of statements answered) = ______ Average score for this section

Transfer your score to the Static Code Analysis Index at the beginning of the Self-Assessment.

CRITERION #2: DEFINE:

INTENT: Formulate the stakeholder problem. Define the problem, needs and objectives.

In my belief, the answer to this question is clearly defined:

5 Strongly Agree

4 Agree

3 Neutral

2 Disagree

1 Strongly Disagree

1. How will the Static Code Analysis team and the group measure complete success of Static Code Analysis?

<– Score

2. Is role-based testing within scope?

<– Score

3. Are customer(s) identified and segmented according to their different needs and requirements?

<– Score

4. Has/have the customer(s) been identified?

<– Score

5. Does the review address the comprehensibility of the requirements?

<– Score

6. When is the estimated completion date?

<– Score

7. What are the compelling stakeholder reasons for embarking on Static Code Analysis?

<– Score

8. Are accountability and ownership for Static Code Analysis clearly defined?

<– Score

9. How do you keep key subject matter experts in the loop?

<– Score

10. Are team charters developed?

<– Score

11. Are there different segments of customers?

<– Score

12. What is the code required to do under each test case?

<– Score

13. Is the team equipped with available and reliable resources?

<– Score

14. What key stakeholder process output measure(s) does Static Code Analysis leverage and how?

<– Score

15. Will code review be in-scope for each application?

<– Score

16. Is the work to date meeting requirements?

<– Score

17. Are customers identified and high impact areas defined?

<– Score

18. What is the proposed approach to make sure that applications do comply with the requirements?

<– Score

19. What will happen in case a major open source project fails?

<– Score

20. What specifically is the problem? Where does it occur? When does it occur? What is its extent?

<– Score

21. How did the Static Code Analysis manager receive input to the development of a Static Code Analysis improvement plan and the estimated completion dates/times of each activity?

<– Score

22. How do you know what part of your application to examine first?

<– Score

23. Does the team have regular meetings?

<– Score

24. Is there a critical path to deliver Static Code Analysis results?

<– Score

25. Is there regularly 100% attendance at the team meetings? If not, have appointed substitutes attended to preserve cross-functionality and full representation?

<– Score

26. Has anyone else (internal or external to the group) attempted to solve this problem or a similar one before? If so, what knowledge can be leveraged from these previous efforts?

<– Score

27. How many phishing campaigns of varying complexity levels are required?

<– Score

28. What critical content must be communicated – who, what, when, where, and how?

<– Score

29. Is a role defined that is responsible for customer information?

<– Score

30. Is there a Static Code Analysis management charter, including stakeholder case, problem and goal statements, scope, milestones, roles and responsibilities, communication plan?

<– Score

31. Have the customer needs been translated into specific, measurable requirements? How?

<– Score

32. Who defines (or who defined) the rules and roles?

<– Score

33. How much security expertise is required for a basic level of security testing?

<– Score

34. Will team members perform Static Code Analysis work when assigned and in a timely fashion?

<– Score

35. Do the problem and goal statements meet the SMART criteria (specific, measurable, attainable, relevant, and time-bound)?

<– Score

36. What are the boundaries of the scope? What is in bounds and what is not? What is the start point? What is the stop point?

<– Score

37. Are different versions of process maps needed to account for the different types of inputs?

<– Score

38. How often are the team meetings?

<– Score

39. What are the rough order estimates on cost savings/opportunities that Static Code Analysis brings?

<– Score

40. Is there a completed, verified, and validated high-level ‘as is’ (not ‘should be’ or ‘could be’) stakeholder process map?

<– Score

41. What is the total line count for all source code in scope?

<– Score

42. Do professional software engineers have a shared definition of technical debt?

<– Score

43. Are improvement team members fully trained on Static Code Analysis?

<– Score

44. What knowledge or experience is required?

<– Score

45. What all details will be required by your organization for tracking the services?

<– Score

46. Is there a completed SIPOC representation, describing the Suppliers, Inputs, Process, Outputs, and Customers?

<– Score

47. Has everyone on the team, including the team leaders, been properly trained?

<– Score

48. What gets examined?

<– Score

49. When is/was the Static Code Analysis start date?

<– Score

50. Is the team sponsored by a champion or stakeholder leader?

<– Score

51. How do you think the partners involved in Static Code Analysis would have defined success?

<– Score

52. Are there any case studies for implementing Privacy by Design?

<– Score

53. Is the Static Code Analysis scope manageable?

<– Score

54. What methods will you use to elicit requirements?

<– Score

55. Is Static Code Analysis linked to key stakeholder goals and objectives?

<– Score

56. Has a high-level ‘as is’ process map been completed, verified and validated?

<– Score

57. Has the improvement team collected the ‘voice of the customer’ (obtained feedback – qualitative and quantitative)?

<– Score

58. Do you have a policy that requires BYOD users to prohibit the usage of unapproved application stores?

<– Score

59. Is full participation by members in regularly held team meetings guaranteed?

<– Score

60. Is a fully trained team formed, supported, and committed to work on the Static Code Analysis improvements?

<– Score

61. How is the team tracking and documenting its work?

<– Score

62. Is data collected and displayed to better understand customer(s) critical needs and requirements.

<– Score

63. How does the Static Code Analysis manager ensure against scope creep?

<– Score

64. Who are the Static Code Analysis improvement team members, including Management Leads and Coaches?

<– Score

65. Is the team formed and are team leaders (Coaches and Management Leads) assigned?

<– Score

66. What customer feedback methods were used to solicit their input?

<– Score

67. Has the Static Code Analysis work been fairly and/or equitably divided and delegated among team members who are qualified and capable to perform the work? Has everyone contributed?

<– Score

68. What constraints exist that might impact the team?

<– Score

69. What are the dynamics of the communication plan?

<– Score

70. What are the Roles and Responsibilities for each team member and its leadership? Where is this documented?

<– Score

71. When are meeting minutes sent out? Who is on the distribution list?

<– Score

72. Are there system or user requirements or both?

<– Score

73. How do you manage changes in Static Code Analysis requirements?

<– Score

74. What would be the goal or target for a Static Code Analysis’s improvement team?

<– Score

75. What is the definition of success?

<– Score

76. How will variation in the actual durations of each activity be dealt with to ensure that the expected Static Code Analysis results are met?

<– Score

77. Does the license permit this CASE tool to reside on more than one machine?

<– Score

78. Has a project plan, Gantt chart, or similar been developed/completed?

<– Score

79. Is Static Code Analysis currently on schedule according to the plan?

<– Score

80. Will team members regularly document their Static Code Analysis work?

<– Score

81. Are stakeholder processes mapped?

<– Score

82. Does the requirement review cover all requirements (at least the new ones for a release)?

<– Score

83. Does a code change normally require a code review before it can be checked in?

<– Score

84. Does quality of requirements specifications matter?

<– Score

85. Has the direction changed at all during the course of Static Code Analysis? If so, when did it change and why?

<– Score

86. Is the current ‘as is’ process being followed? If not, what are the discrepancies?

<– Score

87. Does the review address the completeness of the requirements?

<– Score

88. Are there any constraints known that bear on the ability to perform Static Code Analysis work? How is the team addressing them?

<– Score

89. Has a team charter been developed and communicated?

<– Score

90. Is the improvement team aware of the different versions of a process: what they think it is vs. what it actually is vs. what it should be vs. what it could be?

<– Score

91. How was the ‘as is’ process map developed, reviewed, verified and validated?

<– Score

92. Is the team adequately staffed with the desired cross-functionality? If not, what additional resources are available to the team?

<– Score

93. If substitutes have been appointed, have they been briefed on the Static Code Analysis goals and received regular communications as to the progress to date?

<– Score

Add up total points for this section: _____ = Total points for this section

Divided by: ______ (number of statements answered) = ______ Average score for this section

Transfer your score to the Static Code Analysis Index at the beginning of the Self-Assessment.

CRITERION #3: MEASURE:

INTENT: Gather the correct data. Measure the current performance and evolution of the situation.

In my belief, the answer to this question is clearly defined:

5 Strongly Agree

4 Agree

3 Neutral

2 Disagree

1 Strongly Disagree

1. What is the main cause of failure/delay in rolling out your code to production?

<– Score

2. How do you measure a projects vitality?

<– Score

3. Why do you use Static Code Analysis?

<– Score

4. Who participated in the data collection for measurements?

<– Score

5. Has the actual cost of the project been registered and compared to the approved cost baseline?

<– Score

6. Who tried some dynamic analysis tool?

<– Score

7. How to analyze functions source code of existing systems and decompose them into metrics?

<– Score

8. Where in the development process shall static code analysis be integrated?

<– Score

9. How can analysis search all paths?

<– Score

10. What will be the result of static analysis?

<– Score

11. Does management have the right priorities among projects?

<– Score

12. Does your analysis strategy compute a correct result?

<– Score

13. What code analysis tools do you use?

<– Score

14. How good is static analysis at finding concurrency bugs?

<– Score

15. How long should an analysis take?

<– Score

16. What is dynamic analysis good for?

<– Score

17. Why would you use Static Analysis?

<– Score

18. Is the project useful for comparing costs between various treatment settings and approaches?

<– Score

19. Has static code analysis been performed to identify information security vulnerabilities?

<– Score

20. Does the build fail when there are violations of required static code analysis rules?

<– Score

21. How do you perform static code analysis to detect software security vulnerabilities?

<– Score

22. When is the security analysis testing complete?

<– Score

23. How to conduct a preliminary security analysis?

<– Score

24. What are the uncertainties surrounding estimates of impact?

<– Score

25. How to measure software engineering excellence?

<– Score

26. What is static code analysis of source code?

<– Score

27. How is progress measured?

<– Score

28. Do you subject your code to Static Code Analysis and/or Static Application Security Testing prior to release?

<– Score

29. How shall static code analysis be integrated into the development process?

<– Score

30. Can good or poor design be measured?

<– Score

31. How effective are static analysis tools in detecting Java concurrency bugs and bug patterns?

<– Score

32. What is static analysis good for?

<– Score

33. How do you currently do static analysis?

<– Score

34. Where does static analysis fit in a SDLC?

<– Score

35. What are the strategic priorities for this year?

<– Score

36. What has the team done to assure the stability and accuracy of the measurement process?

<– Score

37. How quickly is the analysis performed?

<– Score

38. What are the possible values of x and y according to the value analysis?

<– Score

39. Do you perform static code analysis?

<– Score

40. How much pain would a buffer overflow vulnerability cause in your program?

<– Score

41. What are costs of participating in the ecosystem?

<– Score

42. Does this static analysis tool aid in assessing what to do about a warning?

<– Score

43. How are imprecise tools measured and compared?

<– Score

44. What are the principles of static code analysis and how security code review should be employed?

<– Score

45. What is static code analysis to your organization?

<– Score

46. What tools and methods should be used to measure the defects?

<– Score

47. What happens when you re-run the analysis?

<– Score

48. What does static code analysis do?

<– Score

49. What statistics do you think would be beneficial to have on Analysis Overview panel for done analysis?

<– Score

50. What charts has the team used to display the components of variation in the process?

<– Score

51. What are the costs?

<– Score

52. Are analytical methods for each parameter to be analyzed specified?

<– Score

53. What is the overall security budget and the priorities of that budget?

<– Score

54. What particular quality tools did the team find helpful in establishing measurements?

<– Score

55. Are all of the entry points and trust boundaries identified by the design and are in risk analysis report?

<– Score

56. Will your analysis always be correct?

<– Score

57. Can particular attributes of software be subjected to similar measurements?

<– Score

58. Is it possible to following the analysis progress?

<– Score

59. Do code review practices impact design quality?

<– Score

60. What tools for static code analysis do you use?

<– Score

61. Will you use the static code analysis tools?

<– Score

62. Which components will be analyzed?

<– Score

63. What is the point of analyzing programs?

<– Score

64. What types of reporting and analytics capabilities does the product provide?

<– Score

65. Do you improve the usefulness of static analysis tools with models trained on historic data?

<– Score

66. Who tried some static analysis tool?

<– Score

67. Have you ever consciously avoided using a static analysis tool?

<– Score

68. Are you able to realize any cost savings?

<– Score

69. What users will be impacted?

<– Score

70. What is the find-and-fix cost, per defect type, of defects injected during Code?

<– Score

71. What improvements do developers want to see being made to static analysis tools?

<– Score

72. Why do practical static analysis tools both miss problems and report false problems?

<– Score

73. What other traceability can static code analysis assist?

<– Score

74. What is the impact on software quality?

<– Score

75. Can static code analysis in the development process be automated?

<– Score

76. How could a static analysis tool evaluate the assertion?

<– Score

77. How would a static analysis tool detect that the authorization service of the application can be bypassed?

<– Score

78. Do you have any cost Static Code Analysis limitation requirements?

<– Score

79. What are the key input variables? What are the key process variables? What are the key output variables?

<– Score

80. How effective are free static analysis tools detecting vulnerabilities in web application plugins?

<– Score

81. Is the waste analysis data that the generator agrees to provide specified?

<– Score

82. Which measurements correlate well to software quality?

<– Score

83. What is the impact on the team when technical debt is explicitly considered?

<– Score

84. What should an analyst have within reach?

<– Score

85. What is the cost to gating release with a security expert review?

<– Score

86. How will success or failure be measured?

<– Score

87. What are the critical characteristics of a good static analysis tool?

<– Score

88. Is it possible to estimate the impact of unanticipated complexity such as wrong or failed assumptions, feedback, etcetera on proposed reforms?

<– Score

89. What is the real importance and impact of plugins in the security of a web application?

<– Score

90. What are predictive Static Code Analysis analytics?

<– Score

91. How well do current static analysis tools fit into the workflows of developers?

<– Score

92. What type of analysis is being carried out?

<– Score

93. How often are the reports from the analysis reviewed?

<– Score

94. What can static code analysis do?

<– Score

95. Why is static analysis hard (user perspective)?

<– Score

96. What assumptions do you build into your analysis to make it more accurate?

<– Score

97. What methods of static code analysis are available?

<– Score

98. What configuration change events will trigger code analysis?

<– Score

99. What is static analysis used for?

<– Score

100. What is soundness (in static analysis)?

<– Score

101. How effective are static analysis tools in detecting Java multithreaded bugs and bug patterns?

<– Score

102. Do you still automate application analysis?

<– Score

103. Will the supplier perform static code analysis as part of its code development and/or code integration processes?

<– Score

104. Can you measure the return on analysis?

<– Score

105. How does this affect your analysis?

<– Score

106. What is the impact of the technical debt management model on the team development process?

<– Score

107. Does lazy propagation improve the precision of the analysis?

<– Score

108. Is it easy and intuitive to start the analysis?

<– Score

109. How is static code analysis best integrated into the development process of embedded software?

<– Score

110. How can testing with static code analysis help?

<– Score

111. What is the impact of incidents to major lines of business or mission function?

<– Score

112. What are the details of code inspection process for manual security analysis?

<– Score

113. What are your operating costs?

<– Score

114. How much effort is required to manually start an analysis?

<– Score

115. What are static analyzer operational requirements?

<– Score

116. What are static analysis tools used for?

<– Score

117. How much visualization and how much analytics?

<– Score

118. Has the completeness of the risk analysis been checked systematic approach or review?

<– Score

119. Is the team thoroughly analyzing assemblies using one or more static code analysis tools?

<– Score

120. Does lazy propagation have a noticeable impact on performance of the analysis?

<– Score

121. What is the Static Code Analysis business impact?

<– Score

122. Are the build processes and system architecture that software updates are as best as possible modular in nature to minimise the impact on earlier versions?

<– Score

123. What are the inherent limitations of static code analysis?

<– Score

124. What key measures identified indicate the performance of the stakeholder process?

<– Score

125. What data was collected (past, present, future/ongoing)?

<– Score

126. Is source code sufficiently legible and structured to permit static code analysis and for the review of its functionality to be conducted with confidence?

<– Score

127. Are the semantics of the language defined sufficiently for static code analysis to be feasible?

<– Score

128. What are the possible values of x and y inside the while-loop according to the value analysis?

<– Score

129. What type of application will you be analyzing?

<– Score

130. Are the units of measure consistent?

<– Score

131. What is a trivial way to implement a sound analysis?

<– Score

132. How long to keep data and how to manage retention costs?

<– Score

133. Have you ever used a static analysis tool in a team setting?

<– Score

134. What dynamic analysis approaches are used on the platform and how can they be evaluated?

<– Score

135. Why is static analysis hard (vendor perspective)?

<– Score

136. What is practical static analysis?

<– Score

137. Why is dynamic analysis so widely used for Javascript?

<– Score

138. Does explicitly considering technical debt in decision making have an impact on maintenance cost?

<– Score

Add up total points for this section: _____ = Total points for this section

Divided by: ______ (number of statements answered) = ______ Average score for this section

Transfer your score to the Static Code Analysis Index at the beginning of the Self-Assessment.

CRITERION #4: ANALYZE:

INTENT: Analyze causes, assumptions and hypotheses.

In my belief, the answer to this question is clearly defined:

5 Strongly Agree

4 Agree

3 Neutral

2 Disagree

1 Strongly Disagree

1. How will the data be checked for quality?

<– Score

2. What is the output from running the program?

<– Score

3. What is the printed output code fragment?

<– Score

4. What training and qualifications will you need?

<– Score

5. What were the crucial ‘moments of truth’ on the process map?

<– Score

6. Does the App read external data from the channels that you have identified?

<– Score

7. Is there a strict change management process?

<– Score

8. Is your review process really repeatable and easy to audit?

<– Score

9. Who will facilitate the team and process?

<– Score

10. What are the processes for audit reporting and management?

<– Score

11. What are your key performance measures or indicators and in-process measures for the control and improvement of your Static Code Analysis processes?

<– Score

12. Are you moving business critical data or functionality to the cloud?

<– Score

13. Do you collect capacity and use data for all relevant components of your cloud service offering?

<– Score

14. How do you make sure your data is secure and maintains compliance with legal regulations?

<– Score

15. What data is needed and where is it?

<– Score

16. How will corresponding data be collected?

<– Score

17. What is your organizations system for selecting qualified vendors?

<– Score

18. What is the cost of poor quality as supported by the team’s analysis?

<– Score

19. Are data based on unrealistic organization conditions?

<– Score

20. Do you provide your tenants with documentation that describes your quality assurance process?

<– Score

21. Is data and process analysis, root cause analysis and quantifying the gap/opportunity in place?

<– Score

22. Are you adding confidential/sensitive data?

<– Score

23. Which data types are available in JavaScript?

<– Score

24. What are your current levels and trends in key measures or indicators of Static Code Analysis product and process performance that are important to and directly serve your customers? How do these results compare with the performance of your competitors and other organizations with similar offerings?

<– Score

25. Why is historical population data important?

<– Score

26. Does your it provide remote wipe or corporate data wipe for all organization-assigned mobile devices?

<– Score

27. How can tests based on this data be kept expressive and maintainable?

<– Score

28. Do you provide the physical location/geography of storage of a tenants data in advance?

<– Score

29. What were the financial benefits resulting from any ‘ground fruit or low-hanging fruit’ (quick fixes)?

<– Score

30. How does the Agile software development process work?

<– Score

31. Were there any improvement opportunities identified from the process analysis?

<– Score

32. Is there any way to speed up the process?

<– Score

33. Is there any pre-defined format in which the user will upload Service and Service Provider data?

<– Score

34. What quality tools were used to get through the analyze phase?

<– Score

35. How do you represent the physical data model?

<– Score

36. Does the size of the project or the database play a role in smell density?

<– Score

37. How do you more quickly understand and evolve an application that you have never seen?

<– Score

38. Did any additional data need to be collected?

<– Score

39. Do you review all agreements, policies and processes at least annually?

<– Score

40. Where are the data center and storage facilities?

<– Score

41. When should a process be art not science?

<– Score

42. Where does this information/data go?

<– Score

43. What does the latest vulnerability data suggest?

<– Score

44. Does your team review and reflect on code review process?

<– Score

45. Does the software protect itself and its data against unauthorized access and use?

<– Score

46. What data elements apply to each of the roles?

<– Score

47. Is the data sent on encrypted channel?

<– Score

48. What is the process of the code review when code during the code review needs to be changed?

<– Score

49. Is the Static Code Analysis process severely broken such that a re-design is necessary?

<– Score

50. Were Pareto charts (or similar) used to portray the ‘heavy hitters’ (or key sources of variation)?

<– Score

51. What Static Code Analysis data will be collected?

<– Score

52. Was a cause-and-effect diagram used to explore the different types of causes (or sources of variation)?

<– Score

53. Does the team data drive the test methods when there are multiple test cases?

<– Score

54. What are the queries the system is sending to the database?

<– Score

55. What controls do you have in place to protect data?

<– Score

56. What are the revised rough estimates of the financial savings/opportunity for Static Code Analysis improvements?

<– Score

57. What drives the software development workflow?

<– Score

58. Is the gap/opportunity displayed and communicated in financial terms?

<– Score

59. Is there any sensitive data in configuration files?

<– Score

60. Do you have a policy that requires BYOD users to perform backups of specified corporate data?

<– Score

61. What have sampling and data collection got to do with good qualitative research?

<– Score

62. Are procedures to determine how well the generators data represents the waste to be managed provided?

<– Score

63. Is sensitive data being handled?

<– Score

64. How do you use Static Code Analysis data and information to support organizational decision making and innovation?

<– Score

65. What tools were used to narrow the list of possible causes?

<– Score

66. What tools were used to generate the list of possible causes?

<– Score

67. Does the cloud provider adequately isolate customer data?

<– Score

68. How to assess the success of the open data ecosystem?

<– Score

69. Do data-validation functions log anything?

<– Score

70. What is the printed output program?

<– Score

71. Do you document how you grant and approve access to tenant data?

<– Score

72. How long do data need to be kept in the archive database, if at all?

<– Score

73. Is the performance gap determined?

<– Score

74. Do you provide documentation regarding how you may or access tenant data and metadata?

<– Score

75. Was a detailed process map created to amplify critical steps of the ‘as is’ stakeholder process?

<– Score

76. What database structure does your system utilize?

<– Score

77. What else do you do with this attack surface model / database?

<– Score

78. Does the service specify data durability?

<– Score

79. What is your data breach policy?

<– Score

80. What sort of output validation should a Web Service perform?

<– Score

81. Do staff qualifications match your project?

<– Score

82. Do you encrypt tenant data at rest (on disk/storage) within your environment?

<– Score

83. Who needs to be involved in the process of finding and resolving issues?

<– Score

84. Is the build script able to read and write XML data?

<– Score

85. What are the service management processes and tools in place today?

<– Score

86. Are the research outputs publicly available?

<– Score

87. How is data used for program management and improvement?

<– Score

88. Where is Static Code Analysis data gathered?

<– Score

89. How long do data need to be kept in the operational database?

<– Score

90. Were any designed experiments used to generate additional insight into the data analysis?

<– Score

91. How are users blocked from accessing other users data?

<– Score

92. What lines of the program can affect the output?

<– Score

93. Did any value-added analysis or ‘lean thinking’ take place to identify some of the gaps shown on the ‘as is’ process map?

<– Score

94. How do you quickly determine what is going on in your application?

<– Score

95. What systems/processes must you excel at?

<– Score

96. What Static Code Analysis data should be managed?

<– Score

97. How long do data need to be kept on removable media, if at all?

<– Score

98. What conclusions were drawn from the team’s data collection and analysis? How did the team reach these conclusions?

<– Score

99. What does the data say about the performance of the stakeholder process?

<– Score

100. What resources would be available for working with the data?

<– Score

101. Did they use the workbench to check and/or modify data schema?

<– Score

102. Do you have a need to automate the deployment of your database schema?

<– Score

103. What is the role of the host process in managing apps?

<– Score

104. Does your it provide remote wipe or corporate data wipe for all organization-accepted byod devices?

<– Score

105. Do you have capability to recover data for a specific customer in the case of a failure or data loss?

<– Score

106. Do you provide the physical location/geography of storage of a tenants data upon request?

<– Score

107. What did the team gain from developing a sub-process map?

<– Score

108. Does your organization keep the active and inactive clients in the same database?

<– Score

109. Is there a better way to store data so it can be retrieved more efficiently?

<– Score

110. Are gaps between current performance and the goal performance identified?

<– Score

111. How do you get the convert between code units and physical units for your dataset?

<– Score

112. Have any additional benefits been identified that will result from closing all or most of the gaps?

<– Score

113. Which api enables you to exchange data strings between a client and server?

<– Score

114. How was the detailed process map generated, verified, and validated?

<– Score

115. How to measure baseline process a process performed by separate team?

<– Score

116. Have the problem and goal statements been updated to reflect the additional knowledge gained from the analyze phase?

<– Score

117. Is the traceability of requirements verified in a review process?

<– Score

118. What are the Static Code Analysis design outputs?

<– Score

Add up total points for this section: _____ = Total points for this section

Divided by: ______ (number of statements answered) = ______ Average score for this section

Transfer your score to the Static Code Analysis Index at the beginning of the Self-Assessment.

CRITERION #5: IMPROVE:

INTENT: Develop a practical solution. Innovate, establish and test the solution and to measure the results.

In my belief, the answer to this question is clearly defined:

5 Strongly Agree

4 Agree

3 Neutral

2 Disagree

1 Strongly Disagree

1. Will this copy operation result in a buffer overflow?

<– Score

2. Is supporting Static Code Analysis documentation required?

<– Score

3. Who makes the Static Code Analysis decisions in your organization?

<– Score

4. How do you keep developers up to date on security risks?

<– Score

5. How is the result presented to the auditor?

<– Score

6. What is the implementation plan?

<– Score

7. How to integrate and combine independently developed tools?

<– Score

8. How do Google developers perceive code review?

<– Score

9. Does bug prediction support human developers?

<– Score

10. What is Static Code Analysis’s impact on utilizing the best solution(s)?

<– Score

11. Are some developers significantly more effective than others?

<– Score

12. What about development that cannot be broadly adopted across research communities or beyond?

<– Score

13. Which environment gives developers access to a users device?

<– Score

14. Do you make available documentation of your organization-wide risk management program?

<– Score

15. Can the application revert back to normal operation when the security risk score drops to normal levels?

<– Score

16. Who are the Static Code Analysis decision-makers?

<– Score

17. Do you currently implement Continuous Integration in your development cycle?

<– Score

18. Is operating system matters in developing mobile services?

<– Score

19. Is there significant variation in code review effectiveness between developers?

<– Score

20. Are there any constraints (technical, political, cultural, or otherwise) that would inhibit certain solutions?

<– Score

21. What about improvements and missing approaches in this research area?

<– Score

22. How do developers manually fix real-world buffer overflow bugs?

<– Score

23. Are all firewall access control lists documented with business justification?

<– Score

24. What tools were used to tap into the creativity and encourage ‘outside the box’ thinking?

<– Score

25. How do software engineers understand code changes?

<– Score

26. Are the risks fully understood, reasonable and manageable?

<– Score

27. Is a solution implementation plan established, including schedule/work breakdown structure, resources, risk management plan, cost/budget, and control plan?

<– Score

28. How is quality handled throughout the product development life cycle?

<– Score

29. What communications are necessary to support the implementation of the solution?

<– Score

30. Is it possible to assign issues to developers?

<– Score

31. Is there any other Static Code Analysis solution?

<– Score

32. Does your Microsoft Dynamics CRM solution use the extensibility architecture and provided APIs appropriately?

<– Score

33. What attendant changes will need to be made to ensure that the solution is successful?

<– Score

34. What are the Static Code Analysis security risks?

<– Score

35. How is continuous improvement applied to risk management?

<– Score

36. Is internet-speed software development different?

<– Score

37. How do you measure progress and evaluate training effectiveness?

<– Score

38. Does the solution deliver actionable diagnostics to help developers x defects?

<– Score

39. Is a contingency plan established?

<– Score

40. How do improve your feedback loop during maintenance?

<– Score

41. Does using automated code review services improve software security?

<– Score

42. What does the ‘should be’ process map/design look like?

<– Score

43. Can you integrate quality management and risk management?

<– Score

44. How did the team generate the list of possible solutions?

<– Score

45. Has the application security industry improved?

<– Score

46. Was a pilot designed for the proposed solution(s)?

<– Score

47. How do developers use dynamic features?

<– Score

48. How are java software developers using the eclipse ide?

<– Score

49. Are all requirements and trust levels for customers access defined and documented?

<– Score

50. Does the solution include full-featured reporting and decision-making modules to help your team make the most of the results?

<– Score

51. Will gaining new knowledge and understanding be more helpful than applying what you already know?

<– Score

52. How does the solution remove the key sources of issues discovered in the analyze phase?

<– Score

53. Do you use any special development tool for the mobile software developments?

<– Score

54. What do you do to optimize your applications use of RAM resources?

<– Score

55. What tools do you use during the experiment to help with the development?

<– Score

56. Does the solution deliver actionable diagnostics to help developers fix defects?

<– Score

57. Does code review improve software quality?

<– Score

58. Are tools listed that are used during development?

<– Score

59. What coding style do most developers follow?

<– Score

60. Describe the design of the pilot and what tests were conducted, if any?

<– Score

61. Does code review improve software security?

<– Score

62. Is the implementation plan designed?

<– Score

63. Does implementing code review improve software security?

<– Score

64. What aspects of your implementation pose a supportability risk?

<– Score

65. Were any criteria developed to assist the team in testing and evaluating potential solutions?

<– Score

66. How will the group know that the solution worked?

<– Score

67. How do developers and managers view technical debt?

<– Score

68. Are the best solutions selected?

<– Score

69. Do you have a documented, organization-wide program in place to manage risk?

<– Score

70. What about understanding legacy code?

<– Score

71. Do you have the optimal project management team structure?

<– Score

72. What problems do developers encounter during program comprehension?

<– Score

73. Do vendor agreements bring new compliance risk ?

<– Score

74. What tools were most useful during the improve phase?

<– Score

75. What are the software development models available?

<– Score

76. How do developers promote open source projects?

<– Score

77. Is documentation describing known issues with certain products/services available?

<– Score

78. Are issues and escalation documented?

<– Score

79. Is the optimal solution selected based on testing and analysis?

<– Score

80. What tools were used to evaluate the potential solutions?

<– Score

81. Does open source improve system security?

<– Score

82. What lessons, if any, from a pilot were incorporated into the design of the full-scale solution?

<– Score

83. Who are the Static Code Analysis decision makers?

<– Score

84. What is the team’s contingency plan for potential problems occurring in implementation?

<– Score

85. Are you satisfied regarding security matter for your developed application / services?

<– Score

86. What are the key security risks within the application?

<– Score

87. What assumptions are made about the solution and approach?

<– Score

88. What is Static Code Analysis risk?

<– Score

89. How will the team or the process owner(s) monitor the implementation plan to see that it is working as intended?

<– Score

90. What parts of the source should you document?

<– Score

91. Is there a cost/benefit analysis of optimal solution(s)?

<– Score

92. Is pilot data collected and analyzed?

<– Score

93. Is the Static Code Analysis solution sustainable?

<– Score

94. What risks would a successful attack pose to your organization?

<– Score

95. What is the development pace of web applications?

<– Score

96. Are the most efficient solutions problem-specific?

<– Score

97. Do you have any automated system to report new warnings to developers?

<– Score

98. How are administrators alerted when security risk score rises?

<– Score

99. Does the sdlc requirements or design documentation capture what would constitute a security alert?

<– Score

100. How do professional developers comprehend software?

<– Score

101. Do you apply any test attacks to check the security of your developed software?

<– Score

102. Do you understand the stakeholders needs, wants or constraints?

<– Score

103. Is there a small-scale pilot for proposed improvement(s)? What conclusions were drawn from the outcomes of a pilot?

<– Score

104. Is Static Code Analysis documentation maintained?

<– Score

105. How is software development different?

<– Score

106. Are formal methods useful for software development?

<– Score

107. How do developers navigate the code base?

<– Score

108. Are untested web applications putting your business at risk?

<– Score

109. Are procedures documented for managing Static Code Analysis risks?

<– Score

110. Are the key business and technology risks being managed?

<– Score

111. What were the underlying assumptions on the cost-benefit analysis?

<– Score

112. How do you reduce risk without killing the benefits of agility?

<– Score

113. What alternative responses are available to manage risk?

<– Score

114. How do you minimize risk of failed remediation functions?

<– Score

115. Can software that is developed in chaotic way be trusted as a high quality product?

<– Score

116. Do the developers changes align to the system-level requirements and architecture?

<– Score

117. How to evaluate meta-models for software quality?

<– Score

118. Does your cloud solution include software/provider independent restore and recovery capabilities?

<– Score

119. Can the result be written to various file-types?

<– Score

120. Can money be saved in the long run by making better decisions about paying off technical debt?

<– Score

121. What are the effects on product development of identifying and managing technical debt?

<– Score

122. What resources are required for the improvement efforts?

<– Score

123. What is one of the biggest bang-for-the-buck actions that your organization can take to improve cybersecurity posture?

<– Score

124. Can all programmers improve code?

<– Score

125. How effective are developers at security code review?

<– Score

126. Are risk management tasks balanced centrally and locally?

<– Score

127. Who will be responsible for making the decisions to include or exclude requested changes once Static Code Analysis is underway?

<– Score

128. How much variation is there between developers?

<– Score

129. What is a bad evaluation method for your organization?

<– Score

130. Who manages supplier risk management in your organization?

<– Score

131. How easy is it to integrate your solution with open source solutions?

<– Score

132. Do you have documented ownership for each stage of the lifecycle of encryption keys?

<– Score

133. Do developers read compiler error messages?

<– Score

134. Does using automated code review services improve software quality?

<– Score

135. How do you provide feedback to developers on coding styles or feature implementation?

<– Score

136. How is knowledge sharing about risk management improved?

<– Score

137. What error proofing will be done to address some of the discrepancies observed in the ‘as is’ process?

<– Score

138. What if developers ignore violations?

<– Score

139. Are developers encouraged to develop secure code?

<– Score

140. Does implementing code review improve software quality?

<– Score

Add up total points for this section: _____ = Total points for this section

Divided by: ______ (number of statements answered) = ______ Average score for this section

Transfer your score to the Static Code Analysis Index at the beginning of the Self-Assessment.

CRITERION #6: CONTROL:

INTENT: Implement the practical solution. Maintain the performance and correct possible complications.

In my belief, the answer to this question is clearly defined:

5 Strongly Agree

4 Agree

3 Neutral

2 Disagree

1 Strongly Disagree

1. Is a response plan in place for when the input, process, or output measures indicate an ‘out-of-control’ condition?

<– Score

2. Is there documentation that will support the successful operation of the improvement?

<– Score

3. Is the language of the program control flow graph contained in the language of the specification?

<– Score

4. Are new process steps, standards, and documentation ingrained into normal operations?

<– Score

5. Is a response plan established and deployed?

<– Score

6. What does it mean to scale an element?

<– Score

7. Do you share your business continuity and redundancy plans with your tenants?

<– Score

8. Is there a control plan in place for sustaining improvements (short and long-term)?

<– Score

9. How will the process owner and team be able to hold the gains?

<– Score

10. Will any special training be provided for results interpretation?

<– Score

11. How does the provider monitor applications?

<– Score

12. Will existing staff require re-training, for example, to learn new business processes?

<– Score

13. Will you receive a hint from version control?

<– Score

14. Does job training on the documented procedures need to be part of the process team’s education and training?

<– Score

15. Is design appropriate / policies & standards compliant?

<– Score

16. Is your organization planning to build a data warehouse or BI solution?

<– Score

17. What are the critical parameters to watch?

<– Score

18. How will the process owner verify improvement in present and future sigma levels, process capabilities?

<– Score

19. What is the control/monitoring plan?

<– Score

20. How will the day-to-day responsibilities for monitoring and continual improvement be transferred from the improvement team to the process owner?

<– Score

21. Is there a documented and implemented monitoring plan?

<– Score

22. Has the Static Code Analysis value of standards been quantified?

<– Score

23. Is there a standardized process?

<– Score

24. Has the team learned the fundamentals of build automation scripting?

<– Score

25. Does the team perform architecture and design analysis to compare as-planned to as-built designs?

<– Score

26. How accurate is the resulting application depending on the machine learning algorithm used?

<– Score

27. How will input, process, and output variables be checked to detect for sub-optimal conditions?

<– Score

28. Is code up to quality standards?

<– Score

29. Which software is available for teaching and learning?

<– Score

30. Does the response plan contain a definite closed loop continual improvement scheme (e.g., plan-do-check-act)?

<– Score

31. Are documented procedures clear and easy to follow for the operators?

<– Score

32. Are suggested corrective/restorative actions indicated on the response plan for known causes to problems that might surface?

<– Score

33. Are there any established standards for implementing Privacy by Design?

<– Score

34. Are you looking at a cost reduction tool for the testing labs to test existing standards?

<– Score

35. Is the source code under version control?

<– Score

36. Does the system incorporate a flexible logging solution to monitor and diagnose the system?

<– Score

37. Has the improved process and its steps been standardized?

<– Score

38. Does a troubleshooting guide exist or is it needed?

<– Score

39. Where inside the application do you inject the monitors?

<– Score

40. What are the features needed by the machine learner and which learner fits best to the problem?

<– Score

41. Is your privacy policy aligned with industry standards?

<– Score

42. Is there a transfer of ownership and knowledge to process owner and process team tasked with the responsibilities.

<– Score

43. Is knowledge gained on process shared and institutionalized?

<– Score

44. Who is the Static Code Analysis process owner?

<– Score

45. How will report readings be checked to effectively monitor performance?

<– Score

46. Which pieces of input to the program can an attacker control?

<– Score

47. Do the viable solutions scale to future needs?

<– Score

48. Does the team use a tool to help everyone comply with coding standards?

<– Score

49. Does the tool run on a standard system for the machines supported?

<– Score

50. What is the recommended frequency of auditing?

<– Score

51. Do you determine the monitor resolution that most users will have?

<– Score

52. How might the group capture best practices and lessons learned so as to leverage improvements?

<– Score

53. What should the next improvement project be that is related to Static Code Analysis?

<– Score

54. What are your results for key measures or indicators of the accomplishment of your Static Code Analysis strategy and action plans, including building and strengthening core competencies?

<– Score

55. Are the monitoring analysis and full analysis performed together or separately?

<– Score

56. Have new or revised work instructions resulted?

<– Score

57. Does the vendor monitor, administer or manage the computers that store or process your data?

<– Score

58. What quality tools were useful in the control phase?

<– Score

59. What other areas of the group might benefit from the Static Code Analysis team’s improvements, knowledge, and learning?

<– Score

60. Are there documented procedures?

<– Score

61. What other systems, operations, processes, and infrastructures (hiring practices, staffing, training, incentives/rewards, metrics/dashboards/scorecards, etc.) need updates, additions, changes, or deletions in order to facilitate knowledge transfer and improvements?

<– Score

62. Is reporting being used or needed?

<– Score

63. Is there a recommended audit plan for routine surveillance inspections of Static Code Analysis’s gains?

<– Score

64. Is the complexity of the code under control?

<– Score

65. Does the service provider allow customers to implement your organization continuity plan?

<– Score

66. Are operating procedures consistent?

<– Score

67. What lessons learned from prior implementations of your system do you provide around staffing?

<– Score

68. Do you disclose which controls, standards, certifications and/or regulations you comply with?

<– Score

69. Does the Static Code Analysis performance meet the customer’s requirements?

<– Score

70. Is new knowledge gained imbedded in the response plan?

<– Score

71. What key inputs and outputs are being measured on an ongoing basis?

<– Score

72. Are you following coding standards?

<– Score

73. Can traditional web application security controls fit in a disruptive DevOps environment?

<– Score

74. Are the Static Code Analysis standards challenging?

<– Score

75. How will new or emerging customer needs/requirements be checked/communicated to orient the process toward meeting the new specifications and continually reducing variation?

<– Score

Add up total points for this section: _____ = Total points for this section

Divided by: ______ (number of statements answered) = ______ Average score for this section

Transfer your score to the Static Code Analysis Index at the beginning of the Self-Assessment.

CRITERION #7: SUSTAIN:

INTENT: Retain the benefits.

In my belief, the answer to this question is clearly defined:

5 Strongly Agree

4 Agree

3 Neutral

2 Disagree

1 Strongly Disagree

1. What are supply chain considerations?

<– Score

2. What other tools integrate well with them?

<– Score

3. What is your organization-of-the-art of concurrent software testing in shared memory systems?

<– Score

4. How will the code metrics on both implementations differ?

<– Score

5. Can the system accommodate updating left hand to left-handed and right hand to right-handed?

<– Score

6. Does the team write test helper classes to promote reuse?

<– Score

7. Are there unique roles in the application?

<– Score

8. What automated testing tools do you use?

<– Score

9. Which division do you work - Production or Validation?

<– Score

10. Is the program intended to be run with privileges?

<– Score

11. Do you regularly participate in code reviews?

<– Score

12. How many defects are in your code?

<– Score

13. How frequently do you perform network and server vulnerability scans?

<– Score

14. What is your experience with reusing your own code?

<– Score

15. How to compare or benchmark tools?

<– Score

16. Is open source really more secure?

<– Score

17. Are there any useful tool building patterns for software engineering tools?

<– Score

18. Does the sinks parameters contain sources?

<– Score

19. Which is a Web browser most likely to display?

<– Score

20. Is this application usable for the user?

<– Score

21. When, where and how to use automated tools?

<– Score

22. How do you declare a namespace in JavaScript?

<– Score

23. Who is responsible for end-to-end system performance?

<– Score

24. Does the value of variable x depend on the program input?

<– Score

25. What management practices and tools are used in industry to deal with debt?

<– Score

26. How internally complex is the average file in your system?

<– Score

27. Does your team members/resources provide you with more information?

<– Score

28. Where does each team perform most of work and how often do multiple teams have to work on the same service or module?

<– Score

29. How important is this application to the enterprise?

<– Score

30. Is the software acceptable or insufficient?

<– Score

31. What is the System Workload Mix?

<– Score

32. Does the service provider organization have long term sustainability potential?

<– Score

33. Do you find a shared vocabulary used by all team members?

<– Score

34. Is your application going to be faster?

<– Score

35. How do you test your source code?

<– Score

36. What code do you expect to get and what does it do?

<– Score

37. How can a readability checker be integrated into the workflow?

<– Score

38. How much does your organization presently spend on dynamic testing versus static testing?

<– Score

39. Are complex structures employed in the code?

<– Score

40. What are the goals and objectives of the business?

<– Score

41. Are you just starting your SharePoint project?

<– Score

42. When should you use the section tag versus another type of element?

<– Score

43. Are field calibration procedures for sampling equipment specified (as applicable)?

<– Score

44. Does security training really make a difference?

<– Score

45. Do you utilize any third-party/open source/proprietary frameworks to manage encryption keys?

<– Score

46. Is one variable name used to represent different logical or physical entities in the program?

<– Score

47. Who else should you help?

<– Score

48. Are parts of the team vocabulary used only temporarily?

<– Score

49. What type of applications are to be tested?

<– Score

50. How is the software vetted to ensure it is free of vulnerabilities?

<– Score

51. Is the software elegant or is it ugly?

<– Score

52. Is the application internal or external facing?

<– Score

53. Do you use any less popular or newer backend storage system?

<– Score

54. Did the concept of Technical Debt become clear for you?

<– Score

55. Why does code have vulnerabilities?

<– Score

56. How does it fit into your organization?

<– Score

57. Will the trend towards open source software in areas other than the operating system continue?

<– Score

58. How to effectively manage Technical Debt in an Agile project?

<– Score

59. Do you have an internal audit program that allows for cross-functional audit of assessments?

<– Score

60. What symbol is declared at the specific location in the source?

<– Score

61. Did you obtain all stakeholder approvals?

<– Score

62. Does the design handle sessions securely?

<– Score

63. Do you find new vulnerabilities?

<– Score

64. Has every edge in the program been executed?

<– Score

65. When information truly is ubiquitous, when reach and connectivity are completely global, when computing resources are infinite, and when a whole new set of impossibilities are not only possible, but happening, what will that do to your business?

<– Score

66. How to ensure a certain level of security across the end-to-end supply chain?

<– Score

67. Which tools would return more number of potential errors?

<– Score

68. Have employees been trained in appropriate job skills?

<– Score

69. Did the image render with an offset in all of the Web browsers?

<– Score

70. Does the build script update the assembly version to tie it back to the build and revision number?

<– Score

71. What are some limiting factors in your organizations ecosystem?

<– Score

72. What is good software architecture or design?

<– Score

73. Can the schedule be done in the given time?

<– Score

74. What languages are used for each application?

<– Score

75. How can privacy by design principles be implemented in it systems?

<– Score

76. Are there unused configurations related to business logic?

<– Score

77. How do you check that the code worked correctly on the test input?

<– Score

78. What type of connectivity will most users have?

<– Score

79. How can security teams communicate also the seriousness and importance of security?

<– Score

80. What percentage of published vulnerabilities are repeats of previous mistakes?

<– Score

81. Does organization project estimation allot time for code reviews?

<– Score

82. What type of audit, log, or alert information will the provider send to the customer?

<– Score

83. Is open source software a panacea?

<– Score

84. How will your code and applications react when something has gone wrong?

<– Score

85. Is there a preference between commercial or free tools?

<– Score

86. What are the good and bad quality rules?

<– Score

87. What particular languages and paradigms are suited to build tools?

<– Score

88. Is open source more or less secure?

<– Score

89. Has the cloud provider addressed known hypervisor vulnerabilities?

<– Score

90. Is location based advertising the future of mobile marketing and mobile advertising?

<– Score

91. Does the same checker run on different languages source code?

<– Score

92. Which automatic programming system should be used?

<– Score

93. Do the teams pay off technical debt?

<– Score

94. How many professionals work in your team and how many years of experience each one has?

<– Score

95. Are there materials you would like to see added to the Web site / Tablet Application?

<– Score

96. What is your interest in using open source tools for software security?

<– Score

97. What are the concrete negative effects of technical debt on software quality?

<– Score

98. Is the static structure comprehensible?

<– Score

99. Does the application use roles or profiles?

<– Score

100. Why do something statically when you can manage it more easily on the fly?

<– Score

101. Which types of applications use Web Workers?

<– Score

102. What one word do you want to own in the minds of your customers, employees, and partners?

<– Score

103. How much effort goes into setting up automated continuous security testing?

<– Score

104. What will be the total number of providers connected to the system?

<– Score

105. How do the Approaches Provide Instructional Feedback?

<– Score

106. What, exactly, is software plagiarism?

<– Score

107. Which do you use to show and hide elements in a JavaScript program?

<– Score

108. How do you know your code is secure?

<– Score

109. What is your formula for success in Static Code Analysis ?

<– Score

110. What is wrong with the current approach to software security?

<– Score

111. What language are each of the five applications written in?

<– Score

112. What aspect or aspects of the workbench did you find most disruptive to your workflow?

<– Score

113. How much duplicate code was added last week?

<– Score

114. How big is duplication of code in current code base?

<– Score

115. How do you protect your users, regardless where they are located, from an evolving threat landscape?

<– Score

116. What areas of the application will likely attract the attention of an attacker?

<– Score

117. What is the main objective of a specific review (meeting)?

<– Score

118. What cloud resources does a user have access to?

<– Score

119. How do you effectively manage new types of devices and your mobile/remote users?

<– Score

120. How long does it take to fix a vulnerability?

<– Score

121. Do you support test automation on the mainframe?

<– Score

122. Where are the application properties/configuration parameters stored?

<– Score

123. What is the practice of code review at Google?

<– Score

124. Does the review address the availability of adequate tests?

<– Score

125. Why does cryptographic software fail?

<– Score

126. Which technologies do you suggest your organization explore?

<– Score

127. What are current Static Code Analysis paradigms?

<– Score

128. What about the kinds of vulnerabilities that web scanners simply cannot detect?

<– Score

129. What programming language(s) do you use during the experiment?

<– Score

130. Who does what during a code review?

<– Score

131. What are the topics you research?

<– Score

132. What is your organization security scheme?

<– Score

133. Did that ids alert hit a system that was actually vulnerable?

<– Score

134. Does the application rely on client side validation?

<– Score

135. Do you restrict physical access to information assets and functions by users and support personnel?

<– Score

136. Does the team avoid writing more than one line of test action in the test method?

<– Score

137. Does the program terminate on every input?

<– Score

138. Which code fragment do you prefer?

<– Score

139. Is the team able to extend the build automation scripts by using task libraries?

<– Score

140. How do you choose the program inputs?

<– Score

141. Will users enter the email address themselves or choose it from a select list?

<– Score

142. Is the code reviewer knowledgeable about the domain knowledge of the code that is being reviewed?

<– Score

143. Have you paid any technical debt item?

<– Score

144. Does the system have the desired structure?

<– Score

145. Do you get customer source code?

<– Score

146. Are there guidelines for using methods?

<– Score

147. Why does some new piece of code break an existing test?

<– Score

148. How much of your business logic code is tested?

<– Score

149. Do you feel bad about defects in your code?

<– Score

150. How important are the given quality report properties?

<– Score

151. Can an attacker completely take over and manipulate the system?

<– Score

152. Does the software give sensible error messages?

<– Score

153. Did the animation occur in all of the Web browsers?

<– Score

154. Is it externally facing or internal to trusted users?

<– Score

155. Are all requested assessment tools in production today?

<– Score

156. Does the configuration get applied to all files and users?

<– Score

157. Do you integrate with a build management system?

<– Score

158. Where does your traditional model fail?

<– Score

159. Is programming your primary job?

<– Score

160. What does this really tell you about the test coverage of system as a whole?

<– Score

161. What is the preliminary project schedule and budget?

<– Score

162. What makes an application a candidate for automation?

<– Score

163. What are the application features?

<– Score

164. How is this system or application put together?

<– Score

165. Why does code get repeated again and again?

<– Score

166. Where does the application host sit?

<– Score

167. Which continuous integration or continuous delivery tools do you support?

<– Score

168. Do you have automation, and its slow and flaky?

<– Score

169. How would using the vendors cloud infrastructure weaken your organizations existing network security posture?

<– Score

170. What is the Application Workload Mix of each application component?

<– Score

171. Are user inputs used to directly reference business logic?

<– Score

172. How can others gain expertise in your specialty?

<– Score

173. Is it possible to ensure traceability between defects and design artifacts?

<– Score

174. Do you find the new code fixes useful?

<– Score

175. What is source code and why is it guaranteed to be always important?

<– Score

176. What other criteria would you like to have on Query specification screen for Hot Spot Review?

<– Score

177. Who added code line X, when and why?

<– Score

178. Where are other similar pieces of code?

<– Score

179. What resources does the application protect?

<– Score

180. How does a workforce introduce the security skills to implement a secure code review methodology?

<– Score

181. What does the team do about quality?

<– Score

182. Are appropriate maintenance and decontamination procedures specified for each piece of sampling equipment?

<– Score

183. Are the validation tools comparable?

<– Score

184. How good are you at programming?

<– Score

185. Does the code review address the functional correctness of the code?

<– Score

186. Does the tool provide for any code generation?

<– Score

187. How will you know when your systems are secured?

<– Score

188. Can updates made to critical source code be tracked, and can previous versions of code be reproduced (either via the source code register or other robust means)?

<– Score

189. How specifically would you write the better code?

<– Score

190. What challenges do you face when using GNU Make to build and unit test your code?

<– Score

191. Is the team able to find and address all inappropriate duplication of source code?

<– Score

192. What happens when a new employee joins the organization?

<– Score

193. What is the relation between observability metrics and the mutation score?

<– Score

194. Where are the weaknesses in your system that the COTS items introduce?

<– Score

195. When was the last time that you had a security briefing?

<– Score

196. Is there any evidence that having the technical debt items visible has any influence on the team?

<– Score

197. How would you use JavaScript to hide an advisory paragraph?

<– Score

198. How are electronic and credit card payments handled in the system?

<– Score

199. Do p and q point to disjoint structures in the heap?

<– Score

200. How should the code react when unanticipated situations arise?

<– Score

201. Is the applications environment trusted?

<– Score

202. What is the ratio of size of the watermark that can be embedded to the size of the program?

<– Score

203. Does the team avoid explicit typing of local variables in test code?

<– Score

204. Are there web services within the application?

<– Score

205. Is the functional programming paradigm suitable for embedded/real time systems?

<– Score

206. What to look for when performing a code review?

<– Score

207. Do you have all of the facts?

<– Score

208. Are all vulnerabilities the same severity?

<– Score

209. How often do you reuse code from your own experiments on average?

<– Score

210. Have you looked at your source code lately?

<– Score

211. Is the software straightforward to use or is it cumbersome?

<– Score

212. Does the code change modify the attack surface?

<– Score

213. What are the motivations for code review at Google?

<– Score

214. Is there a piece of code used repetitively?

<– Score

215. What kind of security threats mobile services or software could face?

<– Score

216. What is the purpose of packaging an application?

<– Score

217. Can an attacker crash the system?

<– Score

218. What coding style is the team currently following?

<– Score

219. How does Javascript make an application dynamic and interactive?

<– Score

220. How much time is this team working together?

<– Score

221. What parts of the code are left in the wild?

<– Score

222. Is the program designed to fail gracefully?

<– Score

223. How many paths are in a program?

<– Score

224. Is open source software about innovation?

<– Score

225. Does the application support password expiration?

<– Score

226. What tools are readily available?

<– Score

227. Does the team profile the systems performance on a regular basis?

<– Score

228. How do you maintain certified status in the age of ICS vulnerabilities?

<– Score

229. What are your experiences when reusing code from other researchers?

<– Score

230. Do you use the tools more effectively and efficiently?

<– Score

231. Are there apis and services associated with the application?

<– Score

232. Does your application exhibit any symptoms?

<– Score

233. How do you refine the design to remove threats?

<– Score

234. Has the security design been implemented correctly in the application components?

<– Score

235. Is the team focused on writing maintainable test code?

<– Score

236. What is the current software inventory of your corporate assets?

<– Score

237. Are you using a less popular framework which provides user input to the application?

<– Score

238. What is the purpose of Static Code Analysis in relation to the mission?

<– Score

239. What is the basic architecture of each application?

<– Score

240. How deep into the infrastructure can a threat agent go?

<– Score

241. Are there any pros/cons you want to point out?

<– Score

242. What are your past experiences with the open source world as a user and as a contributor?

<– Score

243. Does the system track how many failed login attempts a user has experienced?

<– Score

244. Which names a valid JavaScript variable?

<– Score

245. Where will the application reside?

<– Score

246. Is it possible to ensure traceability between defects and design?

<– Score

247. Can the security code review be conducted remotely?

<– Score

248. How does the quality of client-side code change over time?

<– Score

249. What exactly are you able to make the application do?

<– Score

250. Can you do all this work?

<– Score

251. How often do you release new versions or update the software?

<– Score

252. Are current approaches sufficient for measuring software quality?

<– Score

253. Are there any mandates for measuring code coverage of known attack surfaces?

<– Score

254. Is the code being integrated into the project fully vetted by IT management and approved?

<– Score

255. What security tools and/or services do you as your organization currently own/use?

<– Score

256. Where do you typically work when you generate Protected Information?

<– Score

257. What are the consequences of this system failing?

<– Score

258. What do mobile App users complain about?

<– Score

259. How much influence should network inputs have on a program?

<– Score

260. Is the code coverage increasing?

<– Score

261. How much of your code do you actually use?

<– Score

262. What are you challenging?

<– Score

263. Is your team at the top of its game?

<– Score

264. What will be the consequences to the stakeholder (financial, reputation etc) if Static Code Analysis does not go ahead or fails to deliver the objectives?

<– Score

265. Does less dynamic testing mean less quality?

<– Score

266. How do you effectively detect bot malware characteristics in Android apps?

<– Score

267. What types of defects are really discovered in code reviews?

<– Score

268. Do you think there are aspects that are missing in this model?

<– Score

269. When should a test be automated?

<– Score

270. How is it that cybersecurity spending is increasing and breaches are still happening?

<– Score

271. Where do you get the code to assess?

<– Score

272. What if you want to switch to another model?

<– Score

273. Can the application automatically change its logging level to react to security threats?

<– Score

274. Does the source code register record a time stamped log of all access and modification made to source code?

<– Score

275. Is there any software out there that is going to be able to check that kind of source code?

<– Score

276. What is the return-on-investment of Agile methods?

<– Score

277. Will the teams pay off some technical debt?

<– Score

278. What do practical tools look like?

<– Score

279. What type of defects lead to security vulnerabilities?

<– Score

280. What language do people write code in?

<– Score

281. Are there some parts of this program that always are executed together?

<– Score

282. Does the team use only one mock object within a test method when testing interaction?

<– Score

283. What tools do you use to model threats to the application?

<– Score

284. Has the team adopted an effective naming convention for test code?

<– Score

285. What are you all doing to address application security concerns in your organization?

<– Score

286. How can software support be integrated into employees workflow?

<– Score

287. What happens when you start minimizing threats from system and application bugs?

<– Score

288. What is essential to test automation design?

<– Score

289. Is clean code more important than efficient code?

<– Score

290. Do bugs foreshadow vulnerabilities?

<– Score

291. Are parts of the team vocabulary used only by team individuals?

<– Score

292. Is there a piece of program code used repetitively?

<– Score

293. Why is it important to continuously and frequently adapt software in the production environment?

<– Score

294. What is your specialty in cybersecurity?

<– Score

295. Does your organization provide the list of different user types who will be accessing the system?

<– Score

296. Does this software satisfy all situations?

<– Score

297. Are you missing Static Code Analysis opportunities?

<– Score

298. Is the team able to profile the systems performance?

<– Score

299. What system/application availability and response time will your proposed system meet?

<– Score

300. Does users perception of trust varies with age?

<– Score

301. Do you know about and use the technical debt concept?

<– Score

302. Does your team subscribe to rules or policies for conducting code reviews?

<– Score

303. What goes into an application test?

<– Score

304. How does program size affect the effectiveness of code coverage tools?

<– Score

305. Is the component giving dependencies too much trust?

<– Score

306. Which property does JavaScript use to update the content of HTML elements?

<– Score

307. What if it is your organization that is at stake?

<– Score

308. How difficult is it for an individual with a computer science background to use the tool?

<– Score

309. Are there secrets or critical IP embedded in the code?

<– Score

310. What will you try with your own team?

<– Score

311. Do bad smells indicate trouble in code?

<– Score

312. Does the team write test code as short test methods?

<– Score

313. What would happen if your organization cut its security budget in half?

<– Score

314. Do you use any tools to automatically test the security of your application?

<– Score

315. Do many eyeballs on the code make it secure?

<– Score

316. Which common coding errors apply to the code you are reviewing?

<– Score

317. Does the team use stub objects to test in isolation?

<– Score

318. Are you being fair and honest?

<– Score

319. How will a real attacker break into your organization?

<– Score

320. Are modifications to the approved methods or alternate methods fully described in the permit application and is the modified or alternate method equivalent to an approved method?

<– Score

321. Did you see that all the JavaScript is embedded after the BODY tag?

<– Score

322. Does the system under test conform to expectations?

<– Score

323. How are web assets isolated and distributed throughout the infrastructure?

<– Score

324. What is the existing Privacy by Design principles?

<– Score

325. How frequently is it possible, and on the other hand meaningful, to perform security testing?

<– Score

326. How do you use JavaScript to manipulate canvas elements?

<– Score

327. Are design patterns missing language features?

<– Score

328. What is the basic design of the application?

<– Score

329. Is the code easy to read and maintain?

<– Score

330. Can an attacker gain administration access to the system?

<– Score

331. How do you provide a safe environment -physically and emotionally?

<– Score

332. Do you have formal management expertise, and are new to agile methods?

<– Score

333. Why are web applications so vulnerable?

<– Score

334. Is the application going to be used on the Internet, intranet, or locally on individual computers?

<– Score

335. How is technical debt used in the project?

<– Score

336. Is the code itself a stated deliverable (primary) or does it generate a deliverable (secondary)?

<– Score

337. Does your application expose sensitive information via user session?

<– Score

338. Does your team have mechanisms to keep team members aware of each others reviews?

<– Score

339. What if you knew which source files were already covered by unit tests?

<– Score

340. How often do you reuse code of other researchers?

<– Score

341. How much could be lost if the module has a vulnerability introduced?

<– Score

342. How do you know how much code to put in one function before it gets too large?

<– Score

343. How do you find vulnerabilities that have slipped through the cracks?

<– Score

344. What is a feasible sequencing of reform initiatives over time?

<– Score

345. Does your program have a double free?

<– Score

346. What qualities do you believe all highly successful cybersecurity professionals share?

<– Score

347. Which is the most common way to code JavaScript with a delayed effect?

<– Score

348. Does the tool have any restrictions on the amount of code a program can contain?

<– Score

349. Is the evolving design going to work?

<– Score

350. When and which technical debt items should be paid?

<– Score

351. Can internet-based applications be engineered?

<– Score

352. How can the designed workflow be implemented with modern day web engineering practices?

<– Score

353. Are you using a technical debt list?

<– Score

354. How do you protect mobile and remote users effectively and efficiently?

<– Score

355. What are the most frequently violated rules in SharePoint?

<– Score

356. What is your software attack surface?

<– Score

357. What happens when you publish source code?

<– Score

358. How many think that quality can be effectively tested in?

<– Score

359. Does the service provider operate your organization continuity program?

<– Score

360. How is Javascript used to perform client-side entry validation?

<– Score

361. Can on-line help be accessed from within the graphics system?

<– Score

362. Who are the applications users and what are patterns and sequences of input?

<– Score

363. Are users made aware of responsibilities for maintaining a safe and secure working environment?

<– Score

364. Are there guidelines for using tools?

<– Score

365. Is the code dependable and secure?

<– Score

366. How do you use JavaScript to update the user interface?

<– Score

367. What to do with vulnerabilities besides fixing them?

<– Score

368. Does talking about the software bring forth bliss or upset?

<– Score

369. Is the software being built with predictability or irregularity?

<– Score

370. Is your basic point _____ or _____?

<– Score

371. Does the app use vulnerable APIs or attributes to display information?

<– Score

372. What parts of your apps are loved by users?

<– Score

373. What is software engineering excellence?

<– Score

374. What is the application state just before an exception is thrown?

<– Score

375. What fraction of the vulnerabilities do you expect to be found by a single security reviewer?

<– Score

Add up total points for this section: _____ = Total points for this section

Divided by: ______ (number of statements answered) = ______ Average score for this section

Transfer your score to the Static Code Analysis Index at the beginning of the Self-Assessment.

Static Code Analysis and Managing Projects, Criteria for Project Managers:

1.0 Initiating Process Group: Static Code Analysis

1. Establishment of pm office?

2. Which of six sigmas dmaic phases focuses on the measurement of internal process that affect factors that are critical to quality?

3. What were the challenges that you encountered during the execution of a previous Static Code Analysis project that you would not want to repeat?

4. What are the constraints?

5. The Static Code Analysis project you are managing has nine stakeholders. How many channel of communications are there between corresponding stakeholders?

6. How well did you do?

7. Which six sigma dmaic phase focuses on why and how defects and errors occur?

8. When must it be done?

9. If the risk event occurs, what will you do?

10. How is each deliverable reviewed, verified, and validated?

11. Who is behind the Static Code Analysis project?

12. At which stage, in a typical Static Code Analysis project do stake holders have maximum influence?

13. Realistic - are the desired results expressed in a way that the team will be motivated and believe that the required level of involvement will be obtained?

14. In which Static Code Analysis project management process group is the detailed Static Code Analysis project budget created?

15. Who are the Static Code Analysis project stakeholders?

16. Have requirements been tested, approved, and fulfill the Static Code Analysis project scope?

17. What were things that you need to improve?

18. Have the stakeholders identified all individual requirements pertaining to business process?

19. When are the deliverables to be generated in each phase?

20. Are stakeholders properly informed about the status of the Static Code Analysis project?

1.1 Project Charter: Static Code Analysis

21. What ideas do you have for initial tests of change (PDSA cycles)?

22. Static Code Analysis project background: what is the primary motivation for this Static Code Analysis project?

23. What is the most common tool for helping define the detail?

24. Major high-level milestone targets: what events measure progress?

25. What barriers do you predict to your success?

26. Where does all this information come from?

27. How will you know a change is an improvement?

28. Customer benefits: what customer requirements does this Static Code Analysis project address?

29. How are Static Code Analysis projects different from operations?

30. Static Code Analysis project deliverables: what is the Static Code Analysis project going to produce?

31. Did your Static Code Analysis project ask for this?

32. What is the justification?

33. What metrics could you look at?

34. Is it an improvement over existing products?

35. What are the deliverables?

36. For whom?

37. Will this replace an existing product?

38. Environmental stewardship and sustainability considerations: what is the process that will be used to ensure compliance with the environmental stewardship policy?

39. What are the assigned resources?

40. Where and how does the team fit within your organization structure?

1.2 Stakeholder Register: Static Code Analysis

41. Who wants to talk about Security?

42. How should employers make voices heard?

43. What are the major Static Code Analysis project milestones requiring communications or providing communications opportunities?

44. What opportunities exist to provide communications?

45. How big is the gap?

46. Who is managing stakeholder engagement?

47. What is the power of the stakeholder?

48. Who are the stakeholders?

49. Is your organization ready for change?

50. What & Why?

51. How much influence do they have on the Static Code Analysis project?

52. How will reports be created?

1.3 Stakeholder Analysis Matrix: Static Code Analysis

53. Experience, knowledge, data?

54. Marketing - reach, distribution, awareness?

55. Who has been involved in the area (thematic or geographic) in the past?

56. Competitive advantages?

57. Tactics: eg, surprise, major contracts?

58. Where are the good opportunities facing your organizations development?

59. What is social & public accountability ?

60. Reliability of data, plan predictability?

61. How to measure the achievement of the Development Objective?

62. What do your organizations stakeholders do better than anyone else?

63. Would it be fair to say that cost is a controlling criteria?

64. Has there been a similar initiative in the region?

65. Own known vulnerabilities?

66. Who will promote/support the Static Code Analysis project, provided that they are involved?

67. Volumes, production, economies?

68. Resources, assets, people?

69. What do people from other organizations see as your strengths?

70. What are the reimbursement requirements?

71. Financial reserves, likely returns?

72. Global influences?

2.0 Planning Process Group: Static Code Analysis

73. Is the schedule for the set products being met?

74. Are work methodologies, financial instruments, etc. shared among departments, organizations and Static Code Analysis projects?

75. How can you tell when you are done?

76. Are there efficient coordination mechanisms to avoid overloading the counterparts, participating stakeholders?

77. When developing the estimates for Static Code Analysis project phases, you choose to add the individual estimates for the activities that comprise each phase. What type of estimation method are you using?

78. Have operating capacities been created and/or reinforced in partners?

79. How many days can task X be late in starting without affecting the Static Code Analysis project completion date?

80. Are you just doing busywork to pass the time?

81. What are the different approaches to building the WBS?

82. What will you do to minimize the impact should a risk event occur?

83. To what extent has the intervention strategy been adapted to the areas of intervention in which it is being implemented?

84. What types of differentiated effects are resulting from the Static Code Analysis project and to what extent?

85. What do you need to do?

86. How well do the team follow the chosen processes?

87. What is the NEXT thing to do?

88. If action is called for, what form should it take?

89. Does it make any difference if you are successful?

90. Did you read it correctly?

91. Are the follow-up indicators relevant and do they meet the quality needed to measure the outputs and outcomes of the Static Code Analysis project?

92. How are it Static Code Analysis projects different?

2.1 Project Management Plan: Static Code Analysis

93. What is risk management?

94. Does the implementation plan have an appropriate division of responsibilities?

95. Is the budget realistic?

96. What worked well?

97. What went wrong?

98. Are comparable cost estimates used for comparing, screening and selecting alternative plans, and has a reasonable cost estimate been developed for the recommended plan?

99. Are calculations and results of analyzes essentially correct?

100. Is mitigation authorized or recommended?

101. Is the appropriate plan selected based on your organizations objectives and evaluation criteria expressed in Principles and Guidelines policies?

102. Who is the Static Code Analysis project Manager?

103. Why Change?

104. Development trends and opportunities. What if the positive direction and vision of your organization causes expected trends to change?

105. What are the assumptions?

106. What does management expect of PMs?

107. If the Static Code Analysis project management plan is a comprehensive document that guides you in Static Code Analysis project execution and control, then what should it NOT contain?

108. Are there non-structural buyout or relocation recommendations?

109. What goes into your Static Code Analysis project Charter?

110. What is Static Code Analysis project scope management?

2.2 Scope Management Plan: Static Code Analysis

111. Will anyone else be involved in verifying the deliverables?

112. Who is responsible for monitoring the Static Code Analysis project scope to ensure the Static Code Analysis project remains within the scope baseline?

113. Is an industry recognized mechanized support tool(s) being used for Static Code Analysis project scheduling & tracking?

114. Are software metrics formally captured, analyzed and used as a basis for other Static Code Analysis project estimates?

115. Is it possible to track all classes of Static Code Analysis project work (e.g. scheduled, un-scheduled, defect repair, etc.)?

116. Pop quiz – which are the same inputs as in scope planning?

117. Does the title convey to the reader the essence of the Static Code Analysis project?

118. Have all necessary approvals been obtained?

119. Are actuals compared against estimates to analyze and correct variances?

120. Are you spending the right amount of money for specific tasks?

121. Is there an issues management plan in place?

122. Is there a requirements change management processes in place?

123. Have external dependencies been captured in the schedule?

124. Is there a Steering Committee in place?

125. Are target dates established for each milestone deliverable?

126. Are trade-offs between accepting the risk and mitigating the risk identified?

127. Has your organization done similar tasks before?

128. Do you have funding for Static Code Analysis project and product development, implementation and on-going support?

129. Has your organization readiness assessment been conducted?

2.3 Requirements Management Plan: Static Code Analysis

130. Who has the authority to reject Static Code Analysis project requirements?

131. Did you get proper approvals?

132. If it exists, where is it housed?

133. What are you counting on?

134. Did you distinguish the scope of work the contractor(s) will be required to do?

135. Is the change control process documented?

136. Why manage requirements?

137. Are actual resources expenditures versus planned expenditures acceptable?

138. Is any organizational data being used or stored?

139. How detailed should the Static Code Analysis project get?

140. Do you have an agreed upon process for alerting the Static Code Analysis project Manager if a request for change in requirements leads to a product scope change?

141. How often will the reporting occur?

142. What is the earliest finish date for this Static Code Analysis project if it is scheduled to start on …?

143. Has the requirements team been instructed in the Change Control process?

144. Is infrastructure setup part of your Static Code Analysis project?

145. Will the Static Code Analysis project requirements become approved in writing?

146. Will the contractors involved take full responsibility?

147. Are all the stakeholders ready for the transition into the user community?

148. Will you perform a Requirements Risk assessment and develop a plan to deal with risks?

149. What are you trying to do?

2.4 Requirements Documentation: Static Code Analysis

150. What is effective documentation?

151. Is the requirement realistically testable?

152. Can you check system requirements?

153. Do your constraints stand?

154. How much testing do you need to do to prove that your system is safe?

155. The problem with gathering requirements is right there in the word gathering. What images does it conjure?

156. Is new technology needed?

157. What variations exist for a process?

158. How to document system requirements?

159. How do you know when a Requirement is accurate enough?

160. How do you get the user to tell you what they want?

161. If applicable; are there issues linked with the fact that this is an offshore Static Code Analysis project?

162. How does the proposed Static Code Analysis project contribute to the overall objectives of your organization?

163. Can the requirements be checked?

164. Do technical resources exist?

165. What are the attributes of a customer?

166. Completeness. are all functions required by the customer included?

167. Does your organization restrict technical alternatives?

168. What is the risk associated with cost and schedule?

169. Where do system and software requirements come from, what are sources?

2.5 Requirements Traceability Matrix: Static Code Analysis

170. How small is small enough?

171. What percentage of Static Code Analysis projects are producing traceability matrices between requirements and other work products?

172. What is the WBS?

173. Is there a requirements traceability process in place?

174. Why do you manage scope?

175. Will you use a Requirements Traceability Matrix?

176. Do you have a clear understanding of all subcontracts in place?

177. What are the chronologies, contingencies, consequences, criteria?

178. How will it affect the stakeholders personally in career?

179. How do you manage scope?

180. Describe the process for approving requirements so they can be added to the traceability matrix and Static Code Analysis project work can be performed. Will the Static Code Analysis project requirements become approved in writing?

181. Why use a WBS?

2.6 Project Scope Statement: Static Code Analysis

182. What are the defined meeting materials?

183. Static Code Analysis project lead, team lead, solution architect?

184. Is this process communicated to the customer and team members?

185. Did your Static Code Analysis project ask for this?

186. Has the Static Code Analysis project scope statement been reviewed as part of the baseline process?

187. Risks?

188. Was planning completed before the Static Code Analysis project was initiated?

189. Change management vs. change leadership - what is the difference?

190. Is the scope of your Static Code Analysis project well defined?

191. Why do you need to manage scope?

192. How often will scope changes be reviewed?

193. Will an issue form be in use?

194. Will all tasks resulting from issues be entered into the Static Code Analysis project Plan and tracked through the plan?

195. Is an issue management process documented and filed?

196. Are the input requirements from the team members clearly documented and communicated?

197. Will the risk documents be filed?

198. Identify how your team and you will create the Static Code Analysis project scope statement and the work breakdown structure (WBS). Document how you will create the Static Code Analysis project scope statement and WBS, and make sure you answer the following questions: In defining Static Code Analysis project scope and the WBS, will you and your Static Code Analysis project team be using methods defined by your organization, methods defined by the Static Code Analysis project management office (PMO), or other methods?

199. How will you verify the accuracy of the work of the Static Code Analysis project, and what constitutes acceptance of the deliverables?

200. Will there be a Change Control Process in place?

2.7 Assumption and Constraint Log: Static Code Analysis

201. What do you log?

202. How are new requirements or changes to requirements identified?

203. Has the approach and development strategy of the Static Code Analysis project been defined, documented and accepted by the appropriate stakeholders?

204. How many Static Code Analysis project staff does this specific process affect?

205. If it is out of compliance, should the process be amended or should the Plan be amended?

206. Diagrams and tables are included to account for complex concepts and increase overall readability?

207. What weaknesses do you have?

208. What other teams / processes would be impacted by changes to the current process, and how?

209. Is this model reasonable?

210. No superfluous information or marketing narrative?

211. Were the system requirements formally reviewed prior to initiating the design phase?

212. Does the plan conform to standards?

213. Contradictory information between document sections?

214. Does the Static Code Analysis project have a formal Static Code Analysis project Plan?

215. Contradictory information between different documents?

216. Is there documentation of system capability requirements, data requirements, environment requirements, security requirements, and computer and hardware requirements?

217. Do documented requirements exist for all critical components and areas, including technical, business, interfaces, performance, security and conversion requirements?

218. How can constraints be violated?

219. What to do at recovery?

2.8 Work Breakdown Structure: Static Code Analysis

220. When do you stop?

221. How big is a work-package?

222. When does it have to be done?

223. Why is it useful?

224. Where does it take place?

225. Can you make it?

226. Is the work breakdown structure (wbs) defined and is the scope of the Static Code Analysis project clear with assigned deliverable owners?

227. How many levels?

228. Do you need another level?

229. Who has to do it?

230. What is the probability that the Static Code Analysis project duration will exceed xx weeks?

231. Why would you develop a Work Breakdown Structure?

232. How much detail?

233. What has to be done?

234. Is it still viable?

235. How will you and your Static Code Analysis project team define the Static Code Analysis projects scope and work breakdown structure?

2.9 WBS Dictionary: Static Code Analysis

236. Appropriate work authorization documents which subdivide the contractual effort and responsibilities, within functional organizations?

237. Are the responsibilities and authorities of each of the above organizational elements or managers clearly defined?

238. Are overhead costs budgets established on a basis consistent with anticipated direct business base?

239. Evaluate the performance of operating organizations?

240. The Static Code Analysis projected business base for each period?

241. Are the overhead pools formally and adequately identified?

242. Are procedures established to prevent changes to the contract budget base other than the already stated authorized by contractual action?

243. Are retroactive changes to BCWS and BCWP prohibited except for correction of errors or for normal accounting adjustments?

244. Is future work which cannot be planned in detail subdivided to the extent practicable for budgeting and scheduling purposes?

245. Are your organizations and items of cost assigned to each pool identified?

246. Does the contractors system provide for the determination of cost variances attributable to the excess usage of material?

247. Are the wbs and organizational levels for application of the Static Code Analysis projected overhead costs identified?

248. Are meaningful indicators identified for use in measuring the status of cost and schedule performance?

249. Are authorized changes being incorporated in a timely manner?

250. Are data elements (BCWS, BCWP, and ACWP) progressively summarized from the detail level to the contract level through the CWBS?

251. Are data elements summarized through the functional organizational structure for progressively higher levels of management?

252. Identify and isolate causes of favorable and unfavorable cost and schedule variances?

253. Does the contractors system description or procedures require that the performance measurement baseline plus management reserve equal the contract budget base?

254. How detailed should a Static Code Analysis project get?

255. Are overhead cost budgets (or Static Code Analysis projections) established on a facility-wide basis at least annually for the life of the contract?

2.10 Schedule Management Plan: Static Code Analysis

256. Are Static Code Analysis project team members involved in detailed estimating and scheduling?

257. Are any non-compliance issues that exist due to your organizations practices communicated to your organization?

258. Has a quality assurance plan been developed for the Static Code Analysis project?

259. Who is responsible for estimating the activity resources?

260. Do Static Code Analysis project teams & team members report on status / activities / progress?

261. Are the predecessor and successor relationships accurate?

262. Have activity relationships and interdependencies within tasks been adequately identified?

263. Are risk oriented checklists used during risk identification?

264. Are Static Code Analysis project leaders committed to this Static Code Analysis project full time?

265. Are multiple estimation methods being employed?

266. Is the development plan and/or process documented?

267. Are changes in deliverable commitments agreed to by all affected groups & individuals?

268. Can additional resources be added to subsequent tasks to reduce the durations of the already stated tasks?

269. Are risk triggers captured?

270. Are all attributes of the activities defined, including risk and uncertainty?

271. Were Static Code Analysis project team members involved in the development of activity & task decomposition?

272. Are schedule performance measures defined including pre-set triggers for specific actions?

273. Does the Static Code Analysis project have a Statement of Work?

274. Are staff skills known and available for each task?

2.11 Activity List: Static Code Analysis

275. How difficult will it be to do specific activities on this Static Code Analysis project?

276. What went right?

277. What is the probability the Static Code Analysis project can be completed in xx weeks?

278. Is infrastructure setup part of your Static Code Analysis project?

279. What did not go as well?

280. What will be performed?

281. What are the critical bottleneck activities?

282. Are the required resources available or need to be acquired?

283. Should you include sub-activities?

284. How should ongoing costs be monitored to try to keep the Static Code Analysis project within budget?

285. What is your organizations history in doing similar activities?

286. For other activities, how much delay can be tolerated?

287. What is the total time required to complete the Static Code Analysis project if no delays occur?

288. In what sequence?

289. How will it be performed?

290. The wbs is developed as part of a joint planning session. and how do you know that youhave done this right?

291. How much slack is available in the Static Code Analysis project?

292. How detailed should a Static Code Analysis project get?

293. Where will it be performed?

2.12 Activity Attributes: Static Code Analysis

294. Why?

295. Are the required resources available?

296. Have you identified the Activity Leveling Priority code value on each activity?

297. Do you feel very comfortable with your prediction?

298. Have constraints been applied to the start and finish milestones for the phases?

299. How else could the items be grouped?

300. Were there other ways you could have organized the data to achieve similar results?

301. Can more resources be added?

302. Would you consider either of corresponding activities an outlier?

303. Time for overtime?

304. What conclusions/generalizations can you draw from this?

305. Which method produces the more accurate cost assignment?

306. How many resources do you need to complete the work scope within a limit of X number of days?

307. Activity: fair or not fair?

308. What is missing?

309. What is the general pattern here?

2.13 Milestone List: Static Code Analysis

310. When will the Static Code Analysis project be complete?

311. How difficult will it be to do specific activities on this Static Code Analysis project?

312. What are your competitors vulnerabilities?

313. It is to be a narrative text providing the crucial aspects of your Static Code Analysis project proposal answering what, who, how, when and where?

314. Do you foresee any technical risks or developmental challenges?

315. Loss of key staff?

316. Gaps in capabilities?

317. Who will manage the Static Code Analysis project on a day-to-day basis?

318. Sustaining internal capabilities?

319. Information and research?

320. Usps (unique selling points)?

321. How will the milestone be verified?

322. How do you manage time?

323. Level of the Innovation?

324. Insurmountable weaknesses?

2.14 Network Diagram: Static Code Analysis

325. What are the Major Administrative Issues?

326. Will crashing x weeks return more in benefits than it costs?

327. Are the gantt chart and/or network diagram updated periodically and used to assess the overall Static Code Analysis project timetable?

328. What job or jobs could run concurrently?

329. How difficult will it be to do specific activities on this Static Code Analysis project?

330. Where do you schedule uncertainty time?

331. What is the completion time?

332. What is the probability of completing the Static Code Analysis project in less that xx days?

333. What controls the start and finish of a job?

334. What are the tools?

335. If x is long, what would be the completion time if you break x into two parallel parts of y weeks and z weeks?

336. What can be done concurrently?

337. How confident can you be in your milestone dates and the delivery date?

338. Planning: who, how long, what to do?

339. What job or jobs precede it?

340. What job or jobs follow it?

341. What is the lowest cost to complete this Static Code Analysis project in xx weeks?

342. What activity must be completed immediately before this activity can start?

343. What must be completed before an activity can be started?

2.15 Activity Resource Requirements: Static Code Analysis

344. Which logical relationship does the PDM use most often?

345. Organizational Applicability?

346. What are constraints that you might find during the Human Resource Planning process?

347. Are there unresolved issues that need to be addressed?

348. Why do you do that?

349. When does monitoring begin?

350. Do you use tools like decomposition and rolling-wave planning to produce the activity list and other outputs?

351. How do you handle petty cash?

352. Anything else?

353. What is the Work Plan Standard?

354. Is there anything planned that does not need to be here?

355. How many signatures do you require on a check and does this match what is in your policy and procedures?

356. Other support in specific areas?

2.16 Resource Breakdown Structure: Static Code Analysis

357. Why time management?

358. Why do you do it?

359. What is each stakeholders desired outcome for the Static Code Analysis project?

360. What can you do to improve productivity?

361. What is the primary purpose of the human resource plan?

362. How should the information be delivered?

363. The list could probably go on, but, the thing that you would most like to know is, How long & How much?

364. What is the purpose of assigning and documenting responsibility?

365. What is the number one predictor of a groups productivity?

366. Who will use the system?

367. Any changes from stakeholders?

368. Who will be used as a Static Code Analysis project team member?

369. What defines a successful Static Code Analysis project?

370. What is the difference between % Complete and % work?

2.17 Activity Duration Estimates: Static Code Analysis

371. Are updates on work results collected and used as inputs to the performance reporting process?

372. Have most organizations benefited from outsourcing?

373. Static Code Analysis project has three critical paths. Which BEST describes how this affects the Static Code Analysis project?

374. Will the new application be developed using existing hardware, software, and networks?

375. Which best describes how this affects the Static Code Analysis project?

376. What type of people would you want on your team?

377. Given your research into similar classes and the work you think is required for this Static Code Analysis project, what assumptions, variables, or costs would you change from the information provided above?

378. Does a process exist to determine the potential loss or gain if risk events occur?

379. What should be done NEXT?

380. Why should Static Code Analysis project managers strive to make jobs look easy?

381. Could it have been avoided?

382. What is the BEST thing for the Static Code Analysis project manager to do?

383. What are two suggestions for ensuring adequate change control on Static Code Analysis projects that involve outside contracts?

384. Are procedures defined for calculating cost estimates?

385. Who will be the main sponsor for it?

386. What do corresponding sources say about Static Code Analysis project management?

387. Why is it important to determine activity sequencing on Static Code Analysis projects?

388. Which is the BEST thing to do to try to complete a Static Code Analysis project two days earlier?

389. Does a process exist for approving or rejecting changes?

2.18 Duration Estimating Worksheet: Static Code Analysis

390. Is a construction detail attached (to aid in explanation)?

391. Do any colleagues have experience with your organization and/or RFPs?

392. Is the Static Code Analysis project responsive to community need?

393. When does your organization expect to be able to complete it?

394. Why estimate time and cost?

395. Will the Static Code Analysis project collaborate with the local community and leverage resources?

396. Why estimate costs?

397. Done before proceeding with this activity or what can be done concurrently?

398. When do the individual activities need to start and finish?

399. When, then?

400. What is cost and Static Code Analysis project cost management?

401. Science = process: remember the scientific method?

402. How can the Static Code Analysis project be displayed graphically to better visualize the activities?

403. What utility impacts are there?

404. Does the Static Code Analysis project provide innovative ways for stakeholders to overcome obstacles or deliver better outcomes?

405. What info is needed?

406. Define the work as completely as possible. What work will be included in the Static Code Analysis project?

2.19 Project Schedule: Static Code Analysis

407. Why is this particularly bad?

408. How effectively were issues able to be resolved without impacting the Static Code Analysis project Schedule or Budget?

409. What does that mean?

410. What is the purpose of a Static Code Analysis project schedule?

411. How can you fix it?

412. How do you manage Static Code Analysis project Risk?

413. Meet requirements?

414. How do you know that youhave done this right?

415. Is infrastructure setup part of your Static Code Analysis project?

416. Are you working on the right risks?

417. How does a Static Code Analysis project get to be a year late ?

418. Are procedures defined by which the Static Code Analysis project schedule may be changed?

419. Was the Static Code Analysis project schedule reviewed by all stakeholders and formally accepted?

420. Why is software Static Code Analysis project disaster so common?

421. Did the final product meet or exceed user expectations?

422. Are key risk mitigation strategies added to the Static Code Analysis project schedule?

423. Verify that the update is accurate. Are all remaining durations correct?

424. How can you address that situation?

2.20 Cost Management Plan: Static Code Analysis

425. Are any non-compliance issues that exist due to State practices communicated to your organization?

426. Forecasts – how will the time and resources needed to complete the Static Code Analysis project be forecast?

427. Is there general agreement & acceptance of the current status and progress of the Static Code Analysis project?

428. Are meeting objectives identified for each meeting?

429. What are the nine areas of expertise?

430. Is there any form of automated support for Issues Management?

431. Are parking lot items captured?

432. Are issues raised, assessed, actioned, and resolved in a timely and efficient manner?

433. Planning and scheduling responsibilities – How will the responsibilities for planning and scheduling be allocated?

434. Weve met your goals?

435. Eac -estimate at completion, what is the total job expected to cost?

436. Is a payment system in place with proper reviews and approvals?

437. Does all Static Code Analysis project documentation reside in a common repository for easy access?

438. Best practices implementation – How will change management be applied to this Static Code Analysis project?

439. Personnel with expertise?

440. Is the steering committee active in Static Code Analysis project oversight?

441. Is the communication plan being followed?

442. What threats might prevent you from getting there?

443. Are metrics used to evaluate and manage Vendors?

444. Have lessons learned been conducted after each Static Code Analysis project release?

2.21 Activity Cost Estimates: Static Code Analysis

445. Were the tasks or work products prepared by the consultant useful?

446. How do you allocate indirect costs to activities?

447. Does the estimator have experience?

448. What do you want to know about the stay to know if costs were inappropriately high or low?

449. Who determines the quality and expertise of contractors?

450. How do you change activities?

451. Were you satisfied with the work?

452. Certification of actual expenditures?

453. Is costing method consistent with study goals?

454. Where can you get activity reports?

455. What happens if you cannot produce the documentation for the single audit?

456. What procedures are put in place regarding bidding and cost comparisons, if any?

457. How do you manage cost?

458. Did the Static Code Analysis project team have the right skills?

459. How do you do activity recasts?

460. How difficult will it be to do specific tasks on the Static Code Analysis project?

461. Maintenance Reserve?

462. How and when do you enter into Static Code Analysis project Procurement Management?

463. Which contract type places the most risk on the seller?

464. Were sponsors and decision makers available when needed outside regularly scheduled meetings?

2.22 Cost Estimating Worksheet: Static Code Analysis

465. What costs are to be estimated?

466. Value pocket identification & quantification what are value pockets?

467. Ask: are others positioned to know, are others credible, and will others cooperate?

468. Identify the timeframe necessary to monitor progress and collect data to determine how the selected measure has changed?

469. What additional Static Code Analysis project(s) could be initiated as a result of this Static Code Analysis project?

470. How will the results be shared and to whom?

471. Who is best positioned to know and assist in identifying corresponding factors?

472. What happens to any remaining funds not used?

473. What will others want?

474. Is the Static Code Analysis project responsive to community need?

475. Can a trend be established from historical performance data on the selected measure and are the criteria for using trend analysis or forecasting methods met?

476. What is the estimated labor cost today based upon this information?

477. Does the Static Code Analysis project provide innovative ways for stakeholders to overcome obstacles or deliver better outcomes?

478. Is it feasible to establish a control group arrangement?

479. Will the Static Code Analysis project collaborate with the local community and leverage resources?

480. What is the purpose of estimating?

481. What can be included?

2.23 Cost Baseline: Static Code Analysis

482. Definition of done can be traced back to the definitions of what are you providing to the customer in terms of deliverables?

483. Who will use corresponding metrics ?

484. At which frequency ?

485. Are you asking management for something as a result of this update?

486. Have all approved changes to the schedule baseline been identified and impact on the Static Code Analysis project documented?

487. Has training and knowledge transfer of the operations organization been completed?

488. What is it ?

489. For what purpose ?

490. What do you want to measure ?

491. Has the Static Code Analysis project (or Static Code Analysis project phase) been evaluated against each objective established in the product description and Integrated Static Code Analysis project Plan?

492. Is the requested change request a result of changes in other Static Code Analysis project(s)?

493. Has the Static Code Analysis projected annual cost to operate and maintain the product(s) or service(s) been approved and funded?

494. Has the actual cost of the Static Code Analysis project (or Static Code Analysis project phase) been tallied and compared to the approved budget?

495. Has the documentation relating to operation and maintenance of the product(s) or service(s) been delivered to, and accepted by, operations management?

496. What is cost and Static Code Analysis project cost management?

2.24 Quality Management Plan: Static Code Analysis

497. Does the system design reflect the requirements?

498. How is the information recorded?

499. Are there unnecessary steps that are creating bottlenecks and/or causing people to wait?

500. What is positive about the current process?

501. How do your action plans support the strategic objectives?

502. How are calibration records kept?

503. What would you gain if you spent time working to improve this process?

504. With the five whys method, the team considers why the issue being explored occurred. do others then take that initial answer and ask why?

505. Who needs a qmp?

506. Who is responsible for approving the qapp?

507. Where do you focus?

508. You know what your customers expectations are regarding this process?

509. How do you check in-coming sample material?

510. When reporting to different audiences, do you vary the form or type of report?

511. How do you field-modify testing procedures?

512. How will you know that a change is actually an improvement?

513. How do you ensure that protocols are up to date?

514. How does your organization measure customer satisfaction/dissatisfaction?

515. How is staff trained in procedures?

516. Why quality management?

2.25 Quality Metrics: Static Code Analysis

517. Is material complete (and does it meet the standards)?

518. How can the effectiveness of each of the activities be measured?

519. Did the team meet the Static Code Analysis project success criteria documented in the Quality Metrics Matrix?

520. What method of measurement do you use?

521. Who is willing to lead?

522. What are your organizations expectations for its quality Static Code Analysis project?

523. Has it met internal or external standards?

524. Was the overall quality better or worse than previous products?

525. How do you calculate such metrics?

526. How should customers provide input?

527. Are quality metrics defined?

528. How do you measure?

529. How do you communicate results and findings to upper management?

530. How do you calculate corresponding metrics?

531. What is the benchmark?

532. What if the biggest risk to your business were the already stated people who do not complain?

533. Is quality culture a competitive advantage?

534. How are requirements conflicts resolved?

535. Were number of defects identified?

2.26 Process Improvement Plan: Static Code Analysis

536. Are you following the quality standards?

537. Have the frequency of collection and the points in the process where measurements will be made been determined?

538. Are you making progress on the goals?

539. What personnel are the champions for the initiative?

540. What lessons have you learned so far?

541. Management commitment at all levels?

542. Has the time line required to move measurement results from the points of collection to databases or users been established?

543. Have the supporting tools been developed or acquired?

544. What is the return on investment?

545. What is quality and how will you ensure it?

546. Why do you want to achieve the goal?

547. Where do you want to be?

548. What makes people good SPI coaches?

549. Who should prepare the process improvement action plan?

550. Are you making progress on your improvement plan?

551. What personnel are the coaches for your initiative?

552. Has a process guide to collect the data been developed?

553. What is the test-cycle concept?

554. Does explicit definition of the measures exist?

2.27 Responsibility Assignment Matrix: Static Code Analysis

555. What travel needed?

556. What are the known stakeholder requirements?

557. Too many as: does a proper segregation of duties exist?

558. Does each activity-deliverable have exactly one Accountable responsibility, so that accountability is clear and decisions can be made quickly?

559. The anticipated business volume?

560. Are significant decision points, constraints, and interfaces identified as key milestones?

561. Budgets assigned to control accounts?

562. Who is the sponsor?

563. No rs: if a task has no one listed as responsible, who is getting the job done?

564. Does the contractors system identify work accomplishment against the schedule plan?

565. Changes in the overhead pool and/or organization structures?

566. How can this help you with team building?

567. Are the requirements for all items of overhead established by rational, traceable processes?

568. Does the contractor use objective results, design reviews and tests to trace schedule performance?

569. Most people let you know when others re too busy, and are others really too busy?

570. Static Code Analysis projected economic escalation?

571. Cwbs elements to be subcontracted, with identification of subcontractors?

572. Major functional areas of contract effort?

573. What expertise is available in your department?

2.28 Roles and Responsibilities: Static Code Analysis

574. Where are you most strong as a supervisor?

575. What are your major roles and responsibilities in the area of performance measurement and assessment?

576. Was the expectation clearly communicated?

577. Who is responsible for each task?

578. What should you do now to prepare for your career 5+ years from now?

579. Are your policies supportive of a culture of quality data?

580. Does the team have access to and ability to use data analysis tools?

581. Who is responsible for implementation activities and where will the functions, roles and responsibilities be defined?

582. Attainable / achievable: the goal is attainable; can you actually accomplish the goal?

583. Concern: where are you limited or have no authority, where you can not influence?

584. How is your work-life balance?

585. What expectations were met?

586. What expectations were NOT met?

587. Once the responsibilities are defined for the Static Code Analysis project, have the deliverables, roles and responsibilities been clearly communicated to every participant?

588. Is feedback clearly communicated and non-judgmental?

589. Are the quality assurance functions and related roles and responsibilities clearly defined?

590. Key conclusions and recommendations: Are conclusions and recommendations relevant and acceptable?

591. What specific behaviors did you observe?

592. What should you highlight for improvement?

2.29 Human Resource Management Plan: Static Code Analysis

593. Is quality monitored from the perspective of the customers needs and expectations?

594. Does all Static Code Analysis project documentation reside in a common repository for easy access?

595. Who needs training?

596. Is there a formal set of procedures supporting Issues Management?

597. Did the Static Code Analysis project team have the right skills?

598. How will the Static Code Analysis project manage expectations & meet needs and requirements?

599. Is your organization human?

600. Have Static Code Analysis project management standards and procedures been identified / established and documented?

601. Are the payment terms being followed?

602. What is the boss?

603. Is there general agreement & acceptance of the current status and progress of the Static Code Analysis project?

604. How to convince to employees that it is a necessary process?

605. Identify who is needed on the core Static Code Analysis project team to complete Static Code Analysis project deliverables and achieve its goals and objectives. What skills, knowledge and experiences are required?

606. Is the Static Code Analysis project schedule available for all Static Code Analysis project team members to review?

607. Are Static Code Analysis project team members committed fulltime?

608. Static Code Analysis project definition & scope?

609. Have process improvement efforts been completed before requirements efforts begin?

610. Are there checklists created to determine if all quality processes are followed?

611. Is there an on-going process in place to monitor Static Code Analysis project risks?

2.30 Communications Management Plan: Static Code Analysis

612. How were corresponding initiatives successful?

613. Are others part of the communications management plan?

614. Do you then often overlook a key stakeholder or stakeholder group?

615. Are there common objectives between the team and the stakeholder?

616. How much time does it take to do it?

617. How often do you engage with stakeholders?

618. Can you think of other people who might have concerns or interests?

619. What steps can you take for a positive relationship?

620. Are the stakeholders getting the information others need, are others consulted, are concerns addressed?

621. What is the stakeholders level of authority?

622. Which stakeholders can influence others?

623. Who are the members of the governing body?

624. Are you constantly rushing from meeting to meeting?

625. Are there too many who have an interest in some aspect of your work?

626. Why manage stakeholders?

627. What to know?

628. What is Static Code Analysis project communications management?

629. What help do you and your team need from the stakeholder?

2.31 Risk Management Plan: Static Code Analysis

630. Are some people working on multiple Static Code Analysis projects?

631. Why do you want risk management?

632. What are some questions that should be addressed in a risk management plan?

633. Are the reports useful and easy to read?

634. What are the chances the risk event will occur?

635. What does a risk management program do?

636. Is the process being followed?

637. For software; are compilers and code generators available and suitable for the product to be built?

638. Litigation – what is the probability that lawsuits will cause problems or delays in the Static Code Analysis project?

639. How much risk protection can you afford?

640. Does the software engineering team have the right mix of skills?

641. What can go wrong?

642. Can you stabilize dynamic risk factors?

643. How would you suggest monitoring for risk transition indicators?

644. Are flexibility and reuse paramount?

645. Could others have been better mitigated?

646. Are team members trained in the use of the tools?

647. Are you on schedule?

648. Was an original risk assessment/risk management plan completed?

2.32 Risk Register: Static Code Analysis

649. Assume the risk event or situation happens, what would the impact be?

650. Have other controls and solutions been implemented in other services which could be applied as an alternative to additional funding?

651. Who needs to know about this?

652. User involvement: do you have the right users?

653. People risk -are people with appropriate skills available to help complete the Static Code Analysis project?

654. What should you do when?

655. What risks might negatively or positively affect achieving the Static Code Analysis project objectives?

656. What are you going to do to limit the Static Code Analysis projects risk exposure due to the identified risks?

657. What is a Community Risk Register?

658. What would the impact to the Static Code Analysis project objectives be should the risk arise?

659. Does the evidence highlight any areas to advance opportunities or foster good relations. If yes what steps will be taken?

660. When is it going to be done?

661. How are risks identified?

662. Is further information required before making a decision?

663. Financial risk -can your organization afford to undertake the Static Code Analysis project?

664. Do you require further engagement?

665. Schedule impact/severity estimated range (workdays) assume the event happens, what is the potential impact?

666. Are there other alternative controls that could be implemented?

667. What should you do now?

2.33 Probability and Impact Assessment: Static Code Analysis

668. Do you use any methods to analyze risks?

669. Do the requirements require the creation of new algorithms?

670. What risks are necessary to achieve success?

671. Are end-users enthusiastically committed to the Static Code Analysis project and the system/product to be built?

672. Do end-users have realistic expectations?

673. What are the current demands of the customer?

674. Are some people working on multiple Static Code Analysis projects?

675. What is the likelihood?

676. Do you manage the process through use of metrics?

677. What should be the external organizations responsibility vis-à-vis total stake in the Static Code Analysis project?

678. Are staff committed for the duration of the Static Code Analysis project?

679. Are Static Code Analysis project requirements stable?

680. Do the people have the right combinations of skills?

681. What action do you usually take against risks?

682. How realistic is the timing of introduction?

683. How completely has the customer been identified?

684. Risk data quality assessment - what is the quality of the data used to determine or assess the risk?

685. Are formal technical reviews part of this process?

686. Has something like this been done before?

2.34 Probability and Impact Matrix: Static Code Analysis

687. How to prioritize risks?

688. Do you need a risk management plan?

689. During which risk management process is a determination to transfer a risk made?

690. What risks were tracked?

691. Is the customer technically sophisticated in the product area?

692. What are the methods to deal with risks?

693. Do you have a consistent repeatable process that is actually used?

694. What are the risks involved in appointing external agencies to manage the Static Code Analysis project?

695. Do requirements put excessive performance constraints on the product?

696. Risk categorization -which of your categories has more risk than others?

697. Is a software Static Code Analysis project management tool available?

698. How likely is the current plan to come in on schedule or on budget?

699. What did not work so well?

700. How are the local factors going to affect the absorption?

701. What can you use the analyzed risks for?

702. Is Static Code Analysis project scope stable?

703. What lifestyle shifts might occur in society?

704. Which of your Static Code Analysis projects should be selected when compared with other Static Code Analysis projects?

705. What are the chances the risk events will occur?

2.35 Risk Data Sheet: Static Code Analysis

706. What are the main opportunities available to you that you should grab while you can?

707. Has the most cost-effective solution been chosen?

708. What actions can be taken to eliminate or remove risk?

709. Are new hazards created?

710. What can happen?

711. What was measured?

712. What are you trying to achieve (Objectives)?

713. What do you know?

714. What can you do?

715. Whom do you serve (customers)?

716. Will revised controls lead to tolerable risk levels?

717. Risk of what?

718. Potential for recurrence?

719. During work activities could hazards exist?

720. What are your core values?

721. What will be the consequences if the risk happens?

722. Has a sensitivity analysis been carried out?

723. What is the likelihood of it happening?

724. Type of risk identified?

2.36 Procurement Management Plan: Static Code Analysis

725. Measurable - are the targets measurable?

726. Is there a set of procedures to capture, analyze and act on quality metrics?

727. Are the people assigned to the Static Code Analysis project sufficiently qualified?

728. Is a pmo (Static Code Analysis project management office) in place which provides oversight to the Static Code Analysis project?

729. Pareto diagrams, statistical sampling, flow charting or trend analysis used quality monitoring?

730. Are change requests logged and managed?

731. Is it possible to track all classes of Static Code Analysis project work (e.g. scheduled, un-scheduled, defect repair, etc.)?

732. Are meeting minutes captured and sent out after meetings?

733. Are decisions made in a timely manner?

734. Are the key elements of a Static Code Analysis project Charter present?

735. Financial capacity; does the seller have, or can the seller reasonably be expected to obtain, the financial resources needed?

736. What areas does the group agree are the biggest success on the Static Code Analysis project?

737. Is the steering committee active in Static Code Analysis project oversight?

738. Are the appropriate IT resources adequate to meet planned commitments?

739. Is the structure for tracking the Static Code Analysis project schedule well defined and assigned to a specific individual?

740. What are you trying to accomplish?

741. Does the detailed work plan match the complexity of tasks with the capabilities of personnel?

742. Similar Static Code Analysis projects?

2.37 Source Selection Criteria: Static Code Analysis

743. What evidence should be provided regarding proposal evaluations?

744. Are evaluators ready to begin this task?

745. How should the solicitation aspects regarding past performance be structured?

746. What aspects should the contracting officer brief the Static Code Analysis project on prior to evaluation of proposals?

747. Are responses to considerations adequate?

748. What common questions or problems are associated with debriefings?

749. How should oral presentations be evaluated?

750. Does an evaluation need to include the identification of strengths and weaknesses?

751. What are the special considerations for preaward debriefings?

752. What are open book debriefings?

753. How and when do you enter into Static Code Analysis project Procurement Management?

754. Will the technical evaluation factor unnecessarily force the acquisition into a higher-priced market segment?

755. How do you facilitate evaluation against published criteria?

756. In the technical/management area, what criteria do you use to determine the final evaluation ratings?

757. What should a DRFP include?

758. Who must be notified?

759. Are there any common areas of weaknesses or deficiencies in the proposals in the competitive range?

760. What information is to be provided and when should it be provided?

761. What are the most common types of rating systems?

762. Are resultant proposal revisions allowed?

2.38 Stakeholder Management Plan: Static Code Analysis

763. How are the overall Static Code Analysis project development processes to be undertaken to produce the Static Code Analysis project outputs?

764. Do you use diagrams and tables to account for complex concepts and increase overall readability?

765. Is there a set of procedures defining the scope, procedures, and deliverables defining quality control?

766. Do any protocols apply for records management?

767. When would you develop a Static Code Analysis project Business Plan?

768. Does the role of the Static Code Analysis project Team cease upon the delivery of the Static Code Analysis projects outputs?

769. Are Static Code Analysis project leaders committed to this Static Code Analysis project full time?

770. Who is responsible for accepting the reports produced by the process?

771. Are communication systems currently in place appropriate?

772. Does a documented Static Code Analysis project organizational policy & plan (i.e. governance model) exist?

773. Which risks pose the highest threat?

774. Are mitigation strategies identified?

775. Are action items captured and managed?

776. Why would a customer be interested in a particular product or service?

777. How accurate and complete is the information?

778. Has the business need been clearly defined?

779. Are the Static Code Analysis project team members located locally to the users/stakeholders?

2.39 Change Management Plan: Static Code Analysis

780. How do you gain sponsors buy-in to the communication plan?

781. Has the relevant business unit been notified of installation and support requirements?

782. Has a training need analysis been carried out?

783. What skills, education, knowledge, or work experiences should the resources have for each identified competency?

784. What is the negative impact of communicating too soon or too late?

785. What are the key change management success metrics?

786. What will be the preferred method of delivery?

787. Is a training information sheet available?

788. Impact of systems implementation on organization change?

789. Who might present the most resistance?

790. When does it make sense to customize?

791. How might they respond to the message and if the response may be negative or open to misinterpretation, what else needs to be said?

792. Is there a need for new relationships to be built?

793. Have the business unit contacts been briefed by the Static Code Analysis project team?

794. Do you need new systems?

795. What new competencies will be required for the roles?

796. What relationships will change?

797. What is the most positive interpretation it can receive?

3.0 Executing Process Group: Static Code Analysis

798. What is the difference between conceptual, application, and evaluative questions?

799. How can software assist in procuring goods and services?

800. How will you know you did it?

801. Are escalated issues resolved promptly?

802. Is the Static Code Analysis project performing better or worse than planned?

803. What is the product of your Static Code Analysis project?

804. Would you rate yourself as being risk-averse, risk-neutral, or risk-seeking?

805. What factors are contributing to progress or delay in the achievement of products and results?

806. How many different communication channels does the Static Code Analysis project team have?

807. How does Static Code Analysis project management relate to other disciplines?

808. What is the shortest possible time it will take to complete this Static Code Analysis project?

809. What are the critical steps involved in selecting measures and initiatives?

810. How well defined and documented were the Static Code Analysis project management processes you chose to use?

811. Does software appear easy to learn?

812. What are deliverables of your Static Code Analysis project?

813. Why should Static Code Analysis project managers strive to make jobs look easy?

3.1 Team Member Status Report: Static Code Analysis

814. What specific interest groups do you have in place?

815. Does the product, good, or service already exist within your organization?

816. How it is to be done?

817. Are the attitudes of staff regarding Static Code Analysis project work improving?

818. When a teams productivity and success depend on collaboration and the efficient flow of information, what generally fails them?

819. Does your organization have the means (staff, money, contract, etc.) to produce or to acquire the product, good, or service?

820. Does every department have to have a Static Code Analysis project Manager on staff?

821. How can you make it practical?

822. The problem with Reward & Recognition Programs is that the truly deserving people all too often get left out. How can you make it practical?

823. Is there evidence that staff is taking a more professional approach toward management of your organizations Static Code Analysis projects?

824. Are your organizations Static Code Analysis projects more successful over time?

825. What is to be done?

826. How will resource planning be done?

827. Why is it to be done?

828. Do you have an Enterprise Static Code Analysis project Management Office (EPMO)?

829. Are the products of your organizations Static Code Analysis projects meeting customers objectives?

830. Will the staff do training or is that done by a third party?

831. How much risk is involved?

832. How does this product, good, or service meet the needs of the Static Code Analysis project and your organization as a whole?

3.2 Change Request: Static Code Analysis

833. Customer acceptance plan how will the customer verify the change has been implemented successfully?

834. Why were your requested changes rejected or not made?

835. How to get changes (code) out in a timely manner?

836. Why do you want to have a change control system?

837. Have scm procedures for noting the change, recording it, and reporting it been followed?

838. Has the change been highlighted and documented in the CSCI?

839. Who is communicating the change?

840. How is the change documented (format, content, storage)?

841. How is quality being addressed on the Static Code Analysis project?

842. What is a Change Request Form?

843. What kind of information about the change request needs to be captured?

844. How are changes graded and who is responsible for the rating?

845. How many lines of code must be changed to implement the change?

846. Since there are no change requests in your Static Code Analysis project at this point, what must you have before you begin?

847. What is the relationship between requirements attributes and reliability?

848. How fast will change requests be approved?

849. What can be filed?

850. What has an inspector to inspect and to check?

851. What are the requirements for urgent changes?

3.3 Change Log: Static Code Analysis

852. How does this change affect scope?

853. Is the submitted change a new change or a modification of a previously approved change?

854. Does the suggested change request represent a desired enhancement to the products functionality?

855. Is the change request within Static Code Analysis project scope?

856. When was the request submitted?

857. Is the change backward compatible without limitations?

858. Do the described changes impact on the integrity or security of the system?

859. Is the change request open, closed or pending?

860. Is the requested change request a result of changes in other Static Code Analysis project(s)?

861. Who initiated the change request?

862. How does this change affect the timeline of the schedule?

863. Is this a mandatory replacement?

864. Does the suggested change request seem to represent a necessary enhancement to the product?

865. When was the request approved?

866. Should a more thorough impact analysis be conducted?

867. How does this relate to the standards developed for specific business processes?

868. Where do changes come from?

869. Will the Static Code Analysis project fail if the change request is not executed?

3.4 Decision Log: Static Code Analysis

870. What is your overall strategy for quality control / quality assurance procedures?

871. How effective is maintaining the log at facilitating organizational learning?

872. What eDiscovery problem or issue did your organization set out to fix or make better?

873. What makes you different or better than others companies selling the same thing?

874. How does the use a Decision Support System influence the strategies/tactics or costs?

875. Who will be given a copy of this document and where will it be kept?

876. How do you know when you are achieving it?

877. Meeting purpose; why does this team meet?

878. How does provision of information, both in terms of content and presentation, influence acceptance of alternative strategies?

879. What are the cost implications?

880. What is the average size of your matters in an applicable measurement?

881. Who is the decisionmaker?

882. At what point in time does loss become unacceptable?

883. How does an increasing emphasis on cost containment influence the strategies and tactics used?

884. Adversarial environment. is your opponent open to a non-traditional workflow, or will it likely challenge anything you do?

885. Do strategies and tactics aimed at less than full control reduce the costs of management or simply shift the cost burden?

886. How do you define success?

887. Linked to original objective?

888. Does anything need to be adjusted?

889. Decision-making process; how will the team make decisions?

3.5 Quality Audit: Static Code Analysis

890. How does your organization know that it is appropriately effective and constructive in preparing its staff for organizational aspirations?

891. How does your organization know that its quality of teaching is appropriately effective and constructive?

892. Is there any content that may be legally actionable?

893. Is the reports overall tone appropriate?

894. How does your organization know that its management of its ethical responsibilities is appropriately effective and constructive?

895. How does your organization know that its teaching activities (and staff learning) are effectively and constructively enhanced by its activities?

896. How does your organization know that the support for its staff is appropriately effective and constructive?

897. Are all staff empowered and encouraged to contribute to ongoing improvement efforts?

898. What does an analysis of your organizations staff profile suggest in terms of its planning, and how is this being addressed?

899. How does your organization know that its range of activities are being reviewed as rigorously and constructively as they could be?

900. How does your organization know that its relationships with industry and employers are appropriately effective and constructive?

901. How does your organization know that its management system is appropriately effective and constructive?

902. How does your organization know that its system for supporting staff research capability is appropriately effective and constructive?

903. How does your organization know that its system for attending to the health and wellbeing of its staff is appropriately effective and constructive?

904. How does your organization know that its relationships with other relevant organizations are appropriately effective and constructive?

905. Has a written procedure been established to identify devices during all stages of receipt, reconditioning, distribution and installation so that mix-ups are prevented?

906. Does the suppliers quality system have a written procedure for corrective action when a defect occurs?

907. Are all records associated with the reconditioning of a device maintained for a minimum of two years after the sale or disposal of the last device within a lot of merchandise?

908. How does your organization know that its staff support services planning and management systems are appropriately effective and constructive?

909. How does your organization know that its security arrangements are appropriately effective and constructive?

3.6 Team Directory: Static Code Analysis

910. Process decisions: do invoice amounts match accepted work in place?

911. Is construction on schedule?

912. Process decisions: are there any statutory or regulatory issues relevant to the timely execution of work?

913. Does a Static Code Analysis project team directory list all resources assigned to the Static Code Analysis project?

914. Process decisions: is work progressing on schedule and per contract requirements?

915. Who will talk to the customer?

916. Where will the product be used and/or delivered or built when appropriate?

917. Process decisions: are contractors adequately prosecuting the work?

918. How will the team handle changes?

919. How does the team resolve conflicts and ensure tasks are completed?

920. How will you accomplish and manage the objectives?

921. Timing: when do the effects of communication take place?

922. Why is the work necessary?

923. Who will be the stakeholders on your next Static Code Analysis project?

924. Process decisions: do job conditions warrant additional actions to collect job information and document on-site activity?

925. Process decisions: which organizational elements and which individuals will be assigned management functions?

926. Decisions: what could be done better to improve the quality of the constructed product?

927. When does information need to be distributed?

928. Where should the information be distributed?

929. Process decisions: are all start-up, turn over and close out requirements of the contract satisfied?

3.7 Team Operating Agreement: Static Code Analysis

930. Did you determine the technology methods that best match the messages to be communicated?

931. What is teaming?

932. To whom do you deliver your services?

933. Do you post meeting notes and the recording (if used) and notify participants?

934. Do team members reside in more than two countries?

935. Communication protocols: how will the team communicate?

936. Do you leverage technology engagement tools group chat, polls, screen sharing, etc.?

937. What are some potential sources of conflict among team members?

938. How will you divide work equitably?

939. Do you vary your voice pace, tone and pitch to engage participants and gain involvement?

940. Do you send out the agenda and meeting materials in advance?

941. What administrative supports will be put in place to support the team and the teams supervisor?

942. What is culture?

943. Are leadership responsibilities shared among team members (versus a single leader)?

944. Do team members need to frequently communicate as a full group to make timely decisions?

945. What resources can be provided for the team in terms of equipment, space, time for training, protected time and space for meetings, and travel allowances?

946. Must your team members rely on the expertise of other members to complete tasks?

947. What went well?

948. Do you call or email participants to ensure understanding, follow-through and commitment to the meeting outcomes?

949. Are there differences in access to communication and collaboration technology based on team member location?

3.8 Team Performance Assessment: Static Code Analysis

950. What are teams?

951. To what degree do members articulate the goals beyond the team membership?

952. To what degree are corresponding categories of skills either actually or potentially represented across the membership?

953. How do you encourage members to learn from each other?

954. To what degree do the goals specify concrete team work products?

955. What are you doing specifically to develop the leaders around you?

956. How much interpersonal friction is there in your team?

957. To what degree can team members meet frequently enough to accomplish the teams ends?

958. If you have received criticism from reviewers that your work suffered from method variance, what was the circumstance?

959. To what degree does the teams purpose contain themes that are particularly meaningful and memorable?

960. To what degree can the team measure progress against specific goals?

961. To what degree will team members, individually and collectively, commit time to help themselves and others learn and develop skills?

962. When does the medium matter?

963. What do you think is the most constructive thing that could be done now to resolve considerations and disputes about method variance?

964. To what degree do team members agree with the goals, relative importance, and the ways in which achievement will be measured?

965. How do you manage human resources?

966. Lack of method variance in self-reported affect and perceptions at work: Reality or artifact?

967. How hard do you try to make a good selection?

968. Do you give group members authority to make at least some important decisions?

969. To what degree are the relative importance and priority of the goals clear to all team members?

3.9 Team Member Performance Assessment: Static Code Analysis

970. How do you work together to improve teaching and learning?

971. To what degree do team members frequently explore the teams purpose and its implications?

972. What stakeholders must be involved in the development and oversight of the performance plan?

973. How will they be formed?

974. What are top priorities?

975. How do you use data to inform instruction and improve staff achievement?

976. Is it critical or vital to the job?

977. Why were corresponding selected?

978. What evaluation results do you have?

979. How often are assessments to be conducted?

980. What evaluation results did you have?

981. Are assessment validation activities performed?

982. Who they are?

983. To what degree are sub-teams possible or necessary?

984. How was the determination made for which training platforms would be used (i.e., media selection)?

985. What makes them effective?

986. Does adaptive training work?

987. How is assessment information achieved, stored?

988. To what extent are systems and applications (e.g., game engine, mobile device platform) utilized?

3.10 Issue Log: Static Code Analysis

989. What date was the issue resolved?

990. What are the typical contents?

991. What steps can you take for positive relationships?

992. Can an impact cause deviation beyond team, stage or Static Code Analysis project tolerances?

993. In classifying stakeholders, which approach to do so are you using?

994. Who do you turn to if you have questions?

995. In your work, how much time is spent on stakeholder identification?

996. What is the status of the issue?

997. How is this initiative related to other portfolios, programs, or Static Code Analysis projects?

998. Who is involved as you identify stakeholders?

999. How were past initiatives successful?

1000. Do you have members of your team responsible for certain stakeholders?

1001. Who needs to know and how much?

1002. Who is the issue assigned to?

1003. Which stakeholders are thought leaders, influences, or early adopters?

1004. Is there an important stakeholder who is actively opposed and will not receive messages?

4.0 Monitoring and Controlling Process Group: Static Code Analysis

1005. Is there sufficient time allotted between the general system design and the detailed system design phases?

1006. Where is the Risk in the Static Code Analysis project?

1007. How is agile program management done?

1008. How can you make your needs known?

1009. User: who wants the information and what are they interested in?

1010. What resources (both financial and non-financial) are available/needed?

1011. How is Agile Static Code Analysis project Management done?

1012. How were collaborations developed, and how are they sustained?

1013. How can you monitor progress?

1014. Is progress on outcomes due to your program?

1015. What is the expected monetary value of the Static Code Analysis project?

1016. Is there sufficient funding available for this?

1017. What good practices or successful experiences or transferable examples have been identified?

1018. Key stakeholders to work with. How many potential communications channels exist on the Static Code Analysis project?

1019. What resources are necessary?

1020. What kinds of things in particular are you looking for data on?

1021. How is agile portfolio management done?

1022. Are the necessary foundations in place to ensure the sustainability of the results of the programme?

1023. Who are the Static Code Analysis project stakeholders?

4.1 Project Performance Report: Static Code Analysis

1024. To what degree do all members feel responsible for all agreed-upon measures?

1025. To what degree does the information network communicate information relevant to the task?

1026. To what degree can team members vigorously define the teams purpose in considerations with others who are not part of the functioning team?

1027. To what degree does the teams work approach provide opportunity for members to engage in fact-based problem solving?

1028. To what degree does the information network provide individuals with the information they require?

1029. How can Static Code Analysis project sustainability be maintained?

1030. To what degree do team members articulate the teams work approach?

1031. To what degree will each member have the opportunity to advance his or her professional skills in all three of the above categories while contributing to the accomplishment of the teams purpose and goals?

1032. To what degree can the team ensure that all members are individually and jointly accountable for the teams purpose, goals, approach, and work-products?

1033. What is the PRS?

1034. To what degree are the tasks requirements reflected in the flow and storage of information?

1035. To what degree is the team cognizant of small wins to be celebrated along the way?

1036. To what degree is there a sense that only the team can succeed?

1037. To what degree are the goals ambitious?

1038. To what degree are the structures of the formal organization consistent with the behaviors in the informal organization?

1039. To what degree does the teams work approach provide opportunity for members to engage in results-based evaluation?

1040. To what degree are the demands of the task compatible with and converge with the relationships of the informal organization?

1041. What is the degree to which rules govern information exchange between individuals within your organization?

1042. To what degree do team members understand one anothers roles and skills?

1043. To what degree do individual skills and abilities match task demands?

4.2 Variance Analysis: Static Code Analysis

1044. Is budgeted cost for work performed calculated in a manner consistent with the way work is planned?

1045. Are control accounts opened and closed based on the start and completion of work contained therein?

1046. Is all contract work included in the CWBS?

1047. Is cost and schedule performance measurement done in a consistent, systematic manner?

1048. How do you manage changes in the nature of the overhead requirements?

1049. Are there changes in the overhead pool and/or organization structures?

1050. Are all budgets assigned to control accounts?

1051. Can process improvements lead to unfavorable variances?

1052. Contract line items and end items?

1053. Are all authorized tasks assigned to identified organizational elements?

1054. What is the expected future profitability of each customer?

1055. How do you identify potential or actual overruns and underruns?

1056. Does the contractors system provide unit or lot costs when applicable?

1057. How does your organization measure performance?

1058. At what point should variances be isolated and brought to the attention of the management?

1059. Are management actions taken to reduce indirect costs when there are significant adverse variances?

1060. How do you identify and isolate causes of favorable and unfavorable cost and schedule variances?

4.3 Earned Value Status: Static Code Analysis

1061. Where is evidence-based earned value in your organization reported?

1062. Where are your problem areas?

1063. How does this compare with other Static Code Analysis projects?

1064. Validation is a process of ensuring that the developed system will actually achieve the stakeholders desired outcomes; Are you building the right product? What do you validate?

1065. What is the unit of forecast value?

1066. Earned value can be used in almost any Static Code Analysis project situation and in almost any Static Code Analysis project environment. it may be used on large Static Code Analysis projects, medium sized Static Code Analysis projects, tiny Static Code Analysis projects (in cut-down form), complex and simple Static Code Analysis projects and in any market sector. some people, of course, know all about earned value, they have used it for years - but perhaps not as effectively as they could have?

1067. If earned value management (EVM) is so good in determining the true status of a Static Code Analysis project and Static Code Analysis project its completion, why is it that hardly any one uses it in information systems related Static Code Analysis projects?

1068. Verification is a process of ensuring that the developed system satisfies the stakeholders agreements and specifications; Are you building the product right? What do you verify?

1069. When is it going to finish?

1070. How much is it going to cost by the finish?

1071. Are you hitting your Static Code Analysis projects targets?

4.4 Risk Audit: Static Code Analysis

1072. Are you willing to seek legal advice when required?

1073. Tradeoff: how much risk can be tolerated and still deliver the products where they need to be?

1074. What can you do to manage outcomes?

1075. Is safety information provided to all involved?

1076. If applicable; does the software interface with new or unproven hardware or unproven vendor products?

1077. What does internal control mean in the context of the audit process?

1078. Are your rules, by-laws and practices non-discriminatory?

1079. What is the Board doing to assure measurement and improve outcomes and quality and reduce avoidable adverse events?

1080. Have permissions or required permits to use facilities managed by other parties been obtained?

1081. What effect would a better risk management program have had?

1082. Does the implementation method matter?

1083. What resources are needed to achieve program results?

1084. How do you govern assets?

1085. Are audit program plans risk-adjusted?

1086. Does your organization have a register of insurance policies detailing all current insurance policies?

1087. Why do audits fail?

1088. How do you manage risk?

1089. Does your organization have or has considered the need for insurance covers: public liability, professional indemnity and directors and officers liability?

4.5 Contractor Status Report: Static Code Analysis

1090. Are there contractual transfer concerns?

1091. Who can list a Static Code Analysis project as organization experience, your organization or a previous employee of your organization?

1092. If applicable; describe your standard schedule for new software version releases. Are new software version releases included in the standard maintenance plan?

1093. What process manages the contracts?

1094. What was the final actual cost?

1095. What was the budget or estimated cost for your organizations services?

1096. How long have you been using the services?

1097. What are the minimum and optimal bandwidth requirements for the proposed solution?

1098. How is risk transferred?

1099. What is the average response time for answering a support call?

1100. What was the overall budget or estimated cost?

1101. What was the actual budget or estimated cost for your organizations services?

1102. Describe how often regular updates are made to the proposed solution. Are corresponding regular updates included in the standard maintenance plan?

1103. How does the proposed individual meet each requirement?

4.6 Formal Acceptance: Static Code Analysis

1104. What features, practices, and processes proved to be strengths or weaknesses?

1105. Have all comments been addressed?

1106. Was the client satisfied with the Static Code Analysis project results?

1107. What function(s) does it fill or meet?

1108. Did the Static Code Analysis project manager and team act in a professional and ethical manner?

1109. Does it do what Static Code Analysis project team said it would?

1110. Do you buy pre-configured systems or build your own configuration?

1111. General estimate of the costs and times to complete the Static Code Analysis project?

1112. Was business value realized?

1113. Is formal acceptance of the Static Code Analysis project product documented and distributed?

1114. Do you perform formal acceptance or burn-in tests?

1115. Was the Static Code Analysis project work done on time, within budget, and according to specification?

1116. Was the Static Code Analysis project managed well?

1117. Who would use it?

1118. What lessons were learned about your Static Code Analysis project management methodology?

1119. What are the requirements against which to test, Who will execute?

1120. Does it do what client said it would?

1121. What is the Acceptance Management Process?

1122. What was done right?

1123. Was the Static Code Analysis project goal achieved?

5.0 Closing Process Group: Static Code Analysis

1124. What can you do better next time, and what specific actions can you take to improve?

1125. How will staff learn how to use the deliverables?

1126. What were things that you did well, and could improve, and how?

1127. What were things that you did very well and want to do the same again on the next Static Code Analysis project?

1128. Is this a follow-on to a previous Static Code Analysis project?

1129. What were the desired outcomes?

1130. How well defined and documented were the Static Code Analysis project management processes you chose to use?

1131. What was learned?

1132. How dependent is the Static Code Analysis project on other Static Code Analysis projects or work efforts?

1133. What is the amount of funding and what Static Code Analysis project phases are funded?

1134. What areas does the group agree are the biggest success on the Static Code Analysis project?

1135. Specific - is the objective clear in terms of what, how, when, and where the situation will be changed?

1136. Were cost budgets met?

1137. What communication items need improvement?

1138. Is this an updated Static Code Analysis project Proposal Document?

1139. Did the Static Code Analysis project management methodology work?

1140. Were the outcomes different from the already stated planned?

1141. What were the actual outcomes?

1142. Is the Static Code Analysis project funded?

5.1 Procurement Audit: Static Code Analysis

1143. Does your organization have an overall strategy and/or policy on public procurement, providing guidance for procuring entities?

1144. When you set social or environmental conditions for the performance of the contract, were corresponding compatible with the law and was adequate information given to the candidates?

1145. Has the department identified and described the different elements in the procurement process?

1146. Is your organization aware and informed about international procurement standards and good practice?

1147. Has it been determined which shared services the procurement function/unit should be part of?

1148. Was there a sound basis for the scorings applied to the criteria and was the scoring well balanced?

1149. Did you consider and evaluate alternatives, like bundling needs with other departments or grouping supplies in separate lots with different characteristics?

1150. Are internal control systems in place?

1151. In the set up of the system and in the award of contracts were only electronic means used?

1152. Are checks used in numeric sequence?

1153. Are trial balances taken weekly for general ledgers for all funds?

1154. How is the evaluation of contract performance organized?

1155. Was the estimated contract value in line with the final cost of the contract awarded?

1156. Are internal control mechanisms performed before payments?

1157. Were there no inconsistencies between the several tender documents?

1158. In case of decisions not to conclude a procurement or award a contract, were tenderers informed in writing and on a timely basis of the already stated decisions and grounds?

1159. Are buyers rotated so that they do not deal with the same vendors year in and year out?

1160. Are sub-criteria clearly indicated?

1161. Are bank accounts reconciled by an individual independent of the disbursement responsibilities?

1162. Are receiving reports on file for all claims for equipment, supplies and materials in the paid claims file?

5.2 Contract Close-Out: Static Code Analysis

1163. What happens to the recipient of services?

1164. Parties: who is involved?

1165. Have all contracts been completed?

1166. Change in knowledge?

1167. Have all contracts been closed?

1168. What is capture management?

1169. Change in attitude or behavior?

1170. Was the contract complete without requiring numerous changes and revisions?

1171. Have all acceptance criteria been met prior to final payment to contractors?

1172. Parties: Authorized?

1173. How/when used ?

1174. Has each contract been audited to verify acceptance and delivery?

1175. Was the contract sufficiently clear so as not to result in numerous disputes and misunderstandings?

1176. How does it work?

1177. Have all contract records been included in the Static Code Analysis project archives?

1178. Change in circumstances?

1179. Why Outsource?

1180. Was the contract type appropriate?

1181. How is the contracting office notified of the automatic contract close-out?

1182. Are the signers the authorized officials?

5.3 Project or Phase Close-Out: Static Code Analysis

1183. In addition to assessing whether the Static Code Analysis project was successful, it is equally critical to analyze why it was or was not fully successful. Are you including this?

1184. Was the schedule met?

1185. What could be done to improve the process?

1186. What are they?

1187. What are the mandatory communication needs for each stakeholder?

1188. What information did each stakeholder need to contribute to the Static Code Analysis projects success?

1189. What was expected from each stakeholder?

1190. What advantages do the an individual interview have over a group meeting, and vice-versa?

1191. Planned remaining costs?

1192. What stakeholder group needs, expectations, and interests are being met by the Static Code Analysis project?

1193. Does the lesson describe a function that would be done differently the next time?

1194. How often did each stakeholder need an update?

1195. Can the lesson learned be replicated?

1196. Which changes might a stakeholder be required to make as a result of the Static Code Analysis project?

1197. If you were the Static Code Analysis project sponsor, how would you determine which Static Code Analysis project team(s) and/or individuals deserve recognition?

1198. What are the marketing communication needs for each stakeholder?

1199. Is there a clear cause and effect between the activity and the lesson learned?

1200. What is the information level of detail required for each stakeholder?

5.4 Lessons Learned: Static Code Analysis

1201. Does the lesson educate others to improve performance?

1202. What regulatory regime controlled how your organization head and program manager directed your organization and Static Code Analysis project?

1203. How useful was the content of the training you received in preparation for the use of the product/service?

1204. What is your working hypothesis, if you have one?

1205. How clear were you on your role in the Static Code Analysis project?

1206. Where do you go from here?

1207. How well was Static Code Analysis project status communicated throughout your involvement in the Static Code Analysis project?

1208. Who had fiscal authority to manage the funding for the Static Code Analysis project, did that work?

1209. What are the Benefits of Measurements?

1210. What other questions should you have asked?

1211. Whom to share Lessons Learned Information with?

1212. Would you spend your own money to fix this issue?

1213. How clearly defined were the objectives for this Static Code Analysis project?

1214. What needs to be done over or differently?

1215. How useful do individuals find communications?

1216. How much flexibility is there in the funding (e.g., what authorities does the program manager have to change to the specifics of the funding within the overall funding ceiling)?

1217. What would you approach differently next time?

1218. What are the performance measures?

1219. Were any strategies or activities unsuccessful?

1220. What if anything has been lacking?

Index

(Index page number references Only of use in Print Version)