Measuring Software Assurance
Robert J. Ellison, William Nichols, Carol Woody · 2016
Assurance is not a specific thing that can be easily measured and monitored. It is an emerging composition of a variety of independently collected data elements that come from loosely linked software life cycle activities. As a system emerges from concept to high-level design to architecture to detailed design to code to components to implementation there is a huge amount of information that is assembled in artifacts, text, and evaluation outputs. This paper proposes a framework for making sense of these pieces to monitor and manage assurance. An example is provided to show how the framework can be applied to evaluating tainted and counterfeit products.