Overview
ISO/IEC/IEEE 41062:2019 - "Software engineering - Recommended practice for software acquisition" provides guidance on quality considerations to use during one or more steps of a software acquisition process. It is a consensus-based recommended practice (derived from IEEE Std 1062™-2015) intended for use regardless of software size, complexity, or criticality. The guidance covers acquisitions that may include commercial off‑the‑shelf (COTS/OTS) products, custom-developed solutions, free and open source software (FOSS), or software as a service (SaaS) components. Security is explicitly identified as a quality attribute to be considered during acquisition.
Key topics and recommended technical considerations
The standard focuses on selecting and applying appropriate quality considerations in the acquisition lifecycle. Key technical topics typically addressed include:
- Quality attributes & acceptance criteria - defining the non‑functional attributes (e.g., reliability, maintainability, security) that the acquired software must meet.
- Acquisition process steps - applying quality considerations at one or more phases of supplier selection, contracting, delivery, integration, and acceptance.
- Supply‑chain composition - assessing and managing combinations of COTS, custom, and FOSS components and their impact on quality and risk.
- Security as a quality attribute - embedding security requirements and evaluations into acquisition decisions.
- Supplier evaluation and contractual terms - aligning supplier responsibilities, delivery artifacts, and verification activities with quality needs.
- Tailoring and organization-specific selection - identifying which recommended practices and activities are relevant to an organization’s acquisition process.
Note: ISO/IEC/IEEE 41062 provides recommended practices rather than prescriptive mandates; users must decide which activities and quality attributes to include.
Practical applications - who uses this standard
This recommended practice is useful for:
- Acquirers and procurement teams establishing robust software acquisition policies.
- Program and project managers defining acceptance criteria and supplier oversight.
- Systems and software engineers, QA teams, and architects who must integrate purchased or third‑party software.
- Suppliers and vendors that want to align deliverables and processes with acquirer expectations.
- Organizations procuring SaaS, OTS, custom development, or solutions containing FOSS components.
Practical uses include drafting acquisition requirements, defining verification/acceptance activities, and assessing supply‑chain risks and security obligations.
Related standards and provenance
- Based on IEEE Std 1062™-2015 (Recommended Practice for Software Acquisition); adopted as ISO/IEC/IEEE 41062:2019 by JTC 1/SC 7.
- Can be used alongside lifecycle and procurement frameworks to ensure quality and security are integrated into software acquisition decisions.
Keywords: software acquisition, IEEE 1062, acquirer, supplier, COTS, OTS, FOSS, SaaS, software acquisition process, security, quality attributes.