Compliance_and_Agile.pdf

Transcript

1. Compliance and Agile Amsterdam secure software development meetup 1
2. 2 With Mobiquity since 2015 - Data Protection Officer and QMS Lead - Delivery / Service Management TomTom Chess Embedded Technology BT Global Services ejdavids@mobiquityinc.com https://www.linkedin.com/in/davidse/ About me “Technology is all about people” Why?
5. 5 General Data Protection Regulation “protect fundamental rights and freedoms”
6. 6 Medical Device Regulation “protect public health and patient safety” “ensuring transparency and traceability”
7. 7 GDPR “demonstrate compliance with the principles” lawfulness, fairness and transparency purpose limitation data minimisation accuracy storage limitation integrity and confidentiality appropriate technical and organisational measures to ensure a level of security appropriate to the risk
8. 8 ISO 13845 “organization needs to demonstrate its ability to provide medical devices and related services that consistently meet customer and applicable regulatory requirements”
10. 10 Manifesto for Agile Software Development ... Individuals and interactions over processes and tools Working software over comprehensive documentation Customer collaboration over contract negotiation Responding to change over following a plan That is, while there is value in the items on the right, we value the items on the left more. http://agilemanifesto.org/
11. 11 Ready! Done! ✓ Processes and tools ✓ Comprehensive documentation ✓ Contract negotiation ✓ Following a plan ✓ Agile
12. 12 DD inputs DD outputs DD review DD verification DD validation DD transfer DD change control Design and development files, Identification, Traceability, etc. ISO 13845 Design and Development Controls
13. 13 Decision Decision Decision Decision Decision Decision, Decision, Decision, Decision, Decision, Decision, Decision, Decision, Decision, Decision, Decision, Decision, Decision, Decision, Decision, Decision, Decision, Decision, Decision, Decision, ... Risk plan Risk report
14. 14 Regulatory requirements and risk treatment plans are broken down into: epics, user stories, acceptance criteria, test cases, procedures, checklists, documents, audit records, design decisions, risk logs, etc...
15. 15 COMPLIANCE IS HARD WORK BUT DISCIPLINED AGILE TEAMS CAN DO IT
16. 16 Compliance and agile • Product owner knowledge of regulations is essential • Compliance top of mind from the very start and at every major change • Budget and estimations (compliance != free) • It takes time to tango, standardization helps • Discipline and transparency! • Balance sprints per release (time to release vs. process overhead) • Experts available to the team every day Challenges and lessons learned
17. Thank you! Questions? ejdavids@mobiquityinc.com https://www.linkedin.com/in/davidse/ 17