Quality, Accessibility & Compliance

QA Standards & Compliance

A Structured Approach to Software Quality

Software quality and compliance requirements vary by product, industry, technology, risk, and applicable regulations.

QA therefore requires more than functional checks at the end of development. Testing needs to be structured around defined quality characteristics, recognised testing practices, security requirements, and the specific conditions under which the software will operate.

At CloudRoots, our QA practices are informed by recognised software quality and testing frameworks, including ISO/IEC 25010, ISO/IEC/IEEE 29119, ISTQB principles, and established security testing practices such as the OWASP Web Security Testing Guide, where applicable.

The applicable standards and testing scope depend on the requirements governing each product.

ISO/IEC 25010

Software Product Quality

ISO/IEC 25010:2023 defines a product quality model for ICT and software products. It provides quality characteristics and sub-characteristics that can be used to specify, measure, and evaluate software quality throughout its lifecycle.

The model provides a reference for areas including:

  • Functional suitability
  • Performance efficiency
  • Compatibility
  • Interaction capability
  • Reliability
  • Security
  • Maintainability
  • Flexibility
  • Safety

For QA, these characteristics provide a broader view of software quality beyond whether individual features function as expected.

Quality evaluation considers how the product performs across its intended quality characteristics and operating conditions.

ISO/IEC/IEEE 29119

Software Testing Standards

The ISO/IEC/IEEE 29119 series defines internationally agreed standards for software testing and can be applied across different forms of software testing and development lifecycles. The series covers testing concepts, processes, documentation, and test-design techniques.

The framework covers areas including:

  • Test processes
  • Test planning
  • Test design
  • Test execution
  • Test documentation
  • Test reporting
  • Test techniques

The standard is designed to provide a common foundation for organisations performing software testing, rather than prescribing one specific development methodology.

Testing activities are therefore structured around defined objectives, processes, evidence, and outcomes.

ISTQB

Our testing practices are informed by recognised testing principles and terminology, including ISTQB.

The International Software Testing Qualifications Board (ISTQB) provides a globally recognised, vendor-neutral certification scheme for software testing professionals.

Its Certified Tester Foundation Level (CTFL) establishes common terminology and fundamental testing concepts applicable across software delivery approaches including Agile, DevOps, and Continuous Delivery.

ISTQB’s testing knowledge covers areas such as:

  • Testing fundamentals
  • Test levels and types
  • Test analysis and design
  • Defect management
  • Risk-based testing
  • Test management
  • Test automation
  • Non-functional testing

The broader ISTQB scheme also includes advanced and specialist certifications covering areas such as test automation, performance testing, security testing, usability testing, AI testing, and mobile testing.

ISTQB provides a common professional language and body of knowledge for software testing.

OWASP Web Security Testing Guide

Application Security Testing

Security is an important quality consideration for applications that process data, authentication, transactions, APIs, or other sensitive functions.

The OWASP Web Security Testing Guide (WSTG) provides a comprehensive framework of security testing practices for web applications and web services.

Its testing areas include:

  • Information gathering
  • Configuration and deployment
  • Identity management
  • Authentication
  • Authorization
  • Session management
  • Input validation
  • Error handling
  • Cryptography
  • Business logic
  • Client-side security
  • API security

OWASP also structures security testing across stages of the software lifecycle, including definition and design, development, deployment, and maintenance.

Security testing is therefore considered as part of the development lifecycle rather than only as a pre-release activity.

Industry & Regulatory Requirements

Testing Against Applicable Requirements

Software may also be subject to requirements specific to its industry, geography, technology, customers, or intended use.

Depending on the product, these may include:

  • Industry-specific security requirements
  • Data protection requirements
  • Payment and financial security requirements
  • Customer or contractual requirements
  • Internal security controls
  • Product-specific quality requirements

The applicable requirements determine what needs to be tested, what evidence needs to be maintained, and what acceptance criteria need to be met.

A testing standard and a regulatory requirement are not the same thing. Standards provide frameworks or reference practices, while regulations and contractual requirements may establish specific obligations.

Our QA Principles

  1. Standards-Aligned: Testing activities are structured with reference to applicable quality models, testing standards, professional testing practices, and product requirements.
  2. Risk-Based: Testing priorities are determined by the potential impact and likelihood of failure, with greater focus on critical functionality, sensitive data, integrations, security, and high-risk workflows.
  3. Requirements-Driven: Requirements, acceptance criteria, business rules, and expected behaviour provide the basis for defining what needs to be validated.
  4. Evidence-Based: Test conditions, expected results, actual results, defects, re-tests, and regression results provide documented evidence of testing outcomes.
  5. Continuous: Testing extends across the software lifecycle. Changes to code, integrations, configurations, and environments can introduce new risks requiring revalidation.
  6. Appropriate to Scope: Testing depth and methodology are determined by the product, technology, risk profile, industry, and applicable requirements rather than applying the same checklist to every software product.

Quality & Compliance Across the Software Lifecycle

Software quality and compliance requirements vary by product, industry, technology, and applicable regulations. Testing therefore needs to be aligned with the relevant standards, requirements, and risk controls.

CloudRoots structures QA around recognised software quality and testing frameworks, including ISO/IEC 25010, ISO/IEC/IEEE 29119, ISTQB principles, and established security testing practices such as OWASP, where applicable.

Our testing activities can cover functional quality, reliability, performance, security, compatibility, data integrity, maintainability, and other applicable quality characteristics, with documented validation and evidence supporting defined requirements.

Applicable standards may differ. The testing process remains structured, traceable, and aligned with the requirements governing the software.

Build Quality Into Every Release

Need help validating the quality, performance or accessibility of your digital product? Talk to our QA team.

Request A Quote →