Because there are di erent types of software (e.g., language, application, target environment, etc.), di erent software certi cation methodologies are needed. Software process improvement schemes have not taken this approach and have therefore suffered in widespread adoption as a result. Their \one approach ts all" perspective is one reason why we are now seeing more customized process improvement schemes being created (e.g., CMM-SSE and the Common Criteria are recent \newcomers" that address developing software with security requirements) and even the call to certify software professionals. This paper presents a framework for customizing certi cation methodologies according to: (1) the speci c needs of the organization requesting assurances about the software's integrity, and (2) the pecularities of that type of software. Each methodology must mirror the nuances of the type of software it was designed for. For example, certifying that a desktop plug-in will behave appr...
Jeffrey M. Voas