AQAP 2210 software quality assurance

What AQAP 2210 is

AQAP 2210 is the NATO Supplementary Software Quality Assurance Requirements to AQAP 2110 or AQAP 2310. It applies when what you deliver contains software, and it exists because software fails in ways a hardware inspection regime was never designed to catch.

Supplementary is the operative word. AQAP 2210 is not a quality system in its own right and is never cited on its own. The contract names AQAP 2110 or AQAP 2310 for the quality management system, and AQAP 2210 for the software inside the deliverable. The obligations are cumulative, not alternative.

What the standard sets out to achieve

AQAP 2210 addresses both managerial and technical processes across the whole project life cycle. Its stated aims are to:

• Establish visibility of the software development process, so the customer is not asked to take it on trust.
• Detect software quality problems as early as possible in the life cycle, where they are still cheap.
• Provide quality control data in time for corrective action to actually be taken.
• Confirm that quality is engineered in during development rather than inspected in afterwards.
• Provide assurance that the software produced conforms to the contractual requirements.
• Ensure appropriate software support is given to system engineering activities, where the contract requires it.
• Ensure the safety and security conditions of the project are addressed.

What that means in practice

The publication carries requirements for the project quality plan as it applies to software, for software design, and for verification and validation, alongside its definitions. In day-to-day terms that is a plan the customer can hold you to, a design that can be traced to the requirements it satisfies, and evidence that each requirement was actually verified rather than assumed.

The practical difficulty is rarely the engineering. It is that the evidence lives in one place, the requirements in another, and the quality plan in a document nobody has opened since the bid. AQAP 2210 is demonstrated by connecting those three, and by being able to show the connection on the day somebody asks.

How it relates to AQAP 2110 and AQAP 2310

AQAP 2110 contains the requirements of ISO 9001 plus NATO's additions, and is the usual base for a supplier that designs and produces. AQAP 2310 does the same with EN 9100 for complex aviation, space and defence work. AQAP 2210 sits on top of whichever of the two your contract cites, and adds nothing to the parts of the deliverable that are not software.

If you are working out which publications your contract actually invokes, the overview of the AQAP family sets out how 2110, 2131, 2210, 2310 and 2105 relate to each other.

There is no AQAP 2210 certificate

As with every AQAP, conformance is not certified by an accredited certification body the way ISO 9001 is. It is assured through Government Quality Assurance: the customer nation's quality authority verifies your quality system and the specific contract, with a right of access to your premises, your records and your sub-suppliers'. For software that access usually reaches further than suppliers expect, because the evidence a reviewer wants is generated during development, not at the end of it.