External Review of Software Development Lifecycle Process

⁠⁠⁠Overview

The Clean Energy Regulator (CER) is seeking an external provider to independently review the software development lifecycle processes used to maintain, enhance, support and govern a key legacy system for the CER. The review will identify risks, gaps and improvement opportunities, and provide practical recommendations to improve quality, security, maintainability and decrease risk when operating these systems.

Objectives

• Assess whether current lifecycle processes are documented, consistently applied and fit for purpose
• Identify process gaps, risks and control weaknesses
• Recommend practical, prioritised improvements to governance, delivery quality, assurance, security, supportability and modernisation readiness
• Provide clear and actionable advice that can increase delivery confidence and reduce delivery risk

Scope

The scope includes:

• Review of end-to-end lifecycle processes, including demand intake, requirements definition and prioritisation, design, development, testing, release, change control, operations and support
• Consideration of both documented processes and actual working practices across business, technology and support teams
• Assessment of key dependencies, including related applications, data, integrations, infrastructure and business processes

Required Review Areas

• Development, source control, configuration, build and environment management
• Release, deployment, change control, rollback and post-implementation review
• Testing, quality assurance, defect management and release readiness
• Architecture, design, technical debt and documentation
• Maintainability and managing components approaching end-of-life or end-of-support
• Demand intake, requirements capture, prioritisation and approvals
• Security, privacy, and knowledge management
• Operations, support, incident and problem management, monitoring and performance management, and service levels
• Governance, accountabilities and decision rights

Deliverables

• Review plan covering scope, approach, activities, information required and schedule
• Current-state assessment of lifecycle processes, roles, controls, risks and pain points
• Gap and risk assessment against good practice expectations
• Prioritised recommendations, including quick wins and longer-term improvements
• Implementation roadmap with recommended actions, sequencing, dependencies and suggested owners
• Final report and executive presentation

Contractor Requirements

Expected Provider Capability

• Demonstrated experience reviewing SDLC processes for complex, business-critical or legacy systems
• Practical experience in application delivery, maintenance, quality assurance, release management, secure development and operational support
• Ability to assess both process maturity and real-world delivery effectiveness
• Clear communication with both technical and non-technical audiences
• Examples of similar work, proposed personnel, relevant qualifications and proposed methodology