scope:

This document describes a set of useful activities, tasks, methods, and practices that acquirers of software and related services from unrelated (external) suppliers can apply to help ensure an efficient and effective acquisition of software or software services. These practices can be applied in competitive and in sole source procurements and regardless of the type, size, complexity, and cost of the acquisition. The document can be applied to software that runs on any computer system regardless of the size, complexity, or criticality of the software. The software supply chain can include integration of off-the-shelf (OTS), custom, software as a service (SaaS), or open-source software. Software services can include software development and sustainment (maintenance), integration, verification (testing) and operation. Security and safety are included as attributes to be considered during the acquisition. However, specific requirements for acquisition of information assurance (security), safety, and cloud services are not included.

Each organization or individual using this document can identify the specific set of activities to include within the organization's acquisition process, given its legal and regulatory environment, procurement guidelines, and life cycle processes.