探討企業同時導入ISO系列(ISO9001、ISO 27001、ISO 20000)與CMMI之比較分析與管理─以台灣資訊服務業為例

Abstract

優良品質是企業保持競爭優勢的利器，一般企業多將核心業務的管理程序化，並依據ISO等國際標準組織所頒佈之標準加以訂定，期透過系統化方法，提昇產品/服務品質，並發揮整體效能。 本研究以臺灣資訊服務業為例，探討企業同時具有四類國際標準：ISO 9001(品質管理)、ISO 27001(資訊安全管理)、ISO 20000(資訊服務管理)以及CMMI(能力成熟度整合模式)，各標準之間重覆、互補、互稽、引用、申論的各種關係。提供下列三項目研究結果，希望對企業在導入多項國際標準時有所助益。 1.比較分析4類國際標準之異同 運用系統方法(Systematic Approach)、啟發性規劃(Heuristic Programming)及黑盒子(Black Box)觀念，比較分析ISO 9001、ISO 27001、ISO 20000、CMMI等4類國際標準之異同。 2.探討經營困難 例如：多項國際標準對組織文化之衝擊以及員工感受等。 3.提出管理對策及解決方案 以David Brewer﹝10﹞之管理系統整體架構，尋求管理對策及解決方案。 關鍵字：品質、ISO 9001、ISO 27001、ISO 20000、CMMI

Providing excellent product quality is the way for Enterprises to maintain competitive advantages. Generally, enterprises put processes to manage their core business, set standards by using International Standards such as ISO, and utilize systematic approaches to raise product quality and overall performance.

This research study investigates the concurrent deployment of four international standards which are used most often by professionals of the Information Service Industry in Taiwan; namely, ISO 9001 for quality management systems, ISO 27001 for information security management systems, ISO 20000 for information technology service management, and CMMI for process improvement in software engineering. Issues identified are: duplication in concurrent deployment, complementary coverage, mutually auditing, and cross referencing. The study presents three results which would add value to enterprises.

(1)Compares and analyzes the above four international standards by using three techniques: systematic approaches, heuristic programming, and the black-box concept. (2)Identifies difficulties and issues arising from concurrent deployment. For example, deployment of multiple international standards has impact upon the organizational culture and employees. (3)Proposes solutions to address these issues. David Brewer’s framework is used to find these solutions. Keywords: Quality、ISO 9001、ISO 27001、ISO 20000、CMMI.