ISO/IEC/IEEE 24748-8:2026

International
Standard
ISO/IEC/IEEE
24748-8
Second edition
Systems and software
2026-10
engineering — Life cycle
management —
Part 8:
Technical reviews and audits on
defence programs
Ingénierie des systèmes et du logiciel — Gestion du cycle de vie —
Partie 8: Revues techniques et audits des programmes de défense
Reference number
© IEEE 2025
© IEEE 2025
All rights reserved. Unless otherwise specified, or required in the context of its implementation, no part of this publication may
be reproduced or utilized otherwise in any form or by any means, electronic or mechanical, including photocopying, or posting
on the internet or an intranet, without prior written permission. Permission can be requested from either ISO or IEEE at the
respective address below or ISO’s member body in the country of the requester.
Institute of Electrical and Electronics Engineers, Inc
3 Park Avenue, New York
NY 10016-5997, USA
Email: stds.ipr@ieee.org
Website: www.ieee.org
Published in Switzerland
© IEEE 2025 – All rights reserved
ii
Contents Page
Foreword .vi
Introduction .viii
1 Scope . 1
2 Normative references . 1
3 Terms, definitions and abbreviated terms . 1
3.1 Terms and definitions .1
3.2 Abbreviated terms .4
4 Conformance . 4
5 Concepts . 5
5.1 Project assessment and control .5
5.2 Configuration management .5
5.3 Validation .5
5.4 Information and digital engineering .6
5.5 Agile development .6
6 Timing and frequency . 7
6.1 Alignment to system life cycle model . .7
6.2 Risk-based decision points .7
6.3 Entry criteria .7
6.4 Exit criteria .7
6.5 Application to system elements .8
6.6 Iteration and concurrency considerations .8
6.7 Removing, combining or adding reviews or audits .8
7 Technical review and audit processes . 8
7.1 Prepare process .8
7.1.1 Purpose .8
7.1.2 Outcomes .8
7.1.3 Activities and tasks .8
7.2 Conduct process .10
7.2.1 Purpose .10
7.2.2 Outcomes .10
7.2.3 Activities and tasks .10
7.3 Complete process .11
7.3.1 Purpose .11
7.3.2 Outcomes .11
7.3.3 Activities and tasks .11
8 Application to major capability acquisition pathway .12
8.1 Overview . 12
8.1.1 Purpose . 12
8.1.2 Life cycle . 13
8.2 Alternative systems review (ASR) .14
8.2.1 ASR purpose .14
8.2.2 ASR outcomes .14
8.2.3 ASR timing .14
8.2.4 ASR activities and tasks . 15
8.2.5 ASR review topics . 15
8.3 System requirements review (SRR) .16
8.3.1 SRR purpose .16
8.3.2 SRR outcomes .16
8.3.3 SRR timing .17
8.3.4 SRR activities and tasks .17
8.3.5 SRR review topics .17
8.4 System functional review (SFR) .21
© IEEE 2025 – All rights reserved
iii
8.4.1 SFR purpose .21
8.4.2 SFR outcomes .21
8.4.3 SFR timing .21
8.4.4 SFR activities and tasks .21
8.4.5 SFR review topics . 22
8.5 Preliminary design review (PDR) . 22
8.5.1 PDR purpose . 22
8.5.2 PDR outcomes . 23
8.5.3 PDR timing . 23
8.5.4 PDR activities and tasks . 23
8.5.5 PDR review topics . 23
8.6 Critical design review (CDR) . 29
8.6.1 CDR purpose . 29
8.6.2 CDR outcomes . 29
8.6.3 CDR timing . 30
8.6.4 CDR activities and tasks . 30
8.6.5 CDR review topics . 30
8.7 Test readiness review (TRR). 35
8.7.1 TRR purpose . 35
8.7.2 TRR outcomes . 36
8.7.3 TRR timing . 36
8.7.4 TRR activities and tasks . 36
8.7.5 TRR review topics . 36
8.8 Functional configuration audit (FCA) . 39
8.8.1 FCA purpose . 39
8.8.2 FCA outcomes . 39
8.8.3 FCA timing . 39
8.8.4 FCA activities and tasks . 39
8.8.5 FCA audit topics . . 39
8.9 System verification review (SVR) . 40
8.9.1 SVR purpose . 40
8.9.2 SVR outcomes . 40
8.9.3 SVR timing .41
8.9.4 SVR activities and tasks .41
8.9.5 SVR review topics .41
8.10 Production readiness review (PRR) .42
8.10.1 PRR purpose .42
8.10.2 PRR outcomes .42
8.10.3 PRR timing .42
8.10.4 PRR activities and tasks .43
8.10.5 PRR review topics.43
8.11 Physical configuration audit (PCA) .45
8.11.1 PCA purpose .45
8.11.2 PCA outcomes.45
8.11.3 PCA timing .45
8.11.4 PCA activities and tasks . . .45
8.11.5 PCA audit topics .45
9 Application to agile software acquisition pathway . 47
9.1 Overview .47
9.1.1 Purpose .47
9.1.2 Life cycle . 48
9.2 Project initiation review (PIR) . 49
9.2.1 PIR purpose . 49
9.2.2 PIR outcomes . 49
9.2.3 PIR timing . 49
9.2.4 PIR activities and tasks . 49
9.2.5 PIR review topics . 50
9.3 Iterative planning review (IPR) . 50
© IEEE 2025 – All rights reserved
iv
9.3.1 IPR purpose . 50
9.3.2 IPR outcomes .51
9.3.3 IPR timing .51
9.3.4 IPR activities and tasks .51
9.3.5 IPR review topics .51
9.4 Iterative capability review (ICR) . 54
9.4.1 ICR purpose . 54
9.4.2 ICR outcomes . 54
9.4.3 ICR timing . 55
9.4.4 ICR activities and tasks . 55
9.4.5 ICR review topics . 55
9.5 Incremental viability review (IVR) .59
9.5.1 IVR purpose .59
9.5.2 IVR outcomes .59
9.5.3 IVR timing .59
9.5.4 IVR activities and tasks .59
9.5.5 IVR review topics .59
9.6 Incremental release review (IRR) .61
9.6.1 IRR purpose and description.61
9.6.2 IRR outcomes .61
9.6.3 IRR timing .62
9.6.4 IRR activities and tasks .62
9.6.5 IRR review topics .62
9.7 Incremental configuration audit (ICA) . 64
9.7.1 ICA purpose. 64
9.7.2 ICA outcomes . 64
9.7.3 ICA timing . 64
9.7.4 ICA activities and tasks . 65
9.7.5 ICA audit topics . 65
Annex A (informative) Review and audit topics .69
Annex B (informative) Conformance background and options .70
Annex C (informative) Planning considerations .72
Bibliography .80
IEEE notices and abstract .81

© IEEE 2025 – All rights reserved
v
Foreword
ISO (the International Organization for Standardization) and IEC (the International Electrotechnical
Commission) form the specialised system for worldwide standardization. National bodies that are
members of ISO or IEC participate in the development of International Standards through technical
committees established by the respective organization to deal with particular fields of technical activity.
ISO and IEC technical committees collaborate in fields of mutual interest. Other international organizations,
governmental and non-governmental, in liaison with ISO and IEC, also take part in the work.
The procedures used to develop this document and those intended for its further maintenance are described
in the ISO/IEC Directives, Part 1. In particular, the different approval criteria needed for the different types
of ISO/IEC documents should be noted. This document was drafted in accordance with the editorial rules of
the ISO/IEC Directives, Part 2 (see www.iso.org/directives or www.iec.ch/members_experts/refdocs).
IEEE Standards documents are developed within IEEE Societies and subcommittees of IEEE Standards
Association (IEEE SA) Board of Governors. IEEE develops its standards through an accredited consensus
development process, which brings together volunteers representing varied viewpoints and interests to
achieve the final product. IEEE standards are documents developed by volunteers with scientific, academic,
and industry-based expertise in technical working groups. Volunteers are not necessarily members of
IEEE or IEEE SA and participate without compensation from IEEE. While IEEE administers the process and
establishes rules to promote fairness in the consensus development process, IEEE does not independently
evaluate, test, or verify the accuracy of any of the information or the soundness of any judgments contained
in its standards.
ISO and IEC draw attention to the possibility that the implementation of this document may involve the
use of (a) patent(s). ISO and IEC take no position concerning the evidence, validity or applicability of any
claimed patent rights in respect thereof. As of the date of publication of this document, ISO and IEC had not
received notice of (a) patent(s) which may be required to implement this document. However, implementers
are cautioned that this may not represent the latest information, which may be obtained from the patent
database available at www.iso.org/patents and https://patents.iec.ch. ISO and IEC shall not be held
responsible for identifying any or all such patent rights.
Any trade name used in this document is information given for the convenience of users and does not
constitute an endorsement.
For an explanation of the voluntary nature of standards, the meaning of ISO specific terms and expressions
related to conformity assessment, as well as information about ISO's adherence to the World Trade
Organization (WTO) principles in the Technical Barriers to Trade (TBT), see www.iso.org/iso/foreword.html.
In the IEC, see www.iec.ch/understanding-standards.
This document was prepared by Joint Technical Committee ISO/JTC 1, Information technology, Subcommittee
SC 7, Software and systems engineering, in cooperation with the Systems and Software Engineering
Standards Committee of the IEEE Computer Society, under the Partner Standards Development Organization
cooperation agreement between ISO and IEEE.
This second edition cancels and replaces the first edition (ISO/IEC/IEEE 24748-8:2019), which has been
technically revised.
The main changes are as follows:
— aligned document structure, terminology, etc. with related ISO standards (e.g. ISO/IEC/IEEE 15288:2023);
— reorganized and consolidated text for more consistent wording and to support different acquisition life
cycles and organizations;
— added information to support software using highly iterative and incremental (agile) life cycles;
— defined common processes for technical reviews and audits on defence projects;
— defined review and audit topics associated with technical reviews and audits, replacing acceptability
criteria;
© IEEE 2025 – All rights reserved
vi
— added context to support readers without significant defence industry experience;
— updated to reflect current best practices (e.g. digital engineering);
— removed selected guidance material (e.g. annexes describing optional reviews);
— updated definitions, acronyms and bibliography to be consistent with revised text.
A list of all parts in the ISO/IEC/IEEE 24748 series can be found on the ISO and IEC websites.
Any feedback or questions on this document should be directed to the user’s national standards
body. A complete listing of these bodies can be found at www.iso.org/members.html and
www.iec.ch/national-committees.
© IEEE 2025 – All rights reserved
vii
Introduction
This document responds to the needs of defence projects to have more specific and detailed requirements for
technical reviews and audits as part of the assessment of projects during their life cycle. The requirements
and guidance in this document have been written at the most general level possible so that they can meet the
needs of defence agencies in different countries, either by direct application or by tailoring for an agency’s
specific needs.
Defence projects can be different from typical commercial projects in several ways:
— Defence systems can have hazards to human safety, the environment and national security that make
their ownership and use prohibited outside of a defence organization. This can constrain the ability of
projects to develop and deploy solutions for test and operational use;
— Acquisition teams can require comprehensive, cohesive technical data for systems and system elements,
particularly plans, requirements and architectural descriptions (e.g. for certification activities or organic
support);
— Acquisition teams using public funds often need extensive visibility into the definition and execution of
supplier processes to support their fiduciary responsibilities.
These differences can result in the need to support more stakeholders in the review and audit process
(6.6) and the need to review and audit more information items than found in typical commercial projects.
However, non-defence projects are encouraged to apply it if useful.
This document can be used in one or more of the following modes:
— by an acquirer and a supplier, to help develop an agreement on the contribution of each party to the
technical reviews and audit approach;
— by a project, to help establish and execute a technical review and audit approach for that project;
— by an organization, to help establish a desired approach to technical reviews and audits that can be
applied across multiple projects;
— by process assessors, to serve as a reference for use in the performance of process assessments that
support organizational process improvement.
NOTE Several tables in this document include a unique identifier (ID) for each table entry. This identifier can be
used as desired to support compact references to the table entry in tailoring descriptions, checklists, etc.
© IEEE 2025 – All rights reserved
viii
International Standard ISO/IEC/IEEE 24748-8:2026(en)
Systems and software engineering — Life cycle
management —
Part 8:
Technical reviews and audits on defence programs
1 Scope
This document establishes the requirements for technical reviews and audits to be performed throughout
the acquisition life cycle of defence projects. This document provides the purpose, timing, activities and tasks
for each technical review and audit. It can be used to establish agreement between acquirers and suppliers
on the technical reviews and audits that are needed for the project, as well as the focus and expectations of
each technical review and audit.
This document is applicable to:
— those who implement or plan to implement technical reviews and audits in the acquisition of defence-
related systems (and parts thereof) or services;
— those who are responsible for the technical management of projects concerned with the engineering of
systems;
— those responsible for executing ISO/IEC/IEEE 15288 system life cycle processes for defence projects.
While primarily supporting the acquirer-supplier agreement mode, this document also can be used to
support the other modes such as use by organizations, projects and process assessors.
NOTE In this document, the terms "project" and "program" are used interchangeably.
2 Normative references
There are no normative references in this document.
3 Terms, definitions and abbreviated terms
3.1 Terms and definitions
For the purposes of this document, the following terms and definitions apply.
ISO, IEC and IEEE maintain terminology databases for use in standardization at the following addresses:
— ISO Online browsing platform: available at https:// www. iso. org/o bp
— IEC Electropedia: available at https:// www.e lectropedia. org/
— IEEE Standards Dictionary Online: available at https:// ieeexplore .ieee. org/x pls/d ictionary. jsp
NOTE For additional terms and definitions in the field of systems and software engineering, see
ISO/IEC/IEEE 24765, which is published periodically as a “snapshot” of the SEVOCAB (Systems and software
Engineering Vocabulary) database and which is publicly accessible at https://ww w. computer. org/se vocab.

© IEEE 2025 – All rights reserved
3.1.1
agile
development approach based on iterative development, frequent inspection and adaptation, and incremental
deliveries in which requirements and solutions evolve through collaboration in cross-functional teams and
through continual stakeholder feedback
[SOURCE: ISO/IEC/IEEE 24748-1:2024, 3.4]
3.1.2
evaluation
systematic determination of the extent to which an entity meets its specified criteria
[SOURCE: ISO/IEC 25001:2014, 4.1]
3.1.3
increment
tested, deliverable version of a product that provides new or modified capabilities
[SOURCE: ISO/IEC 33202:2024, 3.17, modified — “software” has been removed.]
3.1.4
information
knowledge that is exchangeable amongst users (3.1.13), about things, facts, concepts, and so on, in a universe
of discourse
[SOURCE: ISO/IEC 10746-2:2009, 3.2.6]
3.1.5
information item
information product
separately identifiable body of information (3.1.4) that is produced, stored, and delivered for human use
Note 1 to entry: A document produced to meet information requirements can be an information item, part of an
information item, or a combination of several information items.
Note 2 to entry: An information item can be produced in several versions during a project or system (3.1.11) life cycle.
[SOURCE: ISO/IEC/IEEE 15289:2019, 3.1.12]
3.1.6
information item content
information (3.1.4) included in an information item (3.1.5), associated with a system (3.1.11), product or
service, to satisfy a requirement or need
[SOURCE: ISO/IEC/IEEE 15289:20197, 3.1.13]
3.1.7
iteration
repeating the application of the same process or set of processes on the same level of the system
(3.1.11) structure
[SOURCE: ISO/IEC/IEEE 15288:2023, 3.28]
3.1.8
recursion
repeating the application of the same process or set of processes to successive levels of system
(3.1.11) elements in the system structure
[SOURCE: ISO/IEC/IEEE 15288:2023, 3.31]
Note 1 to entry: No specific order of application is implied by this definition. For software and hardware system
elements, a process may be applied at recursively lower levels for system definition and recursively higher levels for
system realization.
© IEEE 2025 – All rights reserved
Note 2 to entry: This definition does not imply any specific hierarchical, vertical, or horizontal structure for the system
of interest, enabling system, organization, or project.
3.1.9
software configuration item
computer software configuration item
aggregation of software that is designed for configuration management and treated as a single entity in the
configuration management process
Note 1 to entry: The state of technology progression has resulted in the functionality of software code being realized
by its execution while embedded in devices that are not properly described as computers (e.g. digital signal processors,
field programmable gate assemblies). This document uses software configuration item to encompass the broader
execution environment of software code.
[SOURCE: ISO/IEC/IEEE 24765:2017, modified — The admitted term "software configuration item" has been
changed to the preferred term; the abbreviated terms have been removed; note 1 to entry has been added.]
3.1.10
specification
information item (3.1.5) that identifies, in a complete, precise, and verifiable manner, the requirements,
design, behaviour, or other expected characteristics of a system (3.1.11), service, or process
Note 1 to entry: The more generic term is used for consistent terminology within this document and includes terms
such as system performance specification, system requirements document, system or subsystem specification, or
agile (3.1.1) backlog.
[SOURCE: ISO/IEC/IEEE 15289:2019, 3.1.26, modified — Note 1 to entry has been added.]
3.1.11
system
arrangement of parts or elements that together exhibit a stated behaviour or meaning that the individual
constituents do not
Note 1 to entry: A system is sometimes considered as a product or as the services it provides.
Note 2 to entry: In practice, the interpretation of its meaning is frequently clarified by the use of an associative noun,
e.g. aircraft system. Alternatively, the word “system” is substituted simply by a context-dependent synonym (e.g.
aircraft), though this potentially obscures a system principles perspective.
Note 3 to entry: A complete system includes all of the associated equipment, facilities, material, computer programs,
firmware, technical documentation, services, and personnel required for operations and support to the degree
necessary for self-sufficient use in its intended environment.
[SOURCE: ISO/IEC/IEEE 15288:2023, 3.46]
3.1.12
technical review
systems e
...