How to conduct a gap analysis for safety-critical software

In high-stakes industries like aerospace, medical, and automotive, where software malfunctions can have catastrophic consequences, meeting regulations like IEC 62304 or DO-178C goes beyond simply gaining market access. It’s about building software of exceptional quality, where safety and reliability are paramount.

So, it’s vital you know if your product’s software is compliant. And, if not, where is it falling short?

This is where gap analysis can help.

What is gap analysis?

Gap analysis helps teams or individuals establish where they are and where they need to be for a given goal. Everything in between these two points is the eponymous ‘gap’ in need of analysis. A strategy can then be formed to close the gaps and get to where you need to be.

It can be immensely beneficial to improving:

Processes or policies: Do you have the right ones? Are they being followed?

Performance: Are you achieving your goals as an individual or organisation?

Product features: Are you meeting user and market expectations?

Skills: Does your organisation have the skills required to support strategic goals?

Technology: Does your organisation have the infrastructure to support strategic goals?

Compliance: Does your product adhere to necessary laws, regulations and industry standards?

It’s important to remember that gap analysis doesn’t just identify shortcomings. It might show that you’ve achieved your goal, but that there are further improvements you can make.

What are the advantages of gap analysis?

Gap analysis offers a range of benefits. These include:

Goal Setting:  Initially, you might not even know what you aspire to achieve. However, a gap analysis can help you set, refine or change your goals. By examining the current state, you can determine the ideal future state and set achievable objectives.

Progress tracking:  Once you have goals in place, a gap analysis allows you to evaluate your progress. It reveals how far you’ve come and any blockers hindering your advancement.

Prioritisation:  By identifying gaps, you can pinpoint areas requiring the most focus and attention. This ensures you’re working on the most impactful aspects.

Audit preparation:  Performing a gap analysis before an audit demonstrates proactive improvement efforts. Auditors appreciate seeing a company identify and address knowledge gaps.

Performance monitoring:  Regular gap analyses serve as a benchmark for tracking progress over time. By comparing past and present results, you can assess your performance trajectory.

How to conduct a software gap analysis (in three steps)

Clearly, there are lots of use cases for gap analysis, but for the purposes of this blog we’re only interested in one: making sure software meets compliance.

Here’s what you need to do:

1.      Preparation

Define the scope: Decide which areas of your software development lifecycle you want to assess. Start with high-risk areas or processes needing clarification. And make sure your goals aren’t too broad, or you won’t be able to write requirements for them. A good way to mitigate this is to make sure they’re SMART (Specific, Measurable, Achievable, Relevant, and Time-Bound).

Gather resources: Collect the latest version of the standard you’re working toward, relevant guidance documents, and documentation of your current practices. Now’s the time to request access to any required documentation you don’t have, if necessary. You don’t want to be waiting for crucial information, mid-analysis.

Gather intelligence: We often conduct gap analyses for clients, and it’s really useful, before we begin, to get an overview of their processes and their policies.

Establish stakeholders: In an ideal world, you’ll start your gap analysis with all the documentation and information you need. However, just in case, make sure you’ve got access to contacts and stakeholders who can provide additional information or resources you may need.

2.     The gap analysis

There are lots of ways to conduct your gap analysis. SWOT, Fishbone, and PEST/PESTLE are just a few examples. Alternatively, you might just want to use a spreadsheet. Each method has its strengths and weaknesses which will make it more or less suited to certain projects and teams. It’s good to try out different ones and find what suits you.

At Bluefruit, we have written our own gap analysis tool which has templates for specific compliance and will provide all the necessary clauses, against which we can easily score a project using a traffic light system. Once complete, the software outputs a full report, which can be shared with key stakeholders. Neat!

Once you’ve decided how you’re going to conduct your analysis, it’s time to…

Map your current state: Assess and record the current state of your software. It’s important that everyone is transparent here, as this will allow you to create an accurate comparison later.

Define your goal: Clearly define what compliance with the chosen standard looks like for each assessed area. Refer to the standard’s relevant clauses and sections to understand best practices.

Identify the gap: Carefully compare your documented current state with the defined target state. This crucial step will reveal any discrepancies and areas where you’re not meeting the standard’s requirements.

Gap prioritisation: Analyse the identified gaps based on their potential impact on safety, regulatory compliance, and risk. Prioritise them based on the severity and feasibility of addressing them.

3.      Action (closing the gap)

Develop an action plan: Create a concrete roadmap with clearly defined steps, timelines, and responsibilities for addressing each prioritised gap.

Implementation and monitoring: Execute the action plan. By tracking progress and monitoring the effectiveness of implemented changes, you can identify areas for improvement and adjust the plan as needed to ensure the successful closure of identified gaps.

Reporting and Communication: Share the gap analysis report and its implications with relevant stakeholders.

Over to you

So, there you have it. By following these steps and embracing a proactive approach, you can leverage the power of gap analysis to assess your software’s compliance (and any remedial action required). However, navigating complex standards and regulations can be challenging. If you need assistance, reach out to an expert.