ISO/IEC 25010:2023 mapping

ISO/IEC 25010:2023 (Edition 2, November 2023) defines a software product quality model with nine characteristics. (The 2023 revision added Safety as a 9th characteristic alongside the original eight; Quality in Use is now its own standard, ISO/IEC 25019:2023.)

Quality characteristics

1. Functional Suitability — completeness, correctness, appropriateness
2. Performance Efficiency — time behavior, resource utilization, capacity
3. Compatibility — co-existence, interoperability
4. Interaction Capability — operability, learnability, accessibility (replacing the older “Usability”)
5. Reliability — maturity, availability, fault tolerance, recoverability
6. Security — confidentiality, integrity, non-repudiation, accountability, authenticity, resistance
7. Maintainability — modularity, reusability, analyzability, modifiability, testability
8. Flexibility — adaptability, scalability, installability, replaceability (replacing the older “Portability”)
9. Safety — operational constraint, risk identification, fail-safe, hazard warning, safe integration (new in 2023)

How Cadence tags artifacts

In docs/DEFINITION_OF_DONE.md (Phase 1), each checklist item carries a frontmatter tag identifying which 25010 characteristics it supports:

- [ ] (auto) `flutter analyze` clean
      <!-- iso25010: [reliability, maintainability] -->

- [ ] (manual) Mutation follows ADR-0001 optimistic-then-write
      <!-- iso25010: [reliability, performance-efficiency] -->

- [ ] (manual) Every UI handler wraps fire-and-forget in unawaited()
      <!-- iso25010: [reliability, maintainability] -->

Compliance report shape

/cadence-compliance --standard iso25010 produces:

• A coverage table — which characteristics have any backing DoD items vs which are untagged
• Per-characteristic counts (e.g., “Security: 7 DoD items, 5 ADRs, 3 boundary rules”)
• A drill-down listing every artifact tagged with a given characteristic

This is useful for:

• Discovering blind spots (a characteristic with zero artifacts is a signal you have no rules in that area)
• Demonstrating breadth of quality concern to non-technical stakeholders
• Mapping team capacity to characteristics over time

Limitations

Cadence’s 25010 mapping is descriptive, not measurement-based. ISO 25010 itself defines characteristics; the companion standard ISO/IEC 25023 defines measurement methods. Cadence does not implement 25023 metrics in v1; that’s deferred to a later release where appropriate metrics can be derived from CI run history.

Versioning

The mapping pins to ISO/IEC 25010:2023 Edition 2. The pre-2023 version (ISO/IEC 25010:2011) used a different set of characteristics (Usability, Portability) — Cadence ships only the current revision.