[论文解读] DevOps in an ISO 13485 Regulated Environment: A Multivocal Literature Review

Martin Forsberg Lie, Mary Sánchez‐Gordón+1 more|arXiv (Cornell University)|Jul 22, 2020

Software Engineering Techniques and Practices参考文献 19被引用 4

一句话总结

本文通过2015年至2020年的多源文献综述，研究了在符合ISO 13485标准的医疗设备环境中实施DevOps的现状，识别了在监管、合规性、安全性、组织和工程技术维度上的关键挑战与优势。研究提出了一项实用检查清单，以指导组织在保持合规性的同时成功实施DevOps，强调领导层支持、辅导以及迭代式学习在转型过程中的重要性。

ABSTRACT

Background: Medical device development projects must follow proper directives and regulations to be able to market and sell the end-product in their respective territories. The regulations describe requirements that seem to be opposite to efficient software development and short time-to-market. As agile approaches, like DevOps, are becoming more and more popular in software industry, a discrepancy between these modern methods and traditional regulated development has been reported. Although examples of successful adoption in this context exist, the research is sparse. Aims: The objective of this study is twofold: to review the current state of DevOps adoption in regulated medical device environment; and to propose a checklist based on that review for introducing DevOps in that context. Method: A multivocal literature review is performed and evidence is synthesized from sources published between 2015 to March of 2020 to capture the opinions of experts and community in this field. Results: Our findings reveal that adoption of DevOps in a regulated medical device environment such as ISO 13485 has its challenges, but potential benefits may outweigh those in areas such as regulatory, compliance, security, organizational and technical. Conclusion: DevOps for regulated medical device environments is a highly appealing approach as compared to traditional methods and could be particularly suited for regulated medical development. However, an organization must properly anchor a transition to DevOps in top-level management and be supportive in the initial phase utilizing professional coaching and space for iterative learning; as such an initiative is a complex organizational and technical task.

研究动机与目标

• 调查在ISO 13485标准下受监管的医疗设备开发中，DevOps实施的当前状态。
• 识别将DevOps整合到受监管软件开发流程中所面临的挑战与优势。
• 综合专家与社区来源的证据，探讨医疗设备环境中DevOps的实施情况。
• 为希望在符合ISO 13485标准的环境中实施DevOps的组织，制定一项实用检查清单。
• 通过领导层参与、辅导以及迭代式学习框架，支持组织的转型过程。

提出的方法

• 使用2015年至2020年3月间发表的文献，开展多源文献综述。
• 综合学术论文、行业报告和社区论坛中的证据，以捕捉专家与实践者的观点。
• 将发现结果归类为监管、合规性、安全性、组织和工程技术维度。
• 识别在受监管环境中实施DevOps的重复主题与关键成功因素。
• 基于综合证据推导出结构化检查清单，以指导实施。
• 通过与实证发现及监管期望的一致性，验证检查清单的相关性。

实验结果

研究问题

• RQ1 DevOps在符合ISO 13485标准的医疗设备开发环境中目前是如何实施的？
• RQ2 组织在将DevOps整合到受监管的医疗软件开发中时，面临的主要挑战是什么？
• RQ3 在受监管环境中，DevOps在合规性、安全性和上市时间方面提供了哪些优势？
• RQ4 在受监管的医疗设备环境中，实现DevOps成功实施的组织与技术促成因素有哪些？
• RQ5 结构化检查清单如何在保持ISO 13485合规性的前提下，支持向DevOps的过渡？

主要发现

• 在符合ISO 13485标准的环境中实施DevOps面临与监管合规性、文档管理及审计准备相关的重大挑战。
• 尽管存在这些挑战，若管理得当，DevOps在开发速度、质量与安全性方面的潜在优势仍超过其风险。
• 组织因素如领导层支持、辅导以及迭代式学习对成功过渡到DevOps至关重要。
• 技术与流程的整合必须符合ISO 13485的要求，包括版本控制、可追溯性及变更管理。
• 所提出的检查清单为受监管医疗设备开发中的DevOps实施提供了结构化且基于证据的指导框架。
• 本研究证实，DevOps是受监管医疗软件环境中传统方法的可行且极具吸引力的替代方案。