1. Quality management approach
In this file, you can ref useful information about quality management approach such as quality
management approachforms, tools for quality management approach, quality management
approachstrategies … If you need more assistant for quality management approach, please leave
your comment at the end of file.
Other useful material for quality management approach:
• qualitymanagement123.com/23-free-ebooks-for-quality-management
• qualitymanagement123.com/185-free-quality-management-forms
• qualitymanagement123.com/free-98-ISO-9001-templates-and-forms
• qualitymanagement123.com/top-84-quality-management-KPIs
• qualitymanagement123.com/top-18-quality-management-job-descriptions
• qualitymanagement123.com/86-quality-management-interview-questions-and-answers
I. Contents of quality management approach
==================
Designing a quality management approach to cybersecurity starts with two sets of security
standards, (1) the manufacturer and (2) the organization.
The manufacturer standards should include the mitigation of security vulnerabilities, (OWASP,
CVE), based on a specific configuration within a defined architecture. There are only so many
situations in which a network device firewall, router, switch, server, desktop, laptop, handheld
can be deployed. The software, enterprise resource planning (ERP), utilities, apps, etc., should
also be tested for security vulnerabilities before they are released.
We need to weed out the technologists who insist on flying by the seat of their pants. They can
expose the organization to unnecessary reputational risks and potential financial and strategic
risks. By not documenting security standards, the organization will be not be able to produce
consistent outputs. It is impossible to manage quality when nothing is documented; it cannot be
validated or verified.
The organization's security standards need to define how a network device will be implemented.
This usually means that only a select list of manufacturers and products that have been tested and
meet the organization’s requirements can be purchased. This also means that the security
architecture needs to be documented based on those specifications and business requirements.
These specifications need to be meaningful, because they will be tested, verified and validated.
Each device or software product needs to have its security standards documented—again, these
need to be meaningful. A risk assessment could help to identify what needs to be documented. I
also recommend adopting the ISO 9001 approach to product realization. To be effective, security

2. standards need to be consistently documented in a manner that includes specifications. These
specifications are grouped as follows:
 Design—how the device or software fits into the architecture; i.e., internal facing
 Installation—how the device or software will be installed; i.e., configuration
 Operations—how the device or software will be used; i.e., standard operating procedure
 Performance—how should the device or software function; i.e., response times, look,
feel, etc.
In quality management, we refer to these specifications as qualifications because they get tested
and verified before release. We also call them design qualification (DQ), installation
qualification (IQ), operations qualification (OQ) and performance qualification (PQ). These
specifications need to be considered as part of the enterprise security architecture during any
custom software development or major changes. Rule number one is "No surprises!" The secure
software development methodology needs to include specifications for design that eliminate all
known vulnerabilities and any organizational attack vectors that are unique to the organization.
Any changes need to be retested during the quality assurance (QA) and user acceptance testing
phase of development. The QA team needs to include a member from the software side and the
technology side.
The results are a fully integrated, seamless approach to managing security vulnerabilities and
shutting down those attack vectors. The time spent upfront will save time on the back end, so
that management can focus resources on problem management and security events and incidents
to gather additional intelligence. The additional benefit is that the security team can more easily
detect potential security events and incidents more rapidly.
Organizations should not have to pay out of their own pockets to fix security defects that the
manufacturer could have fixed for everyone by adopting a similar quality management approach.
If the developer or manufacturer was facilitating this level of testing, it should be able to provide
the security standards.
Organizations that purchase products that have known vulnerabilities/defects, nullify their
warranties. This increases the organizations’ exposure and liabilities, which means that they will
need to carry more insurance and pay for it out of their pockets, further increasing operational
costs and lowering revenue because the cost of doing business just got more expensive.
==================
III. Quality management tools
1. Check sheet

3. The check sheet is a form (document) used to collect data
in real time at the location where the data is generated.
The data it captures can be quantitative or qualitative.
When the information is quantitative, the check sheet is
sometimes called a tally sheet.
The defining characteristic of a check sheet is that data
are recorded by making marks ("checks") on it. A typical
check sheet is divided into regions, and marks made in
different regions have different significance. Data are
read by observing the location and number of marks on
the sheet.
Check sheets typically employ a heading that answers the
Five Ws:
 Who filled out the check sheet
 What was collected (what each check represents,
an identifying batch or lot number)
 Where the collection took place (facility, room,
apparatus)
 When the collection took place (hour, shift, day
of the week)
 Why the data were collected
2. Control chart
Control charts, also known as Shewhart charts
(after Walter A. Shewhart) or process-behavior
charts, in statistical process control are tools used
to determine if a manufacturing or business
process is in a state of statistical control.
If analysis of the control chart indicates that the
process is currently under control (i.e., is stable,
with variation only coming from sources common
to the process), then no corrections or changes to
process control parameters are needed or desired.
In addition, data from the process can be used to
predict the future performance of the process. If
the chart indicates that the monitored process is
not in control, analysis of the chart can help
determine the sources of variation, as this will

4. result in degraded process performance.[1] A
process that is stable but operating outside of
desired (specification) limits (e.g., scrap rates
may be in statistical control but above desired
limits) needs to be improved through a deliberate
effort to understand the causes of current
performance and fundamentally improve the
process.
The control chart is one of the seven basic tools of
quality control.[3] Typically control charts are
used for time-series data, though they can be used
for data that have logical comparability (i.e. you
want to compare samples that were taken all at
the same time, or the performance of different
individuals), however the type of chart used to do
this requires consideration.
3. Pareto chart
A Pareto chart, named after Vilfredo Pareto, is a type
of chart that contains both bars and a line graph, where
individual values are represented in descending order
by bars, and the cumulative total is represented by the
line.
The left vertical axis is the frequency of occurrence,
but it can alternatively represent cost or another
important unit of measure. The right vertical axis is
the cumulative percentage of the total number of
occurrences, total cost, or total of the particular unit of
measure. Because the reasons are in decreasing order,
the cumulative function is a concave function. To take
the example above, in order to lower the amount of
late arrivals by 78%, it is sufficient to solve the first
three issues.
The purpose of the Pareto chart is to highlight the
most important among a (typically large) set of
factors. In quality control, it often represents the most
common sources of defects, the highest occurring type
of defect, or the most frequent reasons for customer
complaints, and so on. Wilkinson (2006) devised an

5. algorithm for producing statistically based acceptance
limits (similar to confidence intervals) for each bar in
the Pareto chart.
4. Scatter plot Method
A scatter plot, scatterplot, or scattergraph is a type of
mathematical diagram using Cartesian coordinates to
display values for two variables for a set of data.
The data is displayed as a collection of points, each
having the value of one variable determining the position
on the horizontal axis and the value of the other variable
determining the position on the vertical axis.[2] This kind
of plot is also called a scatter chart, scattergram, scatter
diagram,[3] or scatter graph.
A scatter plot is used when a variable exists that is under
the control of the experimenter. If a parameter exists that
is systematically incremented and/or decremented by the
other, it is called the control parameter or independent
variable and is customarily plotted along the horizontal
axis. The measured or dependent variable is customarily
plotted along the vertical axis. If no dependent variable
exists, either type of variable can be plotted on either axis
and a scatter plot will illustrate only the degree of
correlation (not causation) between two variables.
A scatter plot can suggest various kinds of correlations
between variables with a certain confidence interval. For
example, weight and height, weight would be on x axis
and height would be on the y axis. Correlations may be
positive (rising), negative (falling), or null (uncorrelated).
If the pattern of dots slopes from lower left to upper right,
it suggests a positive correlation between the variables
being studied. If the pattern of dots slopes from upper left
to lower right, it suggests a negative correlation. A line of
best fit (alternatively called 'trendline') can be drawn in
order to study the correlation between the variables. An
equation for the correlation between the variables can be
determined by established best-fit procedures. For a linear
correlation, the best-fit procedure is known as linear

6. regression and is guaranteed to generate a correct solution
in a finite time. No universal best-fit procedure is
guaranteed to generate a correct solution for arbitrary
relationships. A scatter plot is also very useful when we
wish to see how two comparable data sets agree with each
other. In this case, an identity line, i.e., a y=x line, or an
1:1 line, is often drawn as a reference. The more the two
data sets agree, the more the scatters tend to concentrate in
the vicinity of the identity line; if the two data sets are
numerically identical, the scatters fall on the identity line
exactly.
5.Ishikawa diagram
Ishikawa diagrams (also called fishbone diagrams,
herringbone diagrams, cause-and-effect diagrams, or
Fishikawa) are causal diagrams created by Kaoru
Ishikawa (1968) that show the causes of a specific
event.[1][2] Common uses of the Ishikawa diagram are
product design and quality defect prevention, to identify
potential factors causing an overall effect. Each cause or
reason for imperfection is a source of variation. Causes
are usually grouped into major categories to identify these
sources of variation. The categories typically include
 People: Anyone involved with the process
 Methods: How the process is performed and the
specific requirements for doing it, such as policies,
procedures, rules, regulations and laws
 Machines: Any equipment, computers, tools, etc.
required to accomplish the job
 Materials: Raw materials, parts, pens, paper, etc.
used to produce the final product
 Measurements: Data generated from the process
that are used to evaluate its quality
 Environment: The conditions, such as location,
time, temperature, and culture in which the process
operates
6. Histogram method

7. A histogram is a graphical representation of the
distribution of data. It is an estimate of the probability
distribution of a continuous variable (quantitative
variable) and was first introduced by Karl Pearson.[1] To
construct a histogram, the first step is to "bin" the range of
values -- that is, divide the entire range of values into a
series of small intervals -- and then count how many
values fall into each interval. A rectangle is drawn with
height proportional to the count and width equal to the bin
size, so that rectangles abut each other. A histogram may
also be normalized displaying relative frequencies. It then
shows the proportion of cases that fall into each of several
categories, with the sum of the heights equaling 1. The
bins are usually specified as consecutive, non-overlapping
intervals of a variable. The bins (intervals) must be
adjacent, and usually equal size.[2] The rectangles of a
histogram are drawn so that they touch each other to
indicate that the original variable is continuous.[3]
III. Other topics related to Quality management approach (pdf download)
quality management systems
quality management courses
quality management tools
iso 9001 quality management system
quality management process
quality management system example
quality system management
quality management techniques
quality management standards
quality management policy
quality management strategy
quality management books