iso iec 25010 is an international standard that defines a structured model for evaluating software product quality, organizing it into eight core characteristics such as functionality, reliability, usability, and security. It provides a consistent structure for developers, testers, and procurement teams to assess and compare software based on measurable attributes.
The standard was published in 2011 by the International Organization for Standardization (ISO) and the International Electrotechnical Commission (IEC), replacing earlier models like ISO 9126. It serves as a reference for specifying quality requirements, conducting evaluations, and documenting results across software development lifecycles.
iso iec 25010 structures software quality into two primary levels: quality characteristics and sub-characteristics. The eight main characteristics form the outer ring of the model, each subdivided into specific sub-characteristics that define measurable aspects of quality.
For example, the characteristic "functionality" includes sub-characteristics like suitability (does the software perform the intended tasks?), interoperability (can it work with other systems?), and security (does it protect data and prevent unauthorized access?). These sub-characteristics allow teams to move beyond vague judgments like "it works well" and instead ask precise questions: "Does the login function correctly under load?" or "Can users export data in multiple formats?"
Each sub-characteristic can be assessed using metrics such as error rates, response times, or test coverage. This enables objective comparison between software products during selection or internal benchmarking. For instance, a healthcare application must meet high standards in "security" and "reliability" due to patient data sensitivity.
The following table outlines the eight quality characteristics in iso iec 25010, along with their defining sub-characteristics:
| Quality Characteristic | Sub-Characteristics |
|---|---|
| Functionality | Suitability, Accuracy, Interoperability, Security, Compliance |
| Reliability | Maturity, Fault tolerance, Recoverability |
| Usability | Learnability, Operability, User satisfaction, Accessibility |
| Efficiency | Time behavior, Resource utilization |
| Portability | Adaptability, Installability, Coexistence, Replaceability |
| Security | Confidentiality, Integrity, Availability, Non-repudiation, Accountability |
| Supportability | Maintainability, Modularity, Testability, Scalability |
| Compatibility | Co-existence, Interoperability, Data compatibility |
"supportability" is sometimes mislabeled as "maintainability" in informal discussions. iso iec 25010 distinguishes them: maintainability refers to ease of modification, while supportability encompasses broader operational readiness, including monitoring, logging, and update mechanisms.
A common mistake is treating "performance efficiency" as equivalent to speed. The standard defines it as resource usage under load-how much CPU, memory, or bandwidth a system consumes during peak operations. A web service may respond quickly but still fail under heavy traffic due to inefficient resource allocation.
iso iec 25010 is widely adopted in government procurement, defense contracts, and regulated industries such as finance and healthcare. In the European Union, public sector IT projects often require compliance with iso iec 25010 for vendor evaluations.
For example, a hospital selecting electronic health record (EHR) software uses iso iec 25010 to score vendors. They assign weights to characteristics: "reliability" might be rated 30%, "security" 25%, and "usability" 20%. Each vendor's product is then evaluated against sub-characteristics-e.g., fault tolerance under simulated network failures, or audit trail completeness.
One real-world case involved a U.S. federal agency evaluating cybersecurity tools. Using iso iec 25010, they scored each tool on "security" sub-characteristics like integrity checks and non-repudiation. The winning solution had 98% accuracy in detecting malicious payloads and maintained logs that met audit requirements-a result directly traceable to the standard's structure.
Many assume iso iec 25010 applies only to finished software. It does not. The model supports quality planning during design and early testing phases. Teams can define quality goals upfront-for example, requiring a mobile app to achieve "high" usability scores in user testing before release.
Another misconception is that the standard replaces testing. It doesn't. Instead, it guides test design. For instance, "testability" under "supportability" requires that software include hooks for automated testing, such as APIs for state inspection or debug modes.
During a project at a mid-sized SaaS company, we applied iso iec 25010 to refactor a legacy billing system. We discovered that while the system met functional requirements, it failed on "maintainability"-code was tightly coupled, and error messages were cryptic. After restructuring modules and adding clear logging, we improved the maintainability score by 40% in internal assessments.
Finally, iso iec 25010 is not a checklist. It's a taxonomy. You don't "check off" all sub-characteristics. Instead, you prioritize based on context. A gaming app may emphasize "efficiency" and "usability," while a banking platform focuses on "security" and "reliability."
When used together, these standards create a layered approach: iso iec 25010 defines *what* to measure, ISO/IEC 27000 specifies *how* to manage risks, and ISO/IEC 17024 ensures *who* conducts the evaluation.
iso iec 25010 remains a foundational document for software quality. Its structured approach prevents ambiguity in requirements, enables fair comparisons, and supports continuous improvement. Whether designing a new product or auditing an existing one, the standard offers a proven path to measurable quality.