External Review of Software Development Lifecycle Process

This Tender is invited by the Issuer. Overview The Clean Energy Regulator (CER) is seeking an external provider to independently review the software development lifecycle processes used to maintain, enhance, support and govern a key legacy system for the CER. The review will identify risks, gaps and improvement opportunities, and provide practical recommendations to improve quality, security, maintainability and decrease risk when operating these systems. Objectives Assess whether current lifecycle processes are documented, consistently applied and fit for purpose Identify process gaps, risks and control weaknesses Recommend practical, prioritised improvements to governance, delivery quality, assurance, security, supportability and modernisation readiness Provide clear and actionable advice that can increase delivery confidence and reduce delivery risk Scope The scope includes: Review of end-to-end lifecycle processes, including demand intake, requirements definition and prioritisation, design, development, testing, release, change control, operations and support Consideration of both documented processes and actual working practices across business, technology and support teams Assessment of key dependencies, including related applications, data, integrations, infrastructure and business processes Required Review Areas Development, source control, configuration, build and environment management Release, deployment, change control, rollback and post-implementation review Testing, quality assurance, defect management and release readiness Architecture, design, technical debt and documentation Maintainability and managing components approaching end-of-life or end-of-support Demand intake, requirements capture, prioritisation and approvals Security, privacy, and knowledge management Operations, support, incident and problem management, monitoring and performance management, and service levels Governance, accountabilities and decision rights Deliverables Review plan covering scope, approach, activities, information required and schedule Current-state assessment of lifecycle processes, roles, controls, risks and pain points Gap and risk assessment against good practice expectations Prioritised recommendations, including quick wins and longer-term improvements Implementation roadmap with recommended actions, sequencing, dependencies and suggested owners Final report and executive presentation Contractor Requirements Expected Provider Capability Demonstrated experience reviewing SDLC processes for complex, business-critical or legacy systems Practical experience in application delivery, maintenance, quality assurance, release management, secure development and operational support Ability to assess both process maturity and real-world delivery effectiveness Clear communication with both technical and non-technical audiences Examples of similar work, proposed personnel, relevant qualifications and proposed methodology