Software Quality Characteristics: ISO 9126 and ISO 25010

Software quality is a core topic in IHK examinations for IT specialists and in everyday software development practice. In exams, you need to explain quality characteristics, assess them, and apply them in project documentation. In practice, software quality determines project success, customer satisfaction, and long-term maintainability. Understanding these ISO standards helps you communicate about quality professionally and define measurable criteria.

This article provides a technical overview of quality characteristics according to ISO 9126 and ISO 25010, including exam questions and key concepts.

In a Nutshell

• ISO 9126: older model with 6 main characteristics.
• ISO 25010: modernized, 8 main characteristics, more refined, adds Security and Compatibility.

Both serve to specify, evaluate, and communicate software quality in measurable terms.

Concise Technical Description

ISO 9126 (6 Characteristics)

1. Functionality
2. Reliability
3. Usability
4. Efficiency
5. Maintainability
6. Portability

ISO 25010 (8 Characteristics)

1. Functional Suitability
2. Performance Efficiency
3. Compatibility
4. Usability
5. Reliability
6. Security
7. Maintainability
8. Portability

Key shifts and what they mean in practice:

Interoperability moves from Functionality to Compatibility In ISO 9126, interoperability was part of functionality—the ability to work with other systems. In ISO 25010, this becomes Compatibility, because it’s no longer just about the function itself but about the fundamental ability to integrate different systems. Example: A CRM system must not only export data (function) but also work with ERP systems from different vendors (compatibility).

Efficiency becomes Performance Efficiency Efficiency focused mainly on resource utilization. Performance Efficiency expands this to include capacity and resource behavior under load. Example: A web application must not only be fast (efficiency) but also remain stable with 1,000 concurrent users (capacity).

Security becomes a standalone main characteristic Previously, security was often embedded in other characteristics. Today it’s a standalone main characteristic because cybersecurity is critical. Example: A banking app must not only function correctly but also be protected against attack.

Maintainability replaces Changeability Maintainability is broader and includes modularity, reusability, and testability. Example: An e-commerce system must not only be easy to change but also simple to test and with reusable components.

Portability replaces Transferability Portability is more precisely defined and includes installability and replaceability. Example: An application must not only run on different operating systems but also be straightforward to install and migrate.

Exam-Relevant Points

• Difference between 9126 and 25010 (6 vs. 8 characteristics, new priorities)
• Name typical sub-characteristics (Functional Completeness, Time Behaviour, Availability, Modifiability, Installability)
• Define metrics and evidence (response time, error rate, MTTR, code metrics, usability scores)
• Formulate acceptance measurably (acceptance criteria per sub-characteristic)
• Recognize trade-offs (performance vs. security, maintainability vs. portability)
• Use mapping between 9126 and 25010 (for legacy modernization)
• Economics: quality reduces failure costs, accelerates delivery

Core Components

1. Main characteristics and sub-characteristics (both standards)
2. Mapping guide (9126 to 25010)
3. Measurement concept (target values, procedures, CI integration)
4. Evidence artifacts (requirements specification, tests, monitoring)
5. Governance (responsibilities, reviews)
6. Risks and mitigations (e.g., caching vs. consistency)
7. Documentation (end-to-end traceability)

Practical Example (Web API for Order Processing)

Functional Suitability:
- Functional Completeness: all use-case endpoints present
- Functional Correctness: discount and tax calculations 100% correct (unit and contract tests)
- Functional Appropriateness: no unnecessary endpoints

Performance Efficiency:
- Time Behaviour: 95th percentile under 200ms at 100 users
- Resource Utilization: CPU under 60%, Memory OOM rate 0
- Capacity: 500 requests per second without SLA breach

Compatibility:
- Interoperability: OpenAPI-compliant, contract tests green
- Co-existence: runs in parallel on tenant systems

Usability:
- Learnability: onboarding under 30 minutes (task success)
- User Error Protection: validation prevents 99% of syntactic errors
- Accessibility: WCAG AA compliant

Reliability:
- Availability: 99.9% monthly
- Fault Tolerance: circuit breaker on third-party system failures
- Recoverability: MTTR under 30 minutes (warm standby)

Security:
- Confidentiality: transport encryption, secrets in vault
- Integrity: signed events, checksums
- Authenticity: OIDC and MFA for admins
- Accountability: immutable audit log

Maintainability:
- Modularity: layering, no cycles
- Analysability: logs with correlations, traces
- Modifiability: feature flags, clear scope
- Testability: 70% unit, 20% integration, 10% E2E

Portability:
- Adaptability: configurable tenants
- Installability: one-command deployment
- Replaceability: database swappable via port adapter

Strengths and Limitations

Strengths

• Common language for discussing quality
• Measurable goals lead to better architectural decisions
• Lower failure and operational costs
• Faster acceptance testing

Limitations

• Effort required to define and measure
• Possible conflicts between goals
• Risk of bureaucracy without genuine practice

Typical Exam Questions (with Short Answers)

1. What is the difference between ISO 9126 and 25010? 25010 has 8 instead of 6 characteristics; new additions are Security and Compatibility, with more refined sub-characteristics.
2. Where is interoperability in 25010? Under Compatibility.
3. What does Performance Efficiency cover? Time Behaviour, Resource Utilization, Capacity.
4. Sub-characteristics of Maintainability? Modularity, Reusability, Analysability, Modifiability, Testability.
5. Example of a measurable Reliability requirement? 99.9% availability per month, MTTR less than 30 minutes.

Key Sources

1. https://iso25000.com
2. https://en.wikipedia.org/wiki/ISO/IEC_25010
3. https://en.wikipedia.org/wiki/ISO/IEC_9126