Descriptive software process modeling. How to deal with sensitive process information

Descriptive software process models are important assets in software process improvement. The accuracy of the model, i. e., the degree to which it reflects the process as it is actually performed, is a key to the success of process improvement programs. To develop such a process model, a Process Engineer collects available process information, which is subsequently summarized in a process model. The information needed to develop an accurate description of the process is often sensitive, regarding, for instance, work practices that are not followed as described in the official process documentation. Revealing this sensitive information to others people within the software organization can be harmful for the information providers. Therefore, dealing with this type of information imposes ethical responsibilities to the Process Engineer and can put Process Engineers into an awkward situation. This paper lists experience from descriptive process modeling cases in industry where sensitive information was provided and provides guidelines on how to deal with such information.