Capability Maturity Model (CMM) Overview
The Software Engineering Institute (SEI) at Carnegie Melon University, sponsored by the US Department of Defence, developed the Capability Maturity Model (CMM v1.0) between 1986 and 1991. Following a workshop held in April 1992, the model was updated to v1.1 using the feedback received from about 200 software professionals.
The model is a conceptual framework based on industry best practice, used to assess the process maturity, capability and performance of software development organisations. The framework offers organisations the opportunity to identify areas for software process improvement.
The CMM framework contains five levels:
- Initial
- Repeatable
- Defined
- Managed
- Optimising
Except for level 1, each level consists of several key process areas an organisation should focus on to improve its software process. Key process areas identify the issues that must be addressed to achieve a maturity level.
Level 1: Initial
The first level is generally considered as unplanned, occasionally chaotic, and non-process driven with success depending on individual effort.
Level 2: Repeatable
- Software configuration management
- Software quality assurance
- Software subcontract management
- Software project tracking and oversight
- Software project planning
- Requirements management
Level 3: Defined
- Peer reviews
- Inter-group coordination
- Software product engineering
- Integrated software management
- Organisation process focus
- Training program
- Organisation process definition
- Organisation process focus
Level 4: Managed
- Software quality management
- Quantitative process management
Level 5: Optimising
- Process change management
- Technology change management
- Defect prevention
An organisation that has achieved the higher levels is also assessed at the lower level criteria with stricter requirements.
Many organisations are claiming to have achieved CMM Level 4 or 5 and to be officially certified by the Software Engineering Institute (SEI). However, it is not unusual for companies to issue a press release stating that the assessment has been done at Level 5, without actually pointing out which criteria have been assessed and satisfied at that level, therefore the overall CMM assessment of the organisation may actually be nil or remain at a lower level.
As an example of good practice, the organisation should state, "Process capability has been independently assessed at a Software Engineering Institute (SEI) Capability Maturity Model (CMM) level 3. The level 5 key process area of Process Change Management has also been satisfied."
This statement describes exactly where the organisation is on the CMM staircase. It says that all the Level 2 and 3 criteria have been assessed and are satisfactory to SEI standards, as well as satisfying one level 5 criterion
Interesting CMM Facts[1]
- Average time to reach CMM level 5 with first assessment at level 2 is five to six years
- Total number of assessments from 1987 through December 2002 is 2616
- About 2000 organisations worldwide have been assessed
- Only a third of assessed organisations reached level 3 and above
- Organisation Maturity Profile (April 2003)
-
- CMM 1 - 16.9%
- CMM 2 - 43.2%
- CMM 3 - 24.6%
- CMM 4 - 8.0%
- CMM 5 - 7.3%
- Software Quality Assurance is the least frequently satisfied level 2 process area among organisations assessed at level 1
- Integrated Software Management is the least frequently satisfied level 3 process area among organisations assessed at level 2
- On average, it takes an organisation:
- - 22 months to move from level 1 to 2
- 21 months to move from level 2 to 3
- 25 months to move from level 3 to 4
- 15 months to move from level 4 to 5
- Higher maturity has been reached among those organisations reporting reappraisals
Some examples of CMM level five organisations are:
- NASA: Onboard Shuttle Group
- Boeing Defence & Space Group (since 1996)
- IBM Federal Systems (since 1994)
There has been a lot of interest in CMM assessments in the past 2 to 3 years. Many organisations have been assessed and received various levels of certification. About a third of recently CMM certified companies are based offshore in countries such as India.
An important point to consider is that we are not talking about only achieving a high CMM Level, but sustaining the processes at that same level over years.