Explore Black History

Capability Maturity Model Integration (CMMI) is a process level improvement training and appraisal program. Administered by the CMMI Institute, a subsidiary of the Information Systems Audit and Control Association (ISACA), it was developed at Carnegie Mellon University (CMU). It is required by many U.S. Government contracts, especially in software development. CMU claims CMMI can be used to guide process improvement across a project, division, or an entire organization.

CMMI defines five maturity levels (1 to 5) for processes: Initial, Managed, Defined, Quantitatively Managed, and Optimizing. CMMI Version 3.0 was published in 2023;^[1] CMMI is registered in the U.S. Patent and Trademark Office by CMU.^[2]

Originally, CMMI addresses three areas of interest, each with a separate model:

1. Product and service development – CMMI for Development (CMMI-DEV)
2. Service establishment, management – CMMI for Services (CMMI-SVC)
3. Product and service acquisition – CMMI for Acquisition (CMMI-ACQ)

In version 2.0, the three areas were merged into one model.

CMMI was developed by a group from industry, government, and the Software Engineering Institute (SEI) at CMU. CMMI models provide guidance for developing or improving processes that meet the business goals of an organization. A CMMI model may also be used as a framework for appraising the process maturity of the organization.^[3] By January 2013, the entire CMMI product suite was transferred from the SEI to the CMMI Institute, a newly created organization at Carnegie Mellon.^[4]

CMMI was developed by the CMMI project, which aimed to improve the usability of maturity models by integrating many different models into one framework. The project consisted of members of industry, government and the Carnegie Mellon Software Engineering Institute (SEI). The main sponsors included the Office of the Secretary of Defense (OSD) and the National Defense Industrial Association.

CMMI is the successor of the capability maturity model (CMM) or Software CMM. The CMM was developed from 1987 until 1997. Version 1.1 was released in 2002, version 1.2 in August 2006, and version 1.3 in November 2010. Some major changes in CMMI V1.3^[5] are support of agile software development,^[6] improvements to high maturity practices^[7] and aligning the representation (staged and continuous).^[8]

According to the Software Engineering Institute (SEI, 2008), CMMI helps "integrate traditionally separate organizational functions, set process improvement goals and priorities, provide guidance for quality processes, and provide a point of reference for appraising current processes."^[9]

Mary Beth Chrissis, Mike Konrad, and Sandy Shrum Rawdon were the authoring team for the hard copy publication of CMMI for Development Version 1.2 and 1.3. The Addison-Wesley publication of Version 1.3 was dedicated to the memory of Watts Humphry. Eileen C. Forrester, Brandon L. Buteau, and Sandy Shrum were the authoring team for the hard copy publication of CMMI for Services Version 1.3. Rawdon "Rusty" Young was chief architect for developing CMMI version 2.0. He was formerly CMMI Product Owner and SCAMPI Quality Lead for the Software Engineering Institute.

In March 2016, the CMMI Institute was acquired by ISACA. In March 2018, the CMMI V2.0 was released. In April 2023, the CMMI V3.0 was released.

In version 1.3, CMMI existed in two representations: continuous and staged.^[3] The continuous representation is designed to allow the user to focus on the specific processes that are considered important for the organization's immediate business objectives, or those to which the organization assigns a high degree of risks. The staged representation is designed to provide a standard sequence of improvements, and can serve as a basis for comparing the maturity of different projects and organizations. The staged representation also provides for an easy migration from the SW-CMM to CMMI.^[3]

In version 2.0 the above representation separation was cancelled and there is now only one cohesive model.^[10]

Depending on the areas of interest (acquisition, services, development) used, the process areas it contains will vary.^[11] Process areas are the areas that will be covered by the organization's processes. The table below lists the seventeen CMMI core process areas that are present for all CMMI areas of interest in version 1.3.

The process areas below and their maturity levels are listed for the CMMI for services model:

Maturity Level 2 – Managed

• CM – Configuration Management
• MA – Measurement and Analysis
• PPQA – Process and Quality Assurance
• REQM – Requirements Management
• SAM – Supplier Agreement Management
• SD – Service Delivery
• WMC – Work Monitoring and Control
• WP – Work Planning

Maturity Level 3 – Defined

• CAM – Capacity and Availability Management
• DAR – Decision Analysis and Resolution
• IRP – Incident Resolution and Prevention
• IWM – Integrated Work Managements
• OPD – Organizational Process Definition
• OPF – Organizational Process Focus...
• OT – Organizational Training
• RSKM – Risk Management
• SCON – Service Continuity
• SSD – Service System Development
• SST – Service System Transition
• STSM – Strategic Service Management

Maturity Level 4 – Quantitatively Managed

• OPP – Organizational Process Performance
• QWM – Quantitative Work Management

Maturity Level 5 – Optimizing

• CAR – Causal Analysis and Resolution.
• OPM – Organizational Performance Management.

CMMI best practices are published in documents called models, each of which addresses a different area of interest. Version 1.3 provides models for three areas of interest: development, acquisition, and services.

• CMMI for Development (CMMI-DEV), v1.3 was released in November 2010. It addresses product and service development processes.
• CMMI for Acquisition (CMMI-ACQ), v1.3 was released in November 2010. It addresses supply chain management, acquisition, and outsourcing processes in government and industry.
• CMMI for Services (CMMI-SVC), v1.3 was released in November 2010. It addresses guidance for delivering services within an organization and to external customers.

In version 2.0 DEV, ACQ and SVC were merged into a single model where each process area potentially has a specific reference to one or more of these three aspects. Trying to keep up with the industry the model also has explicit reference to agile aspects in some process areas.

Some key differences between v1.3 and v2.0 models are given below:

1. "Process Areas" have been replaced with "Practice Areas (PA's)". The latter is arranged by levels, not "Specific Goals".
2. Each PA is composed of a "core" [i.e. a generic and terminology-free description] and "context-specific" [ i.e. description from the perspective of Agile – Scrum, development, services, etc.] section.
3. Since all practices are now compulsory to comply, "Expected" section is removed.
4. "Generic Practices" have been put under a new area called "Governance and Implementation Infrastructure", while "Specific practices" have been omitted.
5. Emphasis on ensuring implementation of PA's and that these are practised continuously until they become a "habit".
6. All maturity levels focus on the keyword "performance".
7. Two and five optional PA's from "Safety" and "Security" purview have been included.
8. PCMM process areas have been merged.

Organizations cannot be certified in CMMI; instead, they undergo a CMMI appraisal to evaluate the implementation and institutionalization of practices defined by the CMMI model. Depending on the scope and objectives of the appraisal, an organization may receive a maturity level (Levels 1–5) for a defined organizational unit or a capability level for individual practice areas.

Organizations typically conduct appraisals for one or more of the following purposes:

1. to evaluate how their processes compare with CMMI best practices;
2. to identify strengths, weaknesses, and opportunities for process improvement;
3. to demonstrate process capability and organizational maturity to customers, suppliers, or other stakeholders; and
4. to satisfy contractual or regulatory requirements.

Since the introduction of CMMI Version 2.0, appraisals are performed using the CMMI Appraisal Method (CAM). CAM replaced the former Standard CMMI Appraisal Method for Process Improvement (SCAMPI) and the associated Appraisal Requirements for CMMI (ARC) framework used in earlier versions of the model.

CAM defines two principal appraisal types:

1. Benchmark Appraisal, the formal appraisal used to determine an organization's official maturity level or capability level(s); and
2. Sustainment Appraisal, used by organizations that have previously achieved a maturity level to confirm that their practices continue to satisfy CMMI requirements between Benchmark Appraisals.

Benchmark Appraisals are conducted by authorized lead appraisers and appraisal teams following the requirements established by the CMMI Institute, now part of ISACA. Organizations may choose to publish successful appraisal results in the official Published Appraisal Results (PARS) repository maintained by the CMMI Institute.

Organizations frequently perform internal readiness assessments or gap analyses before a formal appraisal to identify areas requiring improvement. Unlike the former SCAMPI Class C appraisals, these activities are not formal appraisal classes but preparation activities supporting a subsequent Benchmark Appraisal.

To address user security concerns, two unofficial security guides are available. Considering the Case for Security Content in CMMI for Services has one process area, Security Management.^[12] Security by Design with CMMI for Development, Version 1.3 has four process areas:

1. OPSD – Organizational Preparedness for Secure Development
2. SMP – Secure Management in Projects
3. SRTS – Security Requirements and Technical Solution
4. SVV – Security Verification and Validation

While they do not affect maturity or capability levels, these process areas can be reported in appraisal results.^[13]

The SEI published a study saying 60 organizations measured increases of performance in the categories of cost, schedule, productivity, quality and customer satisfaction.^[14] The median increase in performance varied between 14% (customer satisfaction) and 62% (productivity). However, the CMMI model mostly deals with what processes should be implemented, and not so much with how they can be implemented. These results do not guarantee that applying CMMI will increase performance in every organization. A small company with few resources may be less likely to benefit from CMMI; this view is supported by the process maturity profile (page 10). Of the small organizations (<25 employees), 70.5% are assessed at level 2: Managed, while 52.8% of the organizations with 1,001–2,000 employees are rated at the highest level (5: Optimizing).

Turner & Jain (2002) argue that although it is obvious there are large differences between CMMI and agile software development, both approaches have much in common. They believe neither way is the 'right' way to develop software, but that there are phases in a project where one of the two is better suited. They suggest one should combine the different parts of the methods into a new hybrid method. Sutherland et al., (2007) assert that a combination of Scrum and CMMI brings more adaptability and predictability than either one alone.^[15] David J. Anderson (2005) gives hints on how to interpret CMMI in an agile manner.^[16]

CMMI Roadmaps,^[17] which are a goal-driven approach to selecting and deploying relevant process areas from the CMMI-DEV model, can provide guidance and focus for effective CMMI adoption. There are several CMMI roadmaps for the continuous representation, each with a specific set of improvement goals. Examples are the CMMI Project Roadmap,^[18] CMMI Product and Product Integration Roadmaps^[19] and the CMMI Process and Measurements Roadmaps.^[20] These roadmaps combine the strengths of both the staged and the continuous representations.

The combination of the project management technique earned value management (EVM) with CMMI has been described.^[21] To conclude with a similar use of CMMI, Extreme Programming (XP), a software engineering method, has been evaluated with CMM/CMMI (Nawrocki et al., 2002). For example, the XP requirements management approach, which relies on oral communication, was evaluated as not compliant with CMMI.

CMMI can be appraised using two different approaches: staged and continuous. The staged approach yields appraisal results as one of five maturity levels. The continuous approach yields one of four capability levels. The differences in these approaches are felt only in the appraisal; the best practices are equivalent resulting in equivalent process improvement results.

• Capability Immaturity Model
• Capability Maturity Model
• Enterprise Architecture Assessment Framework
• People Capability Maturity Model
• Software Engineering Process Group

Wikimedia Commons has media related to Capability Maturity Model Integration.

• Official website