The Capability Maturity Model (CMM)
The Capability Maturity Model (CMM) is a methodology used to develop and refine an organization's software development process. The model describes a five-level evolutionary path of increasingly organized and systematically more mature processes.
History
The Capability Maturity Model was initially funded by military research. The United States Air Force funded a study at the Carnegie-Mellon Software Engineering Institute to create a model for the military to use as an objective evaluation of software subcontractors. The result was the Capability Maturity Model, published as Managing the Software Process in 1989.
Software Process
A software process can be defined as a set of activities, methods, practices, and transformations that people use to develop and maintain software and the associated products
Example: project plans, design documents, code, test cases, and user manuals.
As an organization matures, the software process becomes better defined and more consistently implemented throughout the organization.
Maturity Model
A maturity model is a structured collection of elements that describe characteristics of effective processes.
A maturity model can be used as a benchmark for assessing different organizations for equivalent comparison. It describes the maturity of the company based upon the project the company is dealing with the clients.
How can the CMM help an organization?
First, the CMM helps build an understanding of software process by describing the practices that contribute to a level of process maturity.
The second role of the CMM is to provide a consistent basis for conducting appraisals of software processes. The CMM defines a scale for measuring process maturity, thus allowing an organization to accurately compare its process capability to that of another organization. ISO is using the CMM in its efforts to develop international standards for software process assessments.
The CMM 's third role is to serve as a blueprint for software process improvement. The CMM can help an organization focus on the areas it must address in order to advance to the next level of maturity.
CMM 's Five Maturity Levels of Software Processes
IT management uses the CMM tool to improve the software development process. There are two steps to use the tool. The first step is to measure where the organization stands in terms of the CMM levels. The next step is to use the CMM tool for process improvement to move the organization up to the next level.
Level 1 Initial level:
At this level, processes are disorganized, even chaotic. Success is likely to depend on individual efforts. Even in large organizations, CMM Level 1 is common. Many times, software development takes place in department and business unit groups without any centralized direction or control. Duplication of systems functionality and incompatible systems are developed without considering the needs of the overall organization. There is little sharing of knowledge or code because each software developer might use different tools and techniques.
The only advantage of CMM Level 1 software development is that the software might be developed quickly to meet the exact needs of the business unit. But this one advantage is heavily outweighed by the inefficiencies caused by the chaotic nature of this process.
Level 2 Repeatable level:
Basic project management processes are established to track cost, schedule, and functionality. The necessary process discipline is in place to repeat earlier successes on projects with similar applications. For an organization to have a repeatable process, the project management controls and discipline that are provided by the Level 2 KPAs must first be established. Without a foundation of disciplined project management, even effective software engineering procedures may be abandoned during times of schedule pressure or rapidly changing requirements.
Level 3 Defined level:
The software process for both management and engineering activities is documented, standardized, and integrated into a standard software process for the organization. All projects use an approved, tailored version of the organization's standard software process for developing and maintaining software.
At CMM Level 3, software development for the organization is centralized.
Individual departments and business units may still employee development groups, but management oversight and software development processes are centrally controlled. In many companies, all software development is centralized and business units contract with the software development group for services.
By eliminating duplication of effort and allowing better integration of software across the organization, operating at CMM Level 3 provides benefits that help the organization meet its business goals.
Level 4 Managed level:
At this level, an organization monitors and controls its own processes through data collection and analysis. At CMM Level 4, the software development group collects performance and quality metrics to measure how well it is doing. Caution must be used at this step to collect the right metrics. Many organizations begin by attempting to collect too much information and the process becomes overly bureaucratic and costly.
Level 5 Optimizing level:
Quantitative feedback from the process and from piloting innovative ideas and technologies enables continuous process improvement. An organization reaches CMM Level 5 by taking the process and quality data it began collecting, using it in Level 4, and creating a feedback loop to continuously monitor and control the software development process. At Level 5, quality control is built into the software development process. An important benefit for an organization operating at CMM Level 5 is the ability to try out new technologies and processes with a reduced risk of failure. Because the software development process is constantly monitored, a new technique or process can be stopped or adjusted if it does not perform adequately.
Key Process Areas(KPAs) of CMM
Each CMM level focuses on a series of Key Process Areas (KPAs) . The KPA's for a particular level are the focus of enhancements. As processes are systematically implemented, it helps an organization to move to the next maturity level. Within each KPA, is a set of key practices to be taken in order to effectively follow and institutionalize the achievement of the process goals.
Maturity Level | Key Process Areas |
1 | No KPAs |
2 | a. Software Requirement Management The purpose of Requirements Management is to manage requirements of the project’s products and product components and to ensure alignment between those requirements and the project’s plans and work products. b. Software Project Planning The purpose of Software Project Planning is to establish reasonable plans for performing the software engineering and for managing the software project. c. Software Project Tracking & Oversight The purpose of Software Project Tracking and Oversight is to provide adequate visibility into actual progress so that management can take effective actions when the software project's performance deviates significantly from the software plans. d. Software Subcontract Management The purpose of Software Subcontract Management is to select qualified software subcontractors and manage them effectively. e. Software Quality Assurance The purpose of Software Quality Assurance is to provide management with appropriate visibility into the process being used by the software project and of the products being built. f. Software Configuration Management The purpose of Software Configuration Management is to establish and maintain the integrity of the products of the software project throughout the project's software life cycle. |
3 | a. Organizational Process Focus The purpose of Organization Process Focus is to establish the organizational responsibility for software process activities that improve the organization's overall software process capability. Organization Process Focus involves developing and maintaining an understanding of the organization's and projects' software processes and coordinating the activities to assess, develop, maintain, and improve these processes. b. Organizational Process Definition The purpose of Organization Process Definition is to develop and maintain a usable set of software process assets that improve process performance across the projects and provide a basis for cumulative, long-term benefits to the organization. Organization Process Definition involves developing and maintaining the organization's standard software process, along with related process assets, such as descriptions of software life cycles, process tailoring guidelines and criteria, the organization's software process database, and a library of software process-related documentation. c.Training Program The purpose of the Training Program key process area is to develop the skills and knowledge of individuals so they can perform their roles effectively and efficiently. Training Program involves first identifying the training needed by the organization, projects, and individuals, then developing or procuring training to address the identified needs. d. Software Product Engineering The purpose of Software Product Engineering is to consistently perform a well-defined engineering process that integrates all the software engineering activities to produce correct, consistent software products effectively and efficiently. e. Integrated Software Management The purpose of Integrated Software Management is to integrate the software engineering and management activities into a coherent, defined software process that is tailored from the organization's standard software process to address the specific characteristics of the project f. Inter-Group Coordination The purpose of Intergroup Coordination is to establish a means for the software engineering group to participate actively with the other engineering groups so the project is better able to satisfy the customer's needs effectively and efficiently. g. Peer Review Peer Reviews involve a methodical examination of software work products by the producers' peers to identify defects and areas where changes are needed. The specific products that will undergo a peer review are identified in the project's defined software process and scheduled as part of the software project planning activities. |
4 | a. Software Quantitative Process Management The purpose of Quantitative Process Management is to control the process performance of the software project quantitatively. Software process performance represents the actual results achieved from following a software process. b. Software Quality Management Software Quality Management involves defining quality goals for the software products, establishing plans to achieve these goals, and monitoring and adjusting the software plans, software work products, activities, and quality goals to satisfy the needs and desires of the customer and end user for high quality products. |
5 | a. Defect Prevention Defect Prevention involves analyzing defects that were encountered in the past and taking specific actions to prevent the occurrence of those types of defects in the future. The defects may have been identified on other projects as well as in earlier stages or tasks of the current project. Defect prevention activities are also one mechanism for spreading lessons learned between projects. . b. Technology Change Management Technology Change Management involves identifying, selecting, and evaluating new technologies, and incorporating effective technologies into the organization. The objective is to improve software quality, increase productivity, and decrease the cycle time for product development. c. Process Change Management The purpose of Process Change Management is to continually improve the software processes used in the organization with the intent of improving software quality, increasing productivity, and decreasing the cycle time for product development. |
A simple example can explain all of the five levels for an organization:
LEVEL 1
GIAC Bikes got into the software development business when the World Wide Web became popular. GIAC Bikes wanted a web presence, and one of the offices personal volunteered to develop the GIACBikes.com web site. The volunteer had no formal software development training but did an excellent job getting the web site developed. The GIACBikes.com web site was very popular and generated much new business for GIAC Bikes. Over the years, new features were added and the web site became more and more mission critical for GIAC Bikes. As developer left the company, others stepped up to run the web site; however, a little was documented, and the system became complex and hard to maintain. Serious security and operational problems surfaced regularly. These problems were difficult and costly to correct because no one person knew how the system was developed or how it operated. GIAC Bikes management decides that the organization needs a better way to develop and maintain the GIACBikes.com web site software.
LEVEL 2
GIAC Bikes management takes the following steps to move the software development process from Level 1 (ad hoc) to Level 2 (repeatable):
1. Training – GIAC Bikes programmers receive training in software development techniques and processes, including the Software Development Lifecycle (SDLC).
2. Organization – GIAC Bikes management creates a business analyst position. The business analyst job description includes overall responsibility for GIAC Bikes software development and web site. The business analyst job title may be different (i.e. systems analyst, IT project manager), but the job function to direct and control the software development process is the same.
Now, the GIAC Bikes software development process has some definition as new projects are developed with a SDLC methodology. The software development function is led by a person whose job is to organize the development efforts and be sure the software meets the needs of GIAC Bikes.
GIAC Bikes software is now built and documented using a known process and so, it becomes easier and cheaper to maintain and enhance the software.
LEVEL 3
After gaining experience operating at CMM Level 2, GIAC Bikes management decides it needs further improvement in the software development process. To move from CMM Level 2 (repeatable) to CMM Level 3 (defined), GIAC Bikes management takes these steps:
1. Project Management – GIAC Bikes institutes a formal Project Management Office (PMO). The PMO is a central place to manage all GIAC Bikes software development projects. GIAC Bikes institutes a formal company policy giving the PMO responsibility for software development projects and project management and SDLC methodologies.
2. Custom SDLC methodology - Based on experience from operating at CMM Level 2, GIAC Bikes customizes a SDLC methodology around its unique business needs. At Level 3 of the CMM, GIAC Bikes elevates the importance of the software development process for the organization by formalizing the SDLC process and centralizing control over the process. This step adds stronger management oversight to the software development process. By customizing the process methodology, GIAC Bikes makes the process more efficient because those decisions do not have to be made for each new project.
LEVEL 4
At CMM Level 4, GIAC Bikes identifies metrics to measure the effectiveness of its project management and SDLC methodologies. Some example metrics include schedule and cost performance measures for project management and software defect rates (including security defects) for software development. This is a difficult and costly step because collecting and analyzing quantitative metrics is time-consuming. But GIAC Bikes finds that the payoff is worth the cost as it can identify problem areas in its processes and correct the problems. It also allows GIAC Bikes management to spot projects that are beginning to go out of control and take corrective action before the project crashes. Putting quantitative metric collection process in place now allows GIAC Bikes to move to the final CMM level.
LEVEL 5
With quality metrics in place from CMM Level 4 (managed), GIAC Bikes is ready to reap the full benefit from its software development process improvements. Because GIAC Bikes can measure the effects of changes to the software development process, it can try new techniques and measure the impact. For example, GIAC Bikes programmers try a new programming language. Because metrics for the old system can be compared to the new system, GIAC Bikes determines that the new programming language cuts programming defects by 20 percent. Based on these results, the new programming language is adopted companywide and saves money on maintenance programming. GIAC Bikes is in a position to optimize the software development process and react positively to new business needs and technology changes.
The framework for process improvement provided by the CMM can go a long way toward improving the ability of a software organization to be successful on project after project.
