Capability Maturity Model Integration (CMMI) is a process level improvement training and appraisal program. Administered by the CMMI Institute, a subsidiary of the Information Systems Audit and Control Association (ISACA), it was developed at Carnegie Mellon University (CMU). It is required by many U.S. Government contracts, especially in software development. CMU claims CMMI can be used to guide process improvement across a project, division, or an entire organization.
CMMI defines five maturity levels (1 to 5) for processes: Initial, Managed, Defined, Quantitatively Managed, and Optimizing. CMMI Version 3.0 was published in 2023; CMMI is registered in the U.S. Patent and Trademark Office by CMU.
Overview
Originally, CMMI addresses three areas of interest, each with a separate model: Product and service development – CMMI for Development (CMMI-DEV) Service establishment, management – CMMI for Services (CMMI-SVC) Product and service acquisition – CMMI for Acquisition (CMMI-ACQ)
In version 2.0, the three areas were merged into one model.
CMMI was developed by a group from industry, government, and the Software Engineering Institute (SEI) at CMU. CMMI models provide guidance for developing or improving processes that meet the business goals of an organization. A CMMI model may also be used as a framework for appraising the process maturity of the organization. By January 2013, the entire CMMI product suite was transferred from the SEI to the CMMI Institute, a newly created organization at Carnegie Mellon.
History CMMI was developed by the CMMI project, which aimed to improve the usability of maturity models by integrating many different models into one framework. The project consisted of members of industry, government and the Carnegie Mellon Software Engineering Institute (SEI). The main sponsors included the Office of the Secretary of Defense (OSD) and the National Defense Industrial Association.
CMMI is the successor of the capability maturity model (CMM) or Software CMM. The CMM was developed from 1987 until 1997. Version 1.1 was released in 2002, version 1.2 in August 2006, and version 1.3 in November 2010. Some major changes in CMMI V1.3 are support of agile software development, improvements to high maturity practices and aligning the representation (staged and continuous).
According to the Software Engineering Institute (SEI, 2008), CMMI helps "integrate traditionally separate organizational functions, set process improvement goals and priorities, provide guidance for quality processes, and provide a point of reference for appraising current processes.". Software Engineering Institute. Accessed 16 February 2011.
Mary Beth Chrissis, Mike Konrad, and Sandy Shrum Rawdon were the authoring team for the hard copy publication of CMMI for Development Version 1.2 and 1.3. The Addison-Wesley publication of Version 1.3 was dedicated to the memory of Watts Humphry. Eileen C. Forrester, Brandon L. Buteau, and Sandy Shrum were the authoring team for the hard copy publication of CMMI for Services Version 1.3. Rawdon "Rusty" Young was chief architect for developing CMMI version 2.0. He was formerly CMMI Product Owner and SCAMPI Quality Lead for the Software Engineering Institute.
In March 2016, the CMMI Institute was acquired by ISACA. In March 2018, the CMMI V2.0 was released. In April 2023, the CMMI V3.0 was released.
Topics
Representation In version 1.3, CMMI existed in two representations: continuous and staged. The continuous representation is designed to allow the user to focus on the specific processes that are considered important for the organization's immediate business objectives, or those to which the organization assigns a high degree of risks. The staged representation is designed to provide a standard sequence of improvements, and can serve as a basis for comparing the maturity of different projects and organizations. The staged representation also provides for an easy migration from the SW-CMM to CMMI.
In version 2.0 the above representation separation was cancelled and there is now only one cohesive model.
Model framework (v1.3)
Depending on the areas of interest (acquisition, services, development) used, the process areas it contains will vary. Process areas are the areas that will be covered by the organization's processes. The table below lists the seventeen CMMI core process areas that are present for all CMMI areas of interest in version 1.3.
+ Capability Maturity Model Integration (CMMI) core process areas Abbreviation Process area Category Maturity level CAR Causal Analysis and Resolution Support 5 CM Configuration Management Support 2 DAR Decision Analysis and Resolution Support 3 IPM Integrated Project Management Project management 3 MA Measurement and Analysis Support 2 OPD Organizational Process Definition Process management 3 OPF Organizational Process Focus Process management 3 OPM Organizational Performance Management Process management 5 OPP Organizational Process Performance Process management 4 OT Organizational Training Process management 3 PMC Project Monitoring and Control Project management 2 PP Project Planning Project management 2 PPQA Process and Product Quality Assurance Support 2 QPM Quantitative Project Management Project management 4 REQM Requirements Management Project management 2 RSKM Risk Management Project management 3 SAM Supplier Agreement Management Support 2
Maturity levels for services The process areas below and their maturity levels are listed for the CMMI for services model:
Maturity Level 2 – Managed CM – Configuration Management MA – Measurement and Analysis PPQA – Process and Quality Assurance REQM – Requirements Management SAM – Supplier Agreement Management SD – Service Delivery WMC – Work Monitoring and Control WP – Work Planning
Maturity Level 3 – Defined CAM – Capacity and Availability Management DAR – Decision Analysis and Resolution IRP – Incident Resolution and Prevention IWM – Integrated Work Managements OPD – Organizational Process Definition OPF – Organizational Process Focus... OT – Organizational Training RSKM – Risk Management SCON – Service Continuity SSD – Service System Development SST – Service System Transition STSM – Strategic Service Management
Maturity Level 4 – Quantitatively Managed OPP – Organizational Process Performance QWM – Quantitative Work Management
Maturity Level 5 – Optimizing CAR – Causal Analysis and Resolution. OPM – Organizational Performance Management.
Models (v1.3) CMMI best practices are published in documents called models, each of which addresses a different area of interest. Version 1.3 provides models for three areas of interest: development, acquisition, and services. CMMI for Development (CMMI-DEV), v1.3 was released in November 2010. It addresses product and service development processes. CMMI for Acquisition (CMMI-ACQ), v1.3 was released in November 2010. It addresses supply chain management, acquisition, and outsourcing processes in government and industry. CMMI for Services (CMMI-SVC), v1.3 was released in November 2010. It addresses guidance for delivering services within an organization and to external customers.
Model (v2.0) In version 2.0 DEV, ACQ and SVC were merged into a single model where each process area potentially has a specific reference to one or more of these three aspects. Trying to keep up with the industry the model also has explicit reference to agile aspects in some process areas.
Some key differences between v1.3 and v2.0 models are given below: "Process Areas" have been replaced with "Practice Areas (PA's)". The latter is arranged by levels, not "Specific Goals". Each PA is composed of a "core" [i.e. a generic and terminology-free description] and "context-specific" [ i.e. description from the perspective of Agile – Scrum, development, services, etc.] section. Since all practices are now compulsory to comply, "Expected" section is removed. "Generic Practices" have been put under a new area called "Governance and Implementation Infrastructure", while "Specific practices" have been omitted. Emphasis on ensuring implementation of PA's and that these are practised continuously until they become a "habit". All maturity levels focus on the keyword "performance". Two and five optional PA's from "Safety" and "Security" purview have been included. PCMM process areas have been merged.
Appraisal Organizations cannot be certified in CMMI; instead, they undergo a CMMI appraisal to evaluate the implementation and institutionalization of practices defined by the CMMI model. Depending on the scope and objectives of the appraisal, an organization may receive a maturity level (Levels 1–5) for a defined organizational unit or a capability level for individual practice areas.
Organizations typically conduct appraisals for one or more of the following purposes: to evaluate how their processes compare with CMMI best practices; to identify strengths, weaknesses, and opportunities for process improvement; to demonstrate process capability and organizational maturity to customers, suppliers, or other stakeholders; and to satisfy contractual or regulatory requirements.
Since the introduction of CMMI Version 2.0, appraisals are performed using the CMMI Appraisal Method (CAM). CAM replaced the former Standard CMMI Appraisal Method for Process Improvement (SCAMPI) and the associated Appraisal Requirements for CMMI (ARC) framework used in earlier versions of the model.
CAM defines two principal appraisal types: Benchmark Appraisal, the formal appraisal used to determine an organization's official maturity level or capability level(s); and Sustainment Appraisal, used by organizations that have previously achieved a maturity level to confirm that their practices continue to satisfy CMMI requirements between Benchmark Appraisals.
Benchmark Appraisals are conducted by authorized lead appraisers and appraisal teams following the requirements established by the CMMI Institute, now part of ISACA. Organizations may choose to publish successful appraisal results in the official Published Appraisal Results (PARS) repository maintained by the CMMI Institute.
Organizations frequently perform internal readiness assessments or gap analyses before a formal appraisal to identify areas requiring improvement. Unlike the former SCAMPI Class C appraisals, these activities are not formal appraisal classes but preparation activities supporting a subsequent Benchmark Appraisal.
Security To address user security concerns, two unofficial security guides are available. Considering the Case for Security Content in CMMI for Services has one process area, Security Management.Eileer Forrester and Kieran Doyle. Considering the Case for Security Content in CMMI for Services (October 2010) Security by Design with CMMI for Development, Version 1.3 has four process areas: OPSD – Organizational Preparedness for Secure Development SMP – Secure Management in Projects SRTS – Security Requirements and Technical Solution SVV – Security Verification and Validation
While they do not affect maturity or capability levels, these process areas can be reported in appraisal results.Siemens AG Corporate Technology. Security by Design with CMMI for Development, Version 1.3, (May 2013)
Applications