Basics of CMMi

Basic CMMi

Contents 1 CMMI Overview 2 History 3 CMMI representation 4 CMMI model framework 5 Maturity levels in CMMI for development 6 Maturity levels in CMMI for services 7 CMMI models 8 Appraisal 9 CMMI Security Guides Capability Maturity Model Integration Capability Maturity Model Integration (CMMI) is a process improvement training and appraisal program and service administered and marketed by Carnegie Mellon Universityand required by many DoD and U.S. Government contracts, especially in software development. Carnegie Mellon University claims CMMI can be used to guide process improvement across a project, division, or an entire organization. CMMI defines the following maturity levels for processes: Initial, Managed and Defined. Currently supported is CMMI Version 1.3. CMMI is registered in the U.S. Patent and Trademark Office by Carnegie Mellon University. CMMI Overview Characteristics of the Maturity levels. CMMI currently addresses three areas of interest: Product and service development — CMMI for Development (CMMI-DEV), Service establishment, management, — CMMI for Services (CMMI-SVC), and Product and service acquisition — CMMI for Acquisition (CMMI-ACQ). CMMI was developed by a group of experts from industry, government, and the Software Engineering Institute (SEI) at Carnegie Mellon University. CMMI models provide guidance for developing or improving processes that meet the business goals of an organization. A CMMI model may also be used as a framework for appraising the process maturity of the organization. By January of 2013, the entire CMMI product suite was transferred from the SEI to the CMMI Institute, a newly created organization at Carnegie Mellon.  CMMI originated in software engineering but has been highly generalized over the years to embrace other areas of interest, such as the development of hardware products, the delivery of all kinds of services, and the acquisition of products and services. The word "software" does not appear in definitions of CMMI. This generalization of improvement concepts makes CMMI extremely abstract. It is not as specific to software engineering as its predecessor, the Software CMM (CMM, see below). History CMMI was developed by the CMM project, which aimed to improve the usability of maturity models by integrating many different models into one framework. The project consisted of members of industry, government and the Carnegie Mellon Software Engineering Institute (SEI). The main sponsors included the Office of the Secretary of Defense (OSD) and the National Defense Industrial Association. CMMI is the successor of the capability maturity model (CMM) or Software CMM. The CMM was developed from 1987 until 1997. In 2002, CMMI Version 1.1 was released, Version 1.2 followed in August 2006, and CMMI Version 1.3 in November 2010. Some of the major changes in CMMI V1.3 are the support of Agile Software Development,improvements to high maturity practices  and alignment of the representation (staged and continuous). According to the Software Engineering Institute (SEI, 2008), CMMI helps "integrate traditionally separate organizational functions, set process improvement goals and priorities, provide guidance for quality processes, and provide a point of reference for appraising current processes." CMMI topics CMMI representation CMMI exists in two representations: continuous and staged. The continuous representation is designed to allow the user to focus on the specific processes that are considered important for the organization's immediate business objectives, or those to which the organization assigns a high degree of risks. The staged representation is designed to provide a standard sequence of improvements, and can serve as a basis for comparing the maturity of different projects and organizations. The staged representation also provides for an easy migration from the SW-CMM to CMMI. CMMI model framework For more details on this topic, see Process area (CMMI). Depending on the CMMI areas of interest (acquisition, services, development) used, the process areas it contains will vary. Process areas are the areas that will be covered by the organization's processes. The table below lists the collection of seventeen CMMI core process areas that are present for all CMMI areas of interest in CMMI Version 1.3. Capability Maturity Model Integration (CMMI) Core Process Areas Abbreviation Name Area Maturity Level CAR Causal Analysis and Resolution Support 5 CM Configuration Management Support 2 DAR Decision Analysis and Resolution Support 3 IPM Integrated Project Management Project Management 3 MA Measurement and Analysis Support 2 OPD Organizational Process Definition Process Management 3 OPF Organizational Process Focus Process Management 3 OPM Organizational Performance Management Process Management 5 OPP Organizational Process Performance Process Management 4 OT Organizational Training Process Management 3 PMC Project Monitoring and Control Project Management 2 PP Project Planning Project Management 2 PPQA Process and Product Quality Assurance Support 2 QPM Quantitative Project Management Project Management 4 REQM Requirements Management Project Management 2 RSKM Risk Management Project Management 3 SAM Supplier Agreement Management Support 2 Maturity levels in CMMI for development There are five maturity levels. Maturity level ratings are awarded for levels 2 through 5. The process areas below and their maturity levels are listed for the CMMI for Development model: Maturity Level 2 - Managed CM - Configuration Management MA - Measurement and Analysis PMC - Project Monitoring and Control PP - Project Planning PPQA - Process and Product Quality Assurance REQM - Requirements Management SAM - Supplier Agreement Management Maturity Level 3 - Defined DAR - Decision Analysis and Resolution IPM - Integrated Project Management OPD - Organizational Process Definition OPF - Organizational Process Focus OT - Organizational Training PI - Product Integration RD - Requirements Development RSKM - Risk Management TS - Technical Solution VAL - Validation VER - Verification Maturity Level 4 - Quantitatively Managed OPP - Organizational Process Performance QPM - Quantitative Project Management Maturity Level 5 - Optimizing CAR - Causal Analysis and Resolution OPM - Organizational Performance Management Maturity levels in CMMI for services The process areas below and their maturity levels are listed for the CMMI for Services model: Maturity Level 2 - Managed CM - Configuration Management MA - Measurement and Analysis PPQA - Process and Product Quality Assurance REQM - Requirements Management SAM - Supplier Agreement Management SD - Service Delivery WMC - Work Monitoring and Control WP - Work Planning Maturity Level 3 - Defined CAM - Capacity and Availability Management DAR - Decision Analysis and Resolution IRP - Incident Resolution and Prevention IWM - Integrated Work Managements OPD - Organizational Process Definition OPF - Organizational Process Focus OT - Organizational Training RSKM - Risk Management SCON - Service Continuity SSD - Service System Development SST - Service System Transition STSM - Strategic Service Management Maturity Level 4 - Quantitatively Managed OPP - Organizational Process Performance QWM - Quantitative Work Management Maturity Level 5 - Optimizing CAR - Causal Analysis and Resolution OPM - Organizational Performance Management CMMI models CMMI best practices are published in documents called models, each of which addresses a different area of interest. The current release, CMMI Version 1.3, provides models for three areas of interest: development, acquisition, and services. CMMI for Development , v1.3 was released in November 2010. It addresses product and service development processes. CMMI for Acquisition , v1.3 was released in November 2010. It addresses supply chain management, acquisition, and outsourcing processes in government and industry. CMMI for Services , v1.3 was released in November 2010. It addresses guidance for delivering services within an organization and to external customers. Appraisal An organization cannot be certified in CMMI; instead, an organization is appraised. Depending on the type of appraisal, the organization can be awarded a maturity level rating (1-5) or a capability level achievement profile. Many organizations find value in measuring their progress by conducting an appraisal. Appraisals are typically conducted for one or more of the following reasons: To determine how well the organization’s processes compare to CMMI best practices, and to identify areas where improvement can be made To inform external customers and suppliers of how well the organization’s processes compare to CMMI best practices To meet the contractual requirements of one or more customers Appraisals of organizations using a CMMI model must conform to the requirements defined in the Appraisal Requirements for CMMI (ARC) document. There are three classes of appraisals, A, B and C, which focus on identifying improvement opportunities and comparing the organization’s processes to CMMI best practices. Of these, class A appraisal is the most formal and is the only one that can result in a level rating. Appraisal teams use a CMMI model and ARC-conformant appraisal method to guide their evaluation of the organization and their reporting of conclusions. The appraisal results can then be used (e.g., by a process group) to plan improvements for the organization. The Standard CMMI Appraisal Method for Process Improvement (SCAMPI) is an appraisal method that meets all of the ARC requirements. Results of an SCAMPI appraisal may be published (if the appraised organization approves) on the CMMI Web site of the SEI. SCAMPI also supports the conduct ofISO/IEC 15504, also known as SPICE (Software Process Improvement and Capability Determination), assessments etc. This approach promotes that members of the EPG and PATs be trained in the CMMI, that an informal (SCAMPI C) appraisal be performed, and that process areas be prioritized for improvement. More modern approaches, that involve the deployment of commercially available, CMMI-compliant processes, can significantly reduce the time to achieve compliance. SEI has maintained statistics on the "time to move up" for organizations adopting the earlier Software CMM as well as CMMI. These statistics indicate that, since 1987, the median times to move from Level 1 to Level 2 is 23 months, and from Level 2 to Level 3 is an additional 20 months. Since the release of the CMMI, the median times to move from Level 1 to Level 2 is 5 months, with median movement to Level 3 another 21 months. These statistics are updated and published every six months in a maturity profile. The Software Engineering Institute’s (SEI) Team Software Process methodology and the use of CMMI models can be used to raise the maturity level. A new product called Accelerated Improvement Method(AIM) combines the use of CMMI and the TSP. CMMI Security Guides To address user security concerns, two unofficial security guides are available. Considering the Case for Security Content in CMMI for Services has one process area, Security Management. Security by Design with CMMI for Development, Version 1.3 has the following process areas: OPSD - Organizational Preparedness for Secure Development SMP - Secure Management in Projects SRTS - Security Requirements and Technical Solution SVV - Security Verification and Validation While they do not affect maturity or capability levels, these process areas can be reported in appraisal results.