CMM key process areas and continuous improvement

The Capability Maturity Model (CMM) of the Software Engineering Institute (SEI) describes five levels of software process maturity: Initial, Repeatable, Defined, Managed and Optimizing. Each level is defined by a set of key process areas (KPAs) that an organization must perform well to reach it.

How CMM encourages continuous improvement

1. Evolutionary, staged path: CMM does not expect an organization to become excellent at once. It gives a ladder of small, achievable steps. Each level stabilizes some part of the process and becomes the foundation for the next level.
2. Clear next target: an assessment shows the current level and which KPAs are missing. The organization knows exactly what to improve next (for example, a level 2 company works on process definition, training and peer reviews to reach level 3).
3. Goals for every KPA: each KPA states goals and the practices needed to meet them, under five common features: commitment to perform, ability to perform, activities performed, measurement and analysis, and verifying implementation. Progress can therefore be checked objectively.
4. Learning across projects: at level 3 an organization-wide process is defined and kept in a process asset library. Lessons from each project are fed back into this standard process.
5. Measurement-based feedback: at level 4 process and product data are collected and analysed statistically, so problems are seen in numbers rather than opinions.
6. Improvement built into the process: at level 5 improvement itself becomes a normal, ongoing activity. Defect causes are analysed and removed, and new methods and tools are piloted and adopted in a controlled way.
7. Repeated assessments: organizations are reassessed periodically, which creates an improvement cycle: assess, plan, improve, measure, reassess.

 Assess current level --> Identify weak KPAs
        ^                         |
        |                         v
 Measure results  <--  Improve practices

Key process areas at each maturity level

Level 1: Initial

• The process is ad hoc; success depends on individuals.
• No KPAs are defined.

Level 2: Repeatable (focus: basic project management)

• Requirements management: keep a shared understanding of requirements between customer and team, and control changes to them.
• Software project planning: make realistic estimates and plans for the work.
• Software project tracking and oversight: compare actual progress with the plan and take corrective action.
• Software subcontract management: select and manage qualified subcontractors.
• Software quality assurance: give management visibility into the process and products.
• Software configuration management: keep the integrity of work products throughout the life cycle.

Level 3: Defined (focus: organization-wide standard process)

• Organization process focus: set responsibility for process improvement activities.
• Organization process definition: develop and maintain the standard software process.
• Training program: develop the skills and knowledge of staff.
• Integrated software management: tailor the standard process for each project and manage the project with it.
• Software product engineering: carry out engineering tasks (requirements, design, code, test) consistently.
• Intergroup coordination: ensure groups such as development, testing and hardware cooperate.
• Peer reviews: remove defects early through reviews and inspections.

Level 4: Managed (focus: quantitative control)

• Quantitative process management: control process performance using measured data.
• Software quality management: set measurable quality goals for products and track them.

Level 5: Optimizing (focus: continuous improvement)

• Defect prevention: find root causes of defects and remove them so they do not happen again.
• Technology change management: identify, evaluate and introduce new tools and technologies in an orderly way.
• Process change management: continuously improve the organization's processes to raise quality and productivity and shorten development time.

Summary of KPAs

Example: a company at level 2 completes projects on time when they are similar to earlier ones, but each team works differently. By defining a common process, training staff and holding peer reviews, it reaches level 3. It then collects defect density and productivity data (level 4) and finally uses this data to find the main causes of defects and change its process (level 5). Each step makes the next one possible, which is how CMM drives continuous improvement.