Levels of CMM

The Capability Maturity Model (CMM), developed by the Software Engineering Institute (SEI) at Carnegie Mellon University, has five maturity levels. Each level describes how mature, disciplined and predictable an organization's software process is, and each level is the foundation for the next.

                              +--------------+
                              | 5 Optimizing |
                    +---------+--------------+
                    | 4 Managed |
          +---------+-----------+
          | 3 Defined |
  +-------+-----------+
  | 2 Repeatable |
--+--------------+
| 1 Initial |
+-----------+

Level 1: Initial

• The process is ad hoc and sometimes chaotic.
• Few processes are defined; success depends on individual effort and "heroes".
• Schedules and budgets are often exceeded.
• No key process areas (KPAs).

Level 2: Repeatable

• Basic project management processes track cost, schedule and functionality.
• Success on earlier, similar projects can be repeated.
• KPAs: requirements management, software project planning, project tracking and oversight, subcontract management, software quality assurance, software configuration management.

Level 3: Defined

• Both management and engineering activities are documented and integrated into an organization-wide standard software process.
• Every project uses an approved, tailored version of this process.
• KPAs: organization process focus, organization process definition, training program, integrated software management, software product engineering, intergroup coordination, peer reviews.

Level 4: Managed

• Detailed measures of the process and product quality are collected.
• Process and products are quantitatively understood and controlled, so performance is predictable.
• KPAs: quantitative process management, software quality management.

Level 5: Optimizing

• Continuous process improvement is enabled by quantitative feedback and by trying new ideas and technologies.
• Causes of defects are found and removed so they do not happen again.
• KPAs: defect prevention, technology change management, process change management.

How an organization moves up: an SEI assessment checks which KPAs are satisfied. Each KPA has goals and practices grouped under common features (commitment to perform, ability to perform, activities performed, measurement and analysis, verifying implementation). An organization reaches a level only when all KPAs of that level and the levels below are satisfied, so levels cannot be skipped.

Summary