CMMI levels and the top two levels

Capability Maturity Model Integration (CMMI), from the SEI, is the successor to CMM. It integrates software, systems engineering and other disciplines into one process improvement model. In its staged representation, an organization is rated at one of five maturity levels.

Characteristics at each level

Brief notes:

• Level 1: no stable environment; the organization may work well in a crisis but cannot repeat success.
• Level 2: process areas include requirements management, project planning, project monitoring and control, measurement and analysis, process and product quality assurance, and configuration management.
• Level 3: process areas include requirements development, technical solution, verification, validation, organizational process definition, organizational training and risk management.

(In the continuous representation, each process area is instead rated at a capability level: 0 Incomplete to 3 Defined in CMMI v1.3, or 0 Incomplete to 5 Optimizing in earlier versions.)

The two top levels

Level 4: Quantitatively Managed

• The organization sets quantitative objectives for quality and process performance (for example, defect density below 0.5 per KLOC, schedule variance within 5%).
• Process performance is measured and controlled using statistical and other quantitative techniques (control charts, baselines).
• Process areas: Organizational Process Performance and Quantitative Project Management.
• Difference from level 3: performance becomes predictable, not just defined.

Level 5: Optimizing

• The organization continuously improves its processes through incremental and innovative changes in process and technology.
• Common causes of variation are analysed and removed, and improvements are measured against quantitative objectives.
• Process areas: Causal Analysis and Resolution and Organizational Performance Management (called Organizational Innovation and Deployment in earlier versions).

How effective these levels are in managing software processes

• Predictability: level 4 organizations can estimate cost, schedule and quality with narrow error ranges, so commitments to customers are reliable.
• Early detection: statistical control shows when a process goes outside its normal limits, so action is taken before the project fails.
• Fewer defects: level 5 removes root causes of defects, so the same errors do not repeat across projects.
• Controlled change: new tools and methods are piloted and measured before being adopted, which lowers risk.
• Limitations: reaching these levels needs a large investment in measurement, data collection and trained staff. They are most effective for large, stable organizations with many similar projects; for small or very innovative teams the overhead may be greater than the benefit.

Overall, levels 4 and 5 change process management from "following a defined process" to "managing it by data and improving it continuously", which gives the most mature and effective control of software processes.