CMMI-Value

© Copyright 2005, ASK Process, Inc. Page 1 of 8 CMM and CMMI®: Show Me the Value! Abstract Most organizations seek a rating against the Capability Maturity Model (CMM) or Capability Maturity Model Integration (CMMI) because their customers require it of them. But what about the majority of us for whom no such requirement exists? Is there any value in the CMM? Is there any reason why we should pay attention to what the CMMI says? In two words, Yes, and Yes! The Software Engineering Institute (SEI) created the CMM as a result of research into organizations that had proven to be successful in delivering quality software on time and within budget. They sought to find out what it was that differentiated these successful organizations from the majority who were inconsistent in their results, or were just plain failures. The CMM documents the attributes of these successful organizations—attributes that any organization can adopt. In addition, it lays these important attributes out on a path of increasing maturity that any organization can follow if it wants to join the ranks of the successful. The CMM is designed to be a roadmap to successful software and systems development. Organizations that use it as a guide to process improvement can expect to reap significant rewards. What are the CMM and CMMI? When people talk about the "CMM" they almost always are referring to the CMM for Software. This is the original CMM that the SEI developed in the late 1980's. It later developed other CMMs for System Engineering, Software Acquisition, and a number of other disciplines. In the past few years, the SEI has integrated all of these CMM's together into a single comprehensive model called the Capability Maturity Model Integration, or CMMI. This new model is replacing all of the older ones.1 Like the CMM, the CMMI is arranged into five levels of increasing maturity.2 Beginning with Maturity Level 1 (which is where any organization begins regardless of how good its processes are), the five Maturity Levels define a roadmap of increasing maturity in the organization's development processes, and hence, in its ability to complete projects consistently and well. (Refer to Figure 1 for a picture of the five levels of the CMMI, and the Process Areas that are included in each of these levels.) Maturity Level 1, called "Initial", is characterized by "Heroic Efforts". The CMMI identifies no Process Areas at this level. You automatically achieve this level if you can design, develop,  "CMM", "Capability Maturity Model", "CMMI", and "Capability Maturity Model Integration" are registered with the US Patent and Trademark Office by Carnegie Mellon University. 1 This paper focuses on the CMMI. With the exception of specific details about the model, all of the general statements about the CMMI can be applied equally to the CMM. 2 In addition to this "staged representation", the CMMI also has a "continuous representation" that does not arrange the Process Areas into Maturity Levels. For simplicity's sake, this white paper will not address the continuous representation. CMM and CMMI: Show Me the Value! © Copyright 2005, ASK Process, Inc. Page 2 of 8 integrate, and test. Organizations at Maturity Level 1 are sometimes successful, and sometimes not. The inconsistency that is characteristic of organizations at Maturity Level 1 is the reason why "Heroic Efforts" are required in order for them to achieve success in their projects. In fact, the phrase, "Heroic Efforts" is likely to elicit knowing nods of the head from members of these organizations, because it is all too familiar to them. Figure 1: The CMMI Maturity Level 2, called "Managed", is characterized by "Basic Project Management". The seven Process Areas at Maturity Level 2 all deal with management, rather than technical issues: Requirements Management3, Project Planning, Project Monitoring & Control, Supplier Agreement Management, Measurement & Analysis, Product & Process Quality Assurance4, and 3 RM contrasts with "Requirements Development" (a Maturity Level 3 Process Area), which is technical. 4 PPQA is not about testing; that shows up at Maturity Level 3 in the Verification Process Area. CMM and CMMI: Show Me the Value! © Copyright 2005, ASK Process, Inc. Page 3 of 8 Configuration Management5. This is an important lesson. The CMMI teaches us that a firm foundation of disciplined management practices is necessary before the effort to establish technical processes will pay off. In fact, most organizations find that in spite of having established some good technical processes, improvements in their performance are inconsistent and disappointing. This is because even the best technical processes will be made ineffective by immature management processes. So the CMMI guides us to improve our management processes first. Maturity Level 3, called "Defined", is characterized by "Process Standardization". This is where the bulk of the Process Areas reside in the CMMI. We find that these Process Areas fall into three main categories: • Technical – The first five Process Areas (Requirements Development, Technical Solution, Product Integration, Verification, and Validation) deal with the technical engineering work. • Process Management – The next three Process Areas (Organizational Process Focus, Organizational Process Definition, and Organizational Training) provide the infrastructure for maintaining and improving the organization's processes. • Management – The last six Process Areas (Integrated Product Management, Risk Management, Integrated Teaming, Integrated Supplier Management, Decision Analysis & Resolution, and Organizational Environment for Integration) all build more management discipline on top of the basic management Process Areas established at Maturity Level 2. The fourteen Process Areas of Maturity Level 3—built on the seven of Maturity Level 2— provide a full compliment of disciplined processes for the organization. Maturity Level 4, called "Quantitatively Managed", is characterized by "Quantitative Management". With the disciplined processes established at Maturity Levels 2 and 3, the organization is now in the position to be able to gain a statistical, numbers-based understanding of its performance, and use that understanding to "manage by fact". The two Process Areas at Maturity Level 4 (Organizational Process Performance and Quantitative Project Management) apply this capability for statistical management to understand the quality of both the processes the organization uses and the products it produces. Maturity Level 5, called "Optimizing", is characterized by "Continuous Process Improvement". Built on the disciplined processes of Maturity Levels 2 and 3, and the quantitative understanding of Maturity Level 4, the two Process Areas at Maturity Level 5 (Organizational Innovation & Deployment and Causal Analysis & Resolution) put the organization on the path of ever-improving performance by understanding and correcting the root causes of problems, and by fostering an environment of innovation and creativity. Why Do People Believe the CMMI Has Little Value? The CMM and CMMI have received a lot of bad press over the years. Most of that bad press can be traced to one of two things: misunderstandings and abuses. 5 Even CM is more about management issues than technical ones. CMM and CMMI: Show Me the Value! © Copyright 2005, ASK Process, Inc. Page 4 of 8 Misunderstandings. Many people who open the CMMI book are immediately overwhelmed by the volume of information: five Maturity Levels, two Generic Goals, 12 Generic Practices, 25 Process Areas, 55 Specific Goals, 185 Specific Practices, hundreds of Sub-Practices—nearly a thousand pages in all! It is hard to blame them for feeling that this model must be way too restrictive to be applicable to a real-life organization. Yes, the CMMI contains a lot of information. But the majority of it is just that, only information. For organizations that must achieve a CMMI rating, the important things are the Goals. In order to receive a Maturity Level 2 rating, the organization must achieve only the 16 Goals for the seven Maturity Level 2 Process Areas. The Practices (which are much more numerous) are "expected" elements of the model. That means that the SEI expects that an organization will have to perform all of those Practices in order to achieve the Goals. But the Practices are not required. Organizations occasionally employ "alternative practices" to achieve the Goals, and when they do, that is OK. As long as each Goal is achieved, the actual Practices that are employed are not an issue. The Sub-Practices and other information in the CMMI are merely "informative" elements of the model. That is, they are there to provide additional information to help the reader to understand the intent of the Goals and Practices. There is no requirement (or even expectation) that an organization will perform all of the Sub-Practices. Naturally, if your organization is not under a mandate to achieve a Maturity Level rating, then the Practices, and even the Goals in the CMMI take on more of a suggestive flavor. Of course, any organization would do well to take them as exceedingly strong suggestions, given the CMMI’s solid research basis! Abuses. As we said at the beginning of this paper, the SEI designed the CMMI to be a roadmap for process improvement. But what we have seen in practice is organizations requiring their suppliers to achieve specific Maturity Level ratings. This in turn causes those suppliers to turn to the CMMI simply to achieve a rating, even if they have little or no interest in process improvement. When the CMMI is used by an organization that has no interest in process improvement, its use can (and often does) become abuse. Processes are written solely to satisfy a CMMI Appraiser, but with little or no thought for how they will affect the organization's work. Paperwork grows seemingly without bounds, and people feel that they are drowning in "process for process' sake". In these organizations, the CMMI's primary purpose (a roadmap to improvement) is lost, and it becomes a straightjacket for the organization and its people. It becomes abusive as it is abused by those whose primary objective is a Maturity Level rating. And many of these organizations end up with no more than they sought: a Maturity Level rating and process binders sitting on shelves gathering dust while business goes on little improved from its starting point. For those of us who see the CMMI's potential to benefit those who use it, this is the saddest and most frustrating thing: to see an organization that goes through the motions of process improvement, but ends up with only a plaque on the wall and a bevy of disgruntled employees. It is sad because the benefits are so great when the CMMI is used as a guide to process improvement, as it was intended! Maturity Level 1 organizations can be frustrating and exhausting to work in because even when "Heroic Effort" is put forth, project success is often CMM and CMMI: Show Me the Value! © Copyright 2005, ASK Process, Inc. Page 5 of 8 elusive. This contrasts sharply with moving up the maturity scale by truly improving processes, which provides significant benefits to the organization. Value at Maturity Level 2 Maturity Level 2 (ML2) starts us on the road to process improvement by shining the spotlight precisely where it belongs: on management. Too often, managers see the problems of the organization, and look around for the people who need to be fixed (or replaced). Managers are human, and it is human nature to believe that the problems are "out there", rather than within themselves. By focusing on the organization's management processes, ML2 corrects this human failing in two ways. First, it highlights the fact that the way in which projects are managed is a primary contributor to their success (or lack there-of). The first things we pay attention to are our practices for managing requirements (as opposed to engineering them), planning our projects, tracking their status, relating with suppliers, measuring and analyzing data, gauging the quality of our processes, and protecting our project artifacts. These things (which are primarily in the purview of managers) govern our ability to perform good engineering work. That is, they cannot assure good engineering work, but if they are absent or done poorly, they can sabotage the best efforts of our engineers (even heroic efforts)! By establishing Goals and enumerating good Practices for these Process Areas, the CMMI shows managers how they, personally, can make significant contributions to their projects' success. This leads us to the second benefit of ML2: it places managers in the role of process improvement pioneers and leaders. When managers are the ones taking the first halting steps toward better practices, they are demonstrating that they take process improvement seriously, and are willing to do their part to make the organization as effective as it can be. This leadership will not be lost on their employees; the integrity that is communicated by alignment of rhetoric and action always stands out in people's minds. So, ML2 lays a foundation for Maturity Level 3 in two crucial ways. Mature management practices establish an environment in which good engineering practices can thrive, and management's leadership in process improvement sets a precedent that everyone else can emulate. Value at Maturity Level 3 ML2 provides significant benefits. But, stopping there can be counterproductive. The key to good engineering is good engineering practices. ML2 lays a foundation for good Engineering Practices, but it does not assure they exist. In fact, a majority of organizations have reported that at ML2, although their projects are more predictable and operate more smoothly, their actual performance is little improved. So, the net result of ML2 is a better understanding of the organization's engineering capability, but not an improvement in it! Maturity Level 3 (ML3) turns the spotlight on the rest of the organization (while also still keeping it on management). The Process Areas at ML3 cover three distinct topics: Engineering practices, Process Management, and more advanced Management practices. CMM and CMMI: Show Me the Value! © Copyright 2005, ASK Process, Inc. Page 6 of 8 ML3's focus on Engineering provides the opportunity to make real and significant improvement in the organization's capacity to do good engineering work. At ML2, we learned how to manage our Requirements effectively, and now at ML3, we determine the most effective way to engineer Requirements that are worth managing. At ML2, we learned how to plan and track the engineering work, and now at ML3, we determine the most effective ways to design, build, validate, and verify our systems. ML3 capitalizes on the foundation of management practices laid by ML2 to improve the engineering work and build the organization's capability to do excellent work. In addition, ML3 turns the spotlight on the organization's process infrastructure. Although the ability to build and improve processes must exist to achieve ML2, ML3 assures that those practices are effective and serve the organization well. Finally, ML3 continues to build management discipline on top of the basics established in ML2. ML3 ensures that the work of the many multiple players on any project is coordinated well to achieve the best possible result. Taken together, the benefits of ML2 and ML3 are sound practices for doing excellent engineering work, planning and managing that work well, and ensuring the infrastructure that supports those sound practices. Doesn't that sound like precisely what we need? So, what benefits can the higher Maturity Levels provide? Read on! Value at Maturity Levels 4 and 5 Many organizations aspire to nothing beyond Maturity Level 3. But to do so is to miss the opportunity for the most significant benefits in the CMMI. While ML2 and ML3 only establish good practices, Maturity Level 4 (ML4) and Maturity Level 5 (ML5) serve to ensure that the organization's practices are as effective as they can be, and that they continue to be effective as the organization evolves over time. ML4 and ML5 provide these benefits at a much lower cost than the lower Maturity Levels. To reach ML3, you must satisfy the 50 Goals of the 21 different Process Areas at ML2 and ML3. Having gone that far, ML4 and ML5 embody the relatively modest requirement to satisfy only seven Goals of four Process Areas! From a goals-and-practices standpoint, these two highest Maturity Levels together require less work than ML2 alone. And the process improvement mindset that is required to reach ML3 will serve you well as you go for these last two steps in the maturity scale. ML4 provides the benefit of a statistically-based understanding of the performance of the organization. In manufacturing organizations, it is not unusual to see control charts on the walls showing statistics about such things as productivity, quality, scrap, and rework. Those charts speak volumes, not just about the data they are designed to trumpet, but especially about the maturity of the organization's processes. It is impossible to produce a meaningful control chart for an ill-defined process, or for one that is not well understood or is not done consistently. ML2 and ML3 provide that foundation, paving the way for ML4 and its practices for analyzing and learning from the data that those other processes generate. ML4 gives us the insight into our processes that enables us to know how effective they are, and if that effectiveness is holding steady or if it is slipping. This is important insight that any organization needs to maintain its effectiveness over the long run. CMM and CMMI: Show Me the Value! © Copyright 2005, ASK Process, Inc. Page 7 of 8 ML5 provides the tools that the organization needs to be able to use the statistical understanding of ML4 to continually improve their processes. ML5 establishes the practice of continually learning, continually growing, and continually improving the way we do our work. Because we work in an ever-changing business environment, our success is always being challenged. ML5 assures that we are watching, tuning, correcting, and even replacing the practices in the organization to ensure that they are supporting the organization as they should, and are ensuring its continuing survival—and more than that, its excellence. Some process improvement professionals go so far as to say that an organization isn't really doing process improvement until after they have achieved ML5. They say this because at the lower Maturity Levels, the organization is merely following the roadmap provided by the CMMI to make their improvements. At ML5, they are finally making improvements based on the only thing that really counts, a clear understanding of the differences between their actual performance and what they are capable of achieving. ML5's moniker of "Continuous Process Improvement" describes it well. How to Gain the Value, Starting Today! You can download a copy of the full CMMI from the SEI's website at http://www.sei.cmu.edu/cmmi/models/. On this web page, you can choose which version of the model you want. The letters in the names indicate which disciplines each document covers. Choose the version that covers all of the disci