New Page 1

Capability Maturity Model

SW development as a baseball team.

What happens when a ball is hit to a Little League team? Everyone runs around at random. They might do the right thing, or they might not. The next time the ball is hit in the same place, they will do something different.

What happens when a ball is hit to a professional team? Everyone moves in a coordinated fashion, based on practicing that play many times. Sometimes they fail to make the right play, but they almost always try to do the right thing.

Professional teams also discuss their play and look for ways to improve. They might say to each other -- "The next time there is an infield hit with 2 outs, lets do this instead."

What happens when you lose the star player on a Little League team? Usually the team can no longer function. What happens when you lose the start player on a professional team? Often, other players can step up to take his/her place. (Take the St. Louis Rams as an example.)

The Capability Maturity Model (CMM) describes 5 levels of software process maturity, with detail about what constitutes each level.

CMM is used to judge the quality (maturity) of a software development organization -- to see how well it works.

CMM is also used as a roadmap for improving a SW development organization.

How does this work?

There are officially certified CMM "assessors" who come to your company and conduct an audit of your SW processes. (This takes a few weeks.) They tell you what level you are at and what you need to do to advance.

An organization can also send their own people to CMM training. Those people can then help the organization improve. This is worthwhile for large companies.

Summary of the levels

Level 1, Initial -- Anything at all. Ad-hoc and chaotic. Will have some successes, but will also have failures and badly missed deadlines. (98% of SW development organizations at this way.)

Level 2, Repeatable -- SW processes are defined, documented, practiced, and people are trained in them. Groups across an organization may use different processes. (This is harder to do than it sounds. Organizations often take 12-18 months of hard work to get here.)

Level 3, Defined -- SW processes are consistent and known across the whole organization.

Level 4, Managed -- SW processes and results are measured quantitatively, and processes are evaluated with this data.

Level 5, Optimizing -- Organizations engage in continuous process improvement. They experiment with new methods and technologies. They change their processes when they find something that works better.

Some details about each level

Level 1, Initial -- Team tackles projects in different ways at different times. Frequent crises and "firefighting". Can have strong successes, but may not apply those methods on next project. Some time and cost estimates are accurate, but many are far off. Success depends on smart people doing the right things. Hard to recover from good people leaving.

Level 2, Repeatable -- CMM book pages 126, 134, 148, 159, 172, 180.

Level 3, Defined -- CMM book pages 194, 203, 214, 223, 241, 262, 270.

Level 4, Managed -- CMM book pages 278, 293.

Level 5, Optimizing -- CMM book pages 306, 319, 331.

Problems / drawbacks with CMM

1) Organizations look at CMM as a method or formula for improvement. But it is actually a set of goals, without specifying how to achieve the goals. To use CMM, you have to think, be flexible, be creative, and integrate the goals of CMM with the realities of your business.

If you say, "we do CMM just like it is specified in the book", then you aren't doing CMM.

2) Organizations are using CMM as a stamp of approval, without really committing to process improvement. They want to find the easiest way to get certified as Level 2 (or whatever) without really changing their underlying methods.

I talked to the woman who was the first CMM assessor in the world. She was getting tired and disillusioned with the whole thing. When she went in to work with a company they would say "tell us what we need to do to get Level 2" rather than "let's work together to improve our processes".

3) CMM does not help at all for projects that are in a crisis right now. And this is often when companies look for help with their SW process.

An analogy: For long-term cardiac health, eating lots of fruits and veggies, quitting smoking, getting exercise, and reducing your stress, are all good ideas. But suppose you are having a heart attack now. Will any of these actions help? No, it is too late for preventive measures. You need some other kind of intervention.