SecConcept -CMMI Capability Maturity Model Integration

Posted Nov 11, 2020 Updated Oct 30, 2022

By Grace L

19 min read

[toc]

CMM - Capability Maturity Model Integration

Capability Maturity Model Integration (CMMI)

a process level improvement training and appraisal program.
Administered by the CMMI Institute, Subsidiary of “ISACA”
required by many U.S. Government contracts, especially in “Software development”.
CMMI can be used to guide process improvement across a project, division, or an entire organization.
may also be used as a framework for appraising the process maturity of the organization.
CMMI defines the following maturity levels for processes: Initial, Managed, Defined, Quantitatively Managed, and Optimizing.

Originally CMMI addresses three areas of interest:

Product and service development – CMMI for Development (CMMI-DEV),
Service establishment, management, – CMMI for Services (CMMI-SVC),
Product and service acquisition – CMMI for Acquisition (CMMI-ACQ).

In version 2.0 these three areas (that previously had a separate model each) were merged into a single model.

Representation

CMMI existed in two representations:

continuous and staged.
the continuous representation allow the user to
- focus on the specific processes that are considered important for the organization’s immediate business objectives,
- or those to which the organization assigns a high degree of risks.
The staged representation
- provide a standard sequence of improvements,
- can serve as a basis for comparing the maturity of different projects and organizations.
- The staged representation also provides for an easy migration from the SW-CMM to CMMI.

CMM衍生出了一些改善模型，比如：

SW-CMM (Software CMM) 软件CMM
SE-CMM (System Engineering CMM) 系统工程CMM
SA-CMM (Software Acquisition CMM) 软件采购CMM
IPT-CMM (Integrated Product Team CMM) 集成产品群组CMM
P-CMM (People CMM)人力资源能力成熟度模型

The CMMI Process Areas (PAs) can be grouped into the following 4Each process area is defined by a set of goals and practices. There are two categories of goals and practices:

Generic goals and practices: They are part of every process area.

Specific goals and practices: They are specific to a given process area. categories to understand their interactions and links with one another regardless of their defined level:

Process Management
Project Management
Engineering
Support

Each process area is defined by a set of goals and practices.

There are two categories of goals and practices:
Generic goals and practices: They are part of every process area.
Specific goals and practices: They are specific to a given process area.

Maturity levels for services

The process areas below and their maturity levels are listed for the CMMI for services model:

| Level:        | Maturity Level 1 – Initial 初始级        | Maturity Level 2 – Managed                      | Maturity Level 3 – Defined / Standardized               | Maturity Level 4 – Quantitatively Managed           |   Maturity Level 5 – Optimizing / Innovation    |
| ------------- |-----------------------------------------|------------------------------------------------ |-------------------------------------------------------- | --------------------------------------------------- | ----------------------------------------------- |
| Character     | - poor control 软件过程是无序 甚至混乱的    | - 制定了必要的过程纪律 能重复类似项目取得的成功经验     | - develop standard processes, measures and trining      | - Process measured and Controlled                    | - Focus on process improvement                  |
|               | - process unpredictable 对过程几乎没有定义 | - build disciplined work unit management         |   for product and service offerings                     | - 分析对软件过程和产品质量的详细度量数据，对软件过程和产品都有| - 过程的量化反馈和先进的新思想、新技术                |
|               | - 成功取决于个人努力                       |   to stabilise work and conrol commitments      | - 将软件管理和工程两方面的过程文档化 标准化 综合成标准软件过程    |   定量的理解与控制。                                   |   促使过程持续不断改进。                           |
|               | - poorly reactive 管理是反应式的          | - process are planned, documented, performed,   | - 所有项目均使用经批准 剪裁的标准软件过程来开发和维护软件        | - 管理有一个作出结论的客观依据 管理能够在定量的范围内预测性能 | - Implement continuous proactive through        |
|               | - motivate people to overcome problem   |   monitored and controlled at project level     | - 软件产品的生产在整个软件过程是可见的                        | - exploit benefits of standardization               |   incremental and innovative technological      |
|               |   just "get the job done"               | - often reactive                                | - Process, standards, procedures, tools... are defined   | - Process are controlled using statistical and      |   improvement to achieve business goals         |
|               |                                         |                                                 |   at the organizational level.                          |   other quantitative techniques                     |                                                 |
|               |                                         |                                                 | - Proactive                                             |                                                     |                                                 |
|               |                                         |                                                 |                                                         |                                                     |                ---
| ------------- |-----------------------------------------|------------------------------------------------ |-------------------------------------------------------- | --------------------------------------------------- | ----------------------------------------------- |
| Description   | - Firefighting, heroic efforts          | - basic project management, many times reactive | - Process Standardization                               | - Quantitative Mangement                            | - continuous process improvement      ---
| ------------- |-----------------------------------------|------------------------------------------------ |-------------------------------------------------------- | --------------------------------------------------- | ----------------------------------------------- |
| Capabilities  | - design, develop, integrate, test      | * CM – Configuration Management                 | * CAM – Capacity and Availability Management            | – Quantitative Process Management                   | * OPM – Organizational Performance Management.  |
|               | * REQM – Requirements Management        | * MA – Measurement and Analysis                 | * DAR – Decision Analysis and Resolution                | * OPP – Organizational Process Performance          | * CAR – Causal Analysis and Resolution.         |
|               | * SAM – Supplier Agreement Management   | * PPQA – Process and Quality Assurance          | * IRP – Incident Resolution and Prevention              |                                                     |                                                 |
|               | * SD – Service Delivery                 |                                                 | * IWM – Integrated Work Managements                     |                                                     |                                                 |
|               | * WMC – Work Monitoring and Control     |                                                 | * OPD – Organizational Process Definition               |                                                     |                                                 |
|               | * WP – Work Planning                    |                                                 | * OPF – Organizational Process Focus                    |                                                     |                                                 |
|               |                                         |                                                 | * OT – Organizational Training                          |                                                     |                                                 |
|               |                                         |                                                 | * RSKM – Risk Management                                |                                                     |                                                 |
|               |                                         |                                                 | * SCON – Service Continuity                             |                                                     |                                                 |
|               |                                         |                                                 | * SSD – Service System Development                      |                                                     |                                                 |
|               |                                         |                                                 | * SST – Service System Transition                       |                                                     |                                                 |
|               |                                         |                                                 | * STSM – Strategic Service Management       ---
| ------------- |-----------------------------------------|------------------------------------------------ |-------------------------------------------------------- | --------------------------------------------------- | ----------------------------------------------- |
| result        | - risk and waste                        | - risk and waste 6 : Productivity and Quality 4 | - risk and waste 4 : Productivity and Quality 6         | - risk and waste 2 : Productivity and Quality 8     | Productivity and Quality                        |
|               | - ad hoc processes                      | - Repeatable practices                          | - Productivity growth                                   | - Stable processes                                  | Planned innocations                             |
|               | - inconsistent outcomes                 | - Reduces rework                                | - Effective automation                                  | - Reuse/knowledge management                        | Change management                               |
|               | - rework                                | - Satisfied commitments                         | - Economy of scale                                      | - Predictable results                               | Capable processes                               |
|               |                                         |                                                 |                                                         |                                                     |                                                 |

Security

To address user security concerns, two unofficial security guides are available.

OPSD – Organizational Preparedness for Secure Development
SMP – Secure Management in Projects
SRTS – Security Requirements and Technical Solution
SVV – Security Verification and Validation

While they do not affect maturity or capability levels, these process areas can be reported in appraisal results.

Process Areas Detail:

The CMMI contains 22 process areas indicating the aspects of product development that are to be covered by company processes.

1. Causal Analysis and Resolution (CAR) `Support Level 5`

Purpose: identify causes of defects and other problems and take action to prevent them from occurring in the future.