Now that you have been introduced to the components of CMMI models, you need to understand how they fit together to meet your process improvement needs. This chapter introduces the concept of levels and shows how the process areas are organized and used.
CMMI-ACQ does not specify that a project or organization must follow a particular acquisition process flow or that a certain number of deliverables per day or specific performance targets be achieved—only that they have processes in place for adequately addressing acquisition-related practices. To determine whether this is so, a project or organization maps its processes to the process areas contained in this document.
The mapping of processes to process areas enables acquirers to track their progress against the CMMI-ACQ model as they implement processes. It is not intended that every process area of the CMMI-ACQ will map one to one with a given organization’s or project’s processes.
Levels are used in CMMI to describe an evolutionary path recommended for an organization that wants to improve the processes it uses to acquire capabilities, including products and services. Levels can also be the outcome of the rating activity in appraisals.[1] Appraisals can apply to entire companies or to smaller groups such as a small group of projects or a division in a company.
[1] For more information about appraisals, refer to Appraisal Requirements for CMMI and the Standard CMMI Appraisal Method for Process Improvement Method Definition Document [SEI 2006c, SEI 2006b].
Authors’ Note
Levels are useful for benchmarking your capabilities against a publicly reviewed set of practices and establishing improvement priorities. However, be sure to consider the entire team’s capabilities (e.g., acquirer, supplier, and end user) when trying to maximize the outcomes and reduce risk on a particular project.
Authors’ Note
For guidance on how to use CMMI to help reduce project risk across the entire team, see the Software Engineering Institute (SEI) report, “Understanding and Leveraging a Supplier’s CMMI Efforts: A Guidebook for Acquirers” (CMU/SEI-2007-TR-004).
CMMI supports two improvement paths using levels. One path enables organizations to incrementally improve processes corresponding to an individual process area (or process areas) selected by the organization. The other path enables organizations to improve a set of related processes by incrementally addressing successive sets of process areas.
These two improvement paths are associated with the two types of levels: capability levels and maturity levels. These levels correspond to two approaches to process improvement, called representations. The two representations are continuous and staged. The continuous representation has capability levels. The staged representation has maturity levels.
Regardless of which representation you select, the level concept is the same. Levels characterize improvement from an ill-defined state to a state that uses quantitative information to determine and manage improvements that are needed to meet an organization’s business objectives.
To reach a particular level, an organization must satisfy all of the appropriate goals of the process area or set of process areas that are targeted for improvement, regardless of whether it is a capability or a maturity level.
Both representations provide ways to implement process improvement to achieve business objectives, and both provide the same essential content and use the same model components.
Figure 3.1 illustrates the structures of the continuous and staged representations. The differences jump out at you immediately when you look at these structures. The staged representation utilizes maturity levels, whereas the continuous representation utilizes capability levels.
What may strike you as you compare these two representations is their similarity. Both have many of the same components (e.g., process areas, specific goals, and specific practices), and these components have the same hierarchy and configuration.
What is not readily apparent from the high-level view in Figure 3.1 is that the continuous representation focuses on process area capability as measured by capability levels and the staged representation focuses on organizational maturity as measured by maturity levels. The following dimensions (the capability/maturity dimensions) of CMMI are used for benchmarking and appraisal activities, as well as for guiding an organization’s improvement efforts.
• Capability levels apply to an organization’s process improvement achievement in individual process areas. These levels are a means for incrementally improving the processes corresponding to a given process area. There are six capability levels, which are numbered 0 through 5.
• Maturity levels apply to an organization’s process improvement achievement across multiple process areas. These levels are a means of predicting the general outcomes of the next project undertaken. There are five maturity levels, numbered 1 through 5.
Table 3.1 compares the six capability levels to the five maturity levels. Notice that the names of four of the levels are the same in both representations. The differences are that there is no maturity level 0, and at level 1 the capability level is Performed, whereas the maturity level is Initial. Therefore, the starting point is different.
The continuous representation is concerned with selecting both a particular process area to improve and the desired capability level for that process area. In this context, whether a process is performed or incomplete is important. Therefore, the name incomplete is given to the continuous representation starting point.
Because the staged representation is concerned with the overall maturity of the organization, whether individual processes are performed or incomplete is not the primary focus. Therefore, the name initial is given to the staged representation starting point.
Both capability levels and maturity levels provide a way to measure how well organizations can and do improve their processes. However, the associated approach to process improvement is different.
To support those using the continuous representation, all CMMI models reflect capability levels in their design and content.
The six capability levels, designated by the numbers 0 through 5, are as follows:
A capability level for a process area is achieved when all of the generic goals are satisfied up to that level. The fact that capability levels 2 through 5 use the same terms as generic goals 2 through 5 is intentional because each of these generic goals and practices reflects the meaning of the capability levels of the goals and practices. (See the Generic Goals and Generic Practices section in Part Two for more information about generic goals and practices.) A short description of each capability level follows.
An incomplete process is a process that either is not performed or is partially performed. One or more of the specific goals of the process area are not satisfied, and no generic goals exist for this level since there is no reason to institutionalize a partially performed process.
A capability level 1 process is characterized as a performed process. A performed process is a process that satisfies the specific goals of the process area. It supports and enables the work needed to acquire capabilities.
Although capability level 1 results in important improvements, those improvements can be lost over time if they are not institutionalized. The application of institutionalization (the CMMI generic practices at capability levels 2 through 5) helps to ensure that improvements are maintained.
A capability level 2 process is characterized as a managed process. A managed process is a performed (capability level 1) process that has the basic infrastructure in place to support the process. It is planned and executed in accordance with policy; employs skilled people who have adequate resources to produce controlled outputs; involves relevant stakeholders; is monitored, controlled, and reviewed; and is evaluated for adherence to its process description. The process discipline reflected by capability level 2 helps to ensure that existing practices are retained during times of stress.
A capability level 3 process is characterized as a defined process. A defined process is a managed (capability level 2) process that is tailored from the organization’s set of standard processes according to the organization’s tailoring guidelines, and it contributes work products, measures, and other process improvement information to the organizational process assets.
A critical distinction between capability levels 2 and 3 is the scope of standards, process descriptions, and procedures. At capability level 2, the standards, process descriptions, and procedures may be quite different in each specific instance of the process (e.g., on a particular project). At capability level 3, the standards, process descriptions, and procedures for a project are tailored from the organization’s set of standard processes to suit a particular project or organizational unit and therefore are more consistent, except for the differences allowed by the tailoring guidelines.
Another critical distinction is that at capability level 3, processes are typically described more rigorously than at capability level 2. A defined process clearly states the purpose, inputs, entry criteria, activities, roles, measures, verification steps, outputs, and exit criteria. At capability level 3, processes are managed more proactively using an understanding of the interrelationships of the process activities and detailed measures of the process, its work products, and its services.
A capability level 4 process is characterized as a quantitatively managed process. A quantitatively managed process is a defined (capability level 3) process that is controlled using statistical and other quantitative techniques. Quantitative objectives for quality and process performance are established and used as criteria in managing the process. Quality and process performance is understood in statistical terms and is managed throughout the life of the process.
A capability level 5 process is characterized as an optimizing process. An optimizing process is a quantitatively managed (capability level 4) process that is improved based on an understanding of the common causes of variation inherent in the process. The focus of an optimizing process is on continually improving the range of process performance through both incremental and innovative improvements.
Remember that capability levels 2 through 5 use the same terms as generic goals 2 through 5, and a detailed description of these terms appears in the Generic Goals and Generic Practices section in Part Two of this book.
The capability levels of a process area are achieved through the application of generic practices or suitable alternatives to the processes associated with that process area.
Reaching capability level 1 for a process area is equivalent to saying that the processes associated with that process area are performed processes.
Reaching capability level 2 for a process area is equivalent to saying that there is a policy that indicates you will perform the process. There is a plan for performing it, resources are provided, responsibilities are assigned, training to perform it is provided, selected work products related to performing the process are controlled, and so on. In other words, a capability level 2 process can be planned and monitored just like any project or support activity.
Reaching capability level 3 for a process area assumes that an organizational standard process exists that is associated with that process area and that can be tailored to the needs of the project. The processes in the organization are now more consistently defined and applied because they are based on organizational standard processes.
Reaching capability level 4 for a process area assumes that this process area is a key business driver that the organization wants to manage using quantitative and statistical techniques. This analysis gives the organization more visibility into the performance of selected subprocesses, which will make it more competitive in the marketplace.
Reaching capability level 5 for a process area assumes that you have stabilized the selected subprocesses and that you want to reduce the common causes of variation in that process. Remember that variation is a natural occurrence in any process, so although it is conceptually feasible to improve all processes, it is not economical to improve all processes to level 5. Again, you want to concentrate on those processes that help you to meet your business objectives.
To support those using the staged representation, all CMMI models reflect maturity levels in their design and content. A maturity level consists of related specific and generic practices for a predefined set of process areas that improve the organization’s overall performance. The maturity level of an organization provides a way to predict an organization’s performance in a given discipline or set of disciplines. Experience has shown that organizations do their best when they focus their process improvement efforts on a manageable number of process areas at a time and that those areas require increasing sophistication as the organization improves.
A maturity level is a defined evolutionary plateau for organizational process improvement. Each maturity level matures an important subset of the organization’s processes, preparing it to move to the next maturity level. The maturity levels are measured by the achievement of the specific and generic goals associated with each predefined set of process areas.
There are five maturity levels, each a layer in the foundation for ongoing process improvement, designated by the numbers 1 through 5:
Remember that maturity levels 2 through 5 use the same terms as capability levels 2 through 5. This was intentional because the concepts of maturity levels and capability levels are complementary. Maturity levels are used to characterize organizational improvement relative to a set of process areas, and capability levels characterize organizational improvement relative to an individual process area.
At maturity level 1, processes are usually ad hoc and chaotic. The organization usually does not provide a stable environment to support processes. Success in these organizations depends on the competence and heroics of the people in the organization and not on the use of proven processes. In spite of this chaos, maturity level 1 organizations acquire products and services that often work but frequently exceed the budget and schedule documented in their plans.
Maturity level 1 organizations are characterized by a tendency to overcommit, abandonment of processes in a time of crisis, and an inability to repeat their successes.
At maturity level 2, projects establish the foundation for an organization to become an effective acquirer of needed capabilities by institutionalizing basic project management and supplier management practices. Projects define a supplier strategy, create project plans, and monitor and control the project to ensure that the product or service is delivered as planned. The acquirer establishes an agreement with suppliers supporting the projects and manages such agreements to ensure that each supplier delivers on its commitments. The acquirer develops and manages customer and contractual requirements. Configuration management and process and product quality assurance are institutionalized, and the acquirer also develops the capability to measure and analyze process performance.
At maturity level 2, projects, processes, work products, and services are managed. The acquirer ensures that processes are planned in accordance with policy. To execute the process, the acquirer provides adequate resources, assigns responsibility for performing the process, trains people on the process, and ensures that the designated work products of the process are under appropriate levels of configuration management. The acquirer identifies and involves appropriate stakeholders and periodically monitors and controls the process. Process adherence is periodically evaluated and process performance is shared with senior management. The process discipline reflected by maturity level 2 helps to ensure that existing practices are retained during times of stress.
At maturity level 3, acquirers use defined processes for managing projects and suppliers. They embed tenets of project management and acquisition best practices, such as integrated project management and acquisition technical management, into the standard process set. The acquirer verifies that selected work products meet their requirements and validates products and services to ensure that they fulfill their intended use in the intended environment. These processes are well characterized and understood and are described in standards, procedures, tools, and methods.
The organization’s set of standard processes, which is the basis for maturity level 3, is established and improved over time. These standard processes are used to establish consistency across the organization. Projects establish their defined processes by tailoring the organization’s set of standard processes according to tailoring guidelines. (See the glossary for a definition of “organization’s set of standard processes.”)
A critical distinction between maturity levels 2 and 3 is the scope of standards, process descriptions, and procedures. At maturity level 2, the standards, process descriptions, and procedures may be quite different in each specific instance of the process (e.g., on a particular project). At maturity level 3, the standards, process descriptions, and procedures for a project are tailored from the organization’s set of standard processes to suit a particular project or organizational unit and therefore are more consistent except for the differences allowed by the tailoring guidelines.
Another critical distinction is that at maturity level 3, processes are typically described more rigorously than at maturity level 2. A defined process clearly states the purpose, inputs, entry criteria, activities, roles, measures, verification steps, outputs, and exit criteria. At maturity level 3, processes are managed more proactively using an understanding of the interrelationships of process activities and detailed measures of the process, its work products, and its services.
At maturity level 3, the organization must further mature the maturity level 2 process areas. Generic practices associated with generic goal 3 that were not addressed at maturity level 2 are applied to achieve maturity level 3.
Due to the acquirer–supplier relationship, the need for early and aggressive detection of risk is compounded by the complexity of projects acquiring products and services. The purpose of risk management is to identify and assess project risks during project planning and to manage these risks throughout the project.
At maturity level 4, acquirers establish quantitative objectives for quality and process performance and use them as criteria in managing processes. Quantitative objectives are based on the needs of the customer, end users, organization, and process implementers. Quality and process performance is understood in statistical terms and is managed throughout the life of the processes.
For selected subprocesses, specific measures of process performance are collected and statistically analyzed. When selecting processes or subprocesses for analysis, it is critical to understand the relationships among different processes and subprocesses and their impact on the acquirer’s and supplier’s performance relative to delivering the product specified by the customer. Such an approach helps to ensure that quantitative and statistical management is applied where it has the most overall value to the business. Supplier process performance is analyzed as it interfaces with acquirer processes, through data and measures submitted by the supplier. Performance models are used to set performance objectives for both acquirer and supplier performance and to help both parties achieve their objectives.
A critical distinction between maturity levels 3 and 4 is the predictability of process performance. At maturity level 4, the performance of processes is controlled using statistical and other quantitative techniques and is quantitatively predictable. At maturity level 3, processes are typically only qualitatively predictable.
At maturity level 5, an organization continually improves its processes based on a quantitative understanding of the common causes of variation inherent in processes. (See the definition of “common cause of process variation” in the glossary.)
Maturity level 5 focuses on continually improving process performance through incremental and innovative process and technology improvements that enhance the acquirer’s and its suppliers’ ability to meet the acquirer’s quality and process-performance objectives.
Quantitative process improvement objectives for the organization are established, continually revised to reflect changing business objectives, and used as criteria in managing process improvement. The effects of deployed process improvements are measured and compared to quantitative process improvement objectives. Both the defined processes and the organization’s set of standard processes are targets of measurable improvement activities.
The acquirer typically achieves its quality and performance objectives through coordination with its suppliers. The acquirer typically focuses on capability differentiation and collaborative supplier management. Achievement of these objectives also depends on the acquirer’s being able to effectively evaluate and deploy proposed improvements to processes and technologies. For best results, members of the acquirer–supplier network participate in the acquirer’s process and technology improvement activities. Process improvement proposals are systematically gathered and addressed.
A critical distinction between maturity levels 4 and 5 is the type of process variation addressed. At maturity level 4, the organization is concerned with addressing special causes of process variation and providing statistical predictability of results. Although processes may produce predictable results, the results may be insufficient to achieve established objectives. At maturity level 5, the organization is concerned with addressing common causes of process variation and with changing the process (to shift the mean of the process performance or reduce the inherent process variation experienced) to improve process performance and to achieve established quantitative process improvement objectives.
Organizations can achieve progressive improvements in their organizational maturity by achieving control first at the project level and continuing to the most advanced level—organization-wide continuous process improvement—using both quantitative and qualitative data to make decisions.
Since improved organizational maturity is associated with improvement in the range of expected results that can be achieved by an organization, it is one way of predicting the general outcomes of the organization’s next project. For instance, at maturity level 2, the organization has been elevated from ad hoc to disciplined by establishing sound project management. As your organization achieves generic and specific goals for the set of process areas in a maturity level, you are increasing your organizational maturity and reaping the benefits of process improvement. Because each maturity level forms a necessary foundation for the next level, trying to skip maturity levels is usually counterproductive.
At the same time, you must recognize that process improvement efforts should focus on the needs of the organization in the context of its business environment and that process areas at higher maturity levels address the current needs of an organization or project. For example, organizations seeking to move from maturity level 1 to maturity level 2 are frequently encouraged to establish a process group, which is addressed by the Organizational Process Focus process area that resides at maturity level 3. Although a process group is not a necessary characteristic of a maturity level 2 organization, it can be a useful part of the organization’s approach to achieving maturity level 2.
This situation is sometimes characterized as establishing a maturity level 1 process group to bootstrap the maturity level 1 organization to maturity level 2. Maturity level 1 process improvement activities may depend primarily on the insight and competence of the process group staff until an infrastructure to support more disciplined and widespread improvement is in place.
Organizations can institute process improvements anytime they choose, even before they are prepared to advance to the maturity level at which the specific practice is recommended. In such situations, however, organizations should understand that the success of these improvements is at risk because the foundation for their successful institutionalization has not been completed. Processes without the proper foundation may fail at the point they are needed most—when they are under stress.
A defined process that is characteristic of a maturity level 3 organization can be placed at great risk if maturity level 2 management practices are deficient. For example, management may commit to a poorly planned schedule or fail to control changes to baselined requirements. Similarly, many organizations prematurely collect the detailed data characteristic of maturity level 4 only to find the data uninterpretable because of inconsistencies in processes and measurement definitions.
Process areas are viewed differently in continuous and staged representations. Figure 3.2 compares views of how process areas are used in the continuous representation and in the staged representation.
The continuous representation enables an organization to choose the focus of its process improvement efforts by choosing those process areas, or sets of interrelated process areas, that best benefit the organization and its business objectives. Although there are some limits on what an organization can choose because of the dependencies among process areas, the organization has considerable freedom in its selection.
Authors’ Note
When selecting which process areas to use to improve your organization’s processes, take a risk-based approach. For example, if most projects have difficulty selecting appropriate acquisition strategies or can’t effectively perform trade studies, Decision Analysis and Resolution might be a good place to start.
To support those using the continuous representation, process areas are organized into four categories: Process Management, Project Management, Acquisition, and Support. These categories emphasize some of the key relationships that exist among the process areas.
Once you select process areas, you must also select how much you would like to mature processes associated with those process areas (i.e., select the appropriate capability level). Capability levels and generic goals and practices support the improvement of processes associated with individual process areas. For example, an organization may wish to reach capability level 2 in one process area and capability level 4 in another. As the organization reaches a capability level, it sets its sights on the next capability level for one of these same process areas, or it decides to widen its view and address a larger number of process areas.
Authors’ Note
Consider improving processes that cross acquirer–supplier boundaries, such as the requirements process, and perform joint acquirer–supplier improvement activities.
This selection of a combination of process areas and capability levels is typically described in a target profile. A target profile defines all of the process areas to be addressed and the targeted capability level for each. This profile governs which goals and practices the organization will address in its process improvement efforts.
Most organizations, at minimum, target capability level 1, which requires that all specific goals of the process area be achieved. However, organizations that target capability levels higher than 1 concentrate on the institutionalization of selected processes in the organization by implementing the associated generic goals and practices.
The staged representation provides a predetermined path of improvement from maturity level 1 to maturity level 5 that involves achieving the goals of the process areas at each maturity level. To support those using the staged representation, process areas are grouped by maturity level, indicating which process areas to implement to achieve each maturity level. For example, at maturity level 2, there is a set of process areas that an organization would use to guide its process improvement until it can achieve all the goals of all these process areas. Once maturity level 2 is achieved, the organization focuses its efforts on maturity level 3 process areas, and so on. The generic goals that apply to each process area are also predetermined. Generic goal 2 applies to maturity level 2 and generic goal 3 applies to maturity levels 3 through 5.
Table 3.2 provides a list of CMMI-ACQ process areas and their associated categories and maturity levels.
Equivalent staging is a way to compare results from using the continuous representation to those of the staged representation. In essence, if you measured improvement relative to selected process areas using capability levels in the continuous representation, how would you compare that to maturity levels? Is this possible?
Up to this point, we have not discussed process appraisals in much detail. The Standard CMMI Appraisal Method for Process Improvement (SCAMPI) method[2] is used to appraise organizations using CMMI, and one result of an appraisal is a rating [SEI 2006b, Ahern 2008]. If the continuous representation is used for an appraisal, the rating is a capability level profile. If the staged representation is used for an appraisal, the rating is a maturity level (e.g., maturity level 3) rating.
A capability level profile is a list of process areas and the corresponding capability level achieved for each. This profile enables an organization to track its capability level by process area. The profile is an achievement profile when it represents the organization’s actual progress for each process area. Alternatively, the profile is a target profile when it represents the organization’s planned process improvement objectives. Figure 3.3 illustrates a combined target and achievement profile. The gray portion of each bar represents what has been achieved. The unshaded portion represents what remains to be accomplished to meet the target profile.
An achievement profile, when compared with a target profile, enables an organization to plan and track its progress for each selected process area. Maintaining capability level profiles is advisable when using the continuous representation.
Target staging is a sequence of target profiles that describes the path of process improvement for the organization to follow. When building target profiles, the organization should pay attention to the dependencies between generic practices and process areas. If a generic practice depends on a process area, either to carry out the generic practice or to provide a prerequisite product, the generic practice may be much less effective when the process area is not implemented.[3]
[3] See Table 8.2 in the Generic Goals and Generic Practices section of Part Two for more information about the dependencies between generic practices and process areas.
Although there are many reasons to use the continuous representation, ratings consisting of capability level profiles are limited in their ability to provide organizations with a way to generally compare themselves with other organizations. Capability level profiles could be used if each organization selected the same process areas; however, maturity levels have been used to compare organizations for years and already provide predefined sets of process areas.
Because of this situation, equivalent staging was created. Equivalent staging enables an organization using the continuous representation for an appraisal to convert a capability level profile to the associated maturity level rating.
The most effective way to depict equivalent staging is to provide a sequence of target profiles, each of which is equivalent to a maturity level rating of the staged representation. The result is a target staging that is equivalent to the maturity levels of the staged representation.
Figure 3.4 shows a summary of the target profiles that must be achieved when using the continuous representation to be equivalent to maturity levels 2 through 5. Each shaded area in the capability level columns represents a target profile that is equivalent to a maturity level.
The following rules summarize equivalent staging.
• To achieve maturity level 2, all process areas assigned to maturity level 2 must achieve capability level 2 or higher.
• To achieve maturity level 3, all process areas assigned to maturity levels 2 and 3 must achieve capability level 3 or higher.
• To achieve maturity level 4, all process areas assigned to maturity levels 2, 3, and 4 must achieve capability level 3 or higher.
• To achieve maturity level 5, all process areas must achieve capability level 3 or higher.
These rules and the table for equivalent staging are complete; however, you may ask why target profiles 4 and 5 do not extend into the CL4 and CL5 columns. The reason is that maturity level 4 process areas describe a selection of the subprocesses to be stabilized based, in part, on the quality and process-performance objectives of the organization and projects. Not every process area will be addressed in the selection, and CMMI does not presume in advance which process areas might be addressed in the selection.
So, the achievement of capability level 4 for process areas cannot be predetermined, because the choices depend on the selections made by the organization in its implementation of the maturity level 4 process areas. Thus, Figure 3.4 does not show target profile 4 extending into the CL4 column, although some process areas will have achieved capability level 4. The situation for maturity level 5 and target profile 5 is similar.
The existence of equivalent staging should not discourage users of the continuous representation from establishing target profiles that extend above capability level 3. Such a target profile would be determined in part by the selections the organization makes to meet its business objectives.