Is Going Directly for a CMMI ML 5 Appraisal Allowed?

Is a CMMI v1.2 ML 5 appraisal allowed in the following situation?

One of my company's divisions was successfully appraised to CMMI v1.1 ML 5 but the appraisal results expired in 2009. Now my company wants all three divisions, which are located in different cities, appraised to ML 5. Though skipping levels is not recommended, however, is it allowed to go for the appraisal?

There is nothing from the SEI that prevents a company from being appraised to whatever Capability Level or Maturity Level that it chooses. That being said, what does drive the CL or ML is the organization being able to collect, analyze, and correctly use data for statistical and quantitative analysis, as well as being able to institutionalize the behaviors and practices. You should hire an SEI-Certified High Maturity Lead Appraiser and have him or her perform a Class C or Class B appraisal to determine the risks with your current approach and implementation of ML 5. The outcome of this exercise will determine if it is feasible to achieve ML 5 at all three sites.

The Right Model to Follow

Our operations involve providing reporting solutions & implementing them based on tools like SAP BOBJ, MSTR, MS, ORCL primarily setting up datamarts & ETL processes and also providing technical support to customers as a line of business (Java/.net support for third party tools based on bugs/additional requirements given by customers at random)

Question 1: For such an organization , would it be right to follow CMMI for Development or CMMI for Services or both?
Question 2: Are appraisals made on CMMI V1.3 or are we still in CMMI V1.2. If still on 1.2, when are we likely to move to V1.3?
Question 3: If only a few projects or one division of an organization is appraised, will the appraisal rating stand for the company?

Question 1 – This question is difficult to answer based upon your description. Are you developing a product or delivering a service? I really cannot tell from your description, it could be either or both. If you are developing a product, then the CMMI-DEV might be applicable. If you are delivering a service, then the CMMI-SVC might be applicable. And you could blend the two. Another aspect to consider is are you planning to have a SCAMPI A appraisal? If so, then your Lead Appraiser will be able to help you decide which constellation is applicable to your organization. If you are not planning on being appraised, then I would suggest that you look at both constellations and use the Process Areas that apply best to your organization.
Question 2 – CMMI v1.2 is the current version. The SEI recently announced that v1.3 will be released in November 2010. And based on past experience, the SEI will most likely allow appraisals against v1.2 to be conducted up until October 31, 2011.
Question 3 – The short answer is no. The appraisal results ONLY apply to the organization that was appraised, not the entire company.

Examples of Applying CMMI or CMMI-SVC to Government Organizations

I'm looking for cases where CMMI or CMMI-SVC have been applied (successfully or otherwise) within a government organization. I'm trying to identify lessons learned that would be useful to a US federal government department that has considered applying CMMI practices for process improvement.

There have been multiple US Government and Military organizations that have implemented and been appraised to the CMMI. Just look at the SEI's list of appraisal results http://sas.sei.cmu.edu/pars/pars.aspx and you will find these organizations. As far as the CMMI-SVC goes, this constellation was only released in late Feb 2009 and organizations are just beginning to use the model. So I seriously doubt that there are any examples of use available at this point in time. My guess is that the first time anyone will see examples of the CMMI-SVC being used will be at the 2010 SEPG Conference in Savannah, Georgia March 2010.

CMMI Documentation Request

I have read your blog. Can you provide me some documented CMMI processes (Draft)? I would like to learn and implement the process. I have good experience using ISO 9001 for the past 10 years.

There is no such thing as a set of documented CMMI processes that can be provided for a company, though some unscrupulous consultants will try to sell you a set. Rather, there are industry accepted standards for documenting processes, such as ETVX. These process documentation standards are easily available by searching on the internet. The actual processes for REQM , PP, PMC, SAM, MA, PPQA, CM, etc. are a function of the organization’s business and its practices, though there is some commonality across companies and organizations. However, this commonality exists at the CMMI level. The CMMI is a set of guidelines for process improvement. The implementation of these guidelines will differ from organization to organization. The best advice that I can give you is to document all of your current business practices using an industry accepted process documentation standard, avoiding the temptation to improve the process. By simply documenting your existing processes, you will discover opportunities for improvement, but don’t make them at this point. Just document the process as it is currently practiced. Once you have all of your processes documented, then compare the results to the CMMI, add the missing practices, and address any improvement opportunities. Then you will have a set of processes that your employees will have ownership of and will also comply with the CMMI.

Procedures Specify HOW to Do Something, Not WHAT to Do

A common problem I notice when reviewing an organization's processes and procedures is that the organization doesn't understand how to document a procedure. Rather than simply telling someone HOW to perform the process, the document states a set of requirements that must be met by the people performing the procedure, which then allows multiple ways of performing the procedure by any person attempting to use the document. There seems to be a general misunderstanding that commands or directives tell someone HOW to perform a process, when in actuality all that is being communicated is WHAT to do.

The CMMI Glossary defines process as activities that can be recognized as implementations of practices in a CMMI model. These activities can be mapped to one or more practices in CMMI process areas to allow a model to be useful for process improvement and process appraisal.

The Glossary also defines a process element as the fundamental unit of a process. A process can be defined in terms of sub-processes and/or process elements. A sub-process can be further decomposed into sub-processes and/or process elements; a process element cannot. Each process element covers a closely related set of activities (e.g. estimating element, peer review element). Process elements can be portrayed using templates to be completed, abstractions to be refined, or descriptions to be modified or used. A process element can be an activity or task.

Page 53 of the CMMI book provides the following description of Maturity Level 2:

At Maturity Level 2, the projects of the organization have ensured that processes are planned and executed in accordance with policy; the projects employ skilled people who have adequate resources to produce controlled outputs; involve relevant stakeholders; are monitored, controlled, and reviewed; and are evaluated for adherence to their process descriptions. The process discipline reflected by Maturity Level 2 helps to ensure that existing practices are retained during times of stress. When these practices are in place, projects are performed and managed according to their documented plans.

At Maturity Level 2, the status of work products and the delivery of services are visible to management at defined points (e.g., at major milestones and at the completion of major tasks). Commitments are established among relevant stakeholders and are revised as needed. Work products are appropriately controlled. The work products and services satisfy their specified process descriptions, standards, and procedures.

Page 54 of the CMMI book provides the following description of Maturity Level 3:

At Maturity Level 3, processes are well characterized and understood, and are described in standards, procedures, tools, and methods. The organization’s set of standard processes, which is the basis for Maturity Level 3, is established and improved over time. These standard processes are used to establish consistency across the organization. Projects establish their defined processes by tailoring the organization’s set of standard processes according to tailoring guidelines.

A critical distinction between Maturity Levels 2 and 3 is the scope of standards, process descriptions, and procedures. At Maturity Level 2, the standards, process descriptions, and procedures may be quite different in each specific instance of the process (e.g., on a particular project). At Maturity Level 3, the standards, process descriptions, and procedures for a project are tailored from the organization’s set of standard processes to suit a particular project or organizational unit and therefore are more consistent, except for differences allowed by the tailoring guidelines.

Another critical distinction is that at Maturity Level 3, processes are typically described more rigorously than at Maturity Level 2. A defined process clearly states the purpose, inputs, entry criteria, activities, roles, measures, verification steps, outputs, and exit criteria. At Maturity Level 3, processes are managed more proactively using an understanding of the interrelationships of the process activities and detailed measures of the process, its work products, and its services.

Page 295 in Organizational Process Definition provides some Tips that relate to processes and process assets:

Organizational process assets support a fundamental change in behavior. Projects no longer create their processes from scratch but instead use the best practices of the organization, thus improving quality and saving time and money.

Standard processes define the key activities performed in an organization. Some examples of standard processes include requirements elicitation, design, and testing; planning, estimating, monitoring, and control; and product delivery and support.

The objective is to decompose and define the process so that it can be performed consistently across projects but will allow enough flexibility to meet the unique requirements of each project.

And from the book Interpreting the CMMI by Margaret Kulpa and Kent Johnson, second edition on page 198 there is a section on Defining Procedures that supports the CMMI material quoted above. In the context of the CMMI, procedures are equivalent to sub-processes and process elements.

Procedures are step-by-step instructions on how to perform a task. To be repeatable, the steps need to be broken down to a level that anyone who needs to perform the task, with a general understanding of the work to be done, can perform the work adequately by following the instructions. Procedures are a subset of processes. The process is what to do; the procedures are how to do the steps of the process.

Procedures are step-by-step instructions of how your processes are performed. They include:

• Sequence of activities
• Deliverables
• Controls
• Inspections and reviews
• Guidelines and standards used

In addition, in the CMMI book on pages 99 and 100, Bill Curtis, an author of the Software CMM, talks about policies, PPQA, and process improvement:

Polices that merely regurgitate goals from CMMI process areas represent a lost opportunity for executives to communicate their expectations for behavior in their organizations. Once policies are established, executives need visibility into compliance. Assurance groups have influence only to the extent that executives attend to their reports and address noncompliance. However, the greatest value of assurance groups, and this is subtle in Process and Product Quality Assurance (PPQA), is when they serve as mentors to project managers and technical staff on practices that support compliance. Consequently, assurance groups need to be staffed with competent developers and managers so that they are credible in transferring knowledge of best practices across the organization.

Process improvement must be conducted as a project. Executives must assign responsibility for managing the project, provide funding and resources, expect periodic status reports, and measure results. The person assigned to lead the improvement project must be a good role model for other project managers. Executives should ask frequent questions about project plans and the assumptions underlying them. The guidebooks, defined processes, measures, checklists, and other artifacts produced through process improvements are organizational assets. They should be treated as products, albeit for internal use, and be produced with the same discipline used in producing any other product.

Consequences and Summary
By not specifying how to perform the process steps it gives carte blanche to whoever is performing the process to do whatever they want to in order to satisfy the step. In addition, by not specifying how to perform the process steps, it makes it impossible to perform a PPQA process audit. The person performing the objective evaluation of the process (process audit) needs to know how the process is supposed to be performed in order to create a checklist so he or she can objectively evaluate whether or not the process is being followed the way it is supposed to be followed.

Essentially, by not supplying the information of how to perform a process, you do not have a repeatable process, which is at the core of Maturity Level 2. A repeatable process means that every time someone uses the same documented process description, he or she will perform it the same way. The only way that you can ensure this outcome is to document how the process is performed. At Maturity Level 2 it is permissible to have multiple documented processes for the same process. At Maturity Level 3 the organization is supposed to examine the multiple documented processes and look for exemplar practices to elevate to the organization level to become the standard process for the organization.

The challenge facing the process writers is to document the process such that it is neither too detailed nor too general to follow. If it is too detailed, then you have painted yourself into a corner and the process may be too detailed to correctly follow. If too general, then it basically allows you to do anything you want. Either way, there is no benefit to the organization.

This issue also points out a fundamental difference between ISO 9000 and the CMMI. At its core, ISO 9000 is a set of standards for a quality system. It requires the existence of processes good, bad, or indifferent. In contrast, the CMMI is a set of guidelines for process integration and product improvement. The whole focus of the CMMI is process improvement. And it becomes very difficult to do process improvement if you don’t spell out how a process is performed.

To illustrate the issue allow me to cite an example of incorrectly worded procedure step.

• The Project Manager derives estimates for the size of the software work products, or changes to the size of the software work products.

There is more than one way to estimate size if you don’t specify how to perform this step. By not specifying how, you cripple your ability to analyze the process and identify process improvements.

If I were to ask the Project Manager how he or she peforms this step, I might find out that they do this by using the project requirements and historical data (notes and reports from past projects and lessons learned) from similar past projects to determine size factors (SLOCs, number of files, database size, number of screens) and applying appropriate scaling factors using engineering judgment. The Project Manager then reviews the size estimates with the Team Leads for reasonableness. This is an excellent explanation and practice.

By providing this level of detail, now there is enough information for PPQA to perform a process audit and also enough information to perform process improvement and determine if an estimation model can be built to improve the accuracy of project estimates.

MA and PPQA Questions

I have the following two basic queries about CMMI ML 2:

1. While writing a Metrics and measurement process, should we address the organization level metrics data consolidation and review. As ML 2 is project specific, is it proper to also document the organization level data consolidation? Also can anyone tell me, the right site for definition of metrics like requirement stability index, schedule variance, effort variance etc.?
   
2. Similarly while documenting PPQA process, is it proper to start with defining an organization level PPQA plan? I am looking for boundaries where to limit writing processes compliant to ML 2. I know that G.P 2.1 to G.P 2.10 must be in place to achieve CMMI ML 2, but the organization specific plans/areas must not be mentioned/documented at CMMI ML 2.

You sound like you are focusing on CMMI compliance rather than on your business goals and objectives. One of the basic tenets of the model is your business objectives. That is where your focus belongs. And if done properly, you will have the side benefit of being CMMI compliant. So, to address your questions:

1. When documenting your Measurement and Analysis process, you should focus on those measures that are important to you. Remember, the first MA practice SP 1.1 states “Establish and maintain measurement objectives that are derived from identified information needs and objectives.” So whatever you have identified as information needs and objectives, that should be your MA focus. At ML 2, for many organizations that are just doing this for the first time, I recommend the org take baby steps and begin with a project focus. But you don’t have to be restricted to the project, an ML 2 org may have also identified some org level measures as well. Go to the Practical Software and Systems Measurement web site for the specific measurement information you need www.psmsc.com
   
2. There are NO CMMI-imposed restrictions on the limits of PPQA. Your organization must define its own limits for the processes you are going to audit. Since GP 2.9 applies to all Process Areas, at a minimum for ML 2, PPQA applies to all of the ML 2 Process Areas you have implemented in your organization. But, if there are other processes that are critical and/or important to the success of your business, then it makes perfect sense to have PPQA audit them as well. Again, do what is right for your business.

KPA vs. PA

What is the difference between the terms KPA and PA?

KPA stands for Key Process Area and applied to the Capability Maturity Model (CMM) that was retired years ago. This term no longer has any meaning.

PA stands for a CMMI Process Area.

KPA and PA are basically the same, but KPA is only relevant for the obsolete CMM and PA is only relevant for the current CMMI.

The CMMI Glossary defines a Process Area as a cluster of related practices in an area that, when implemented collectively, satisfy a set of goals considered important for making improvements in that area. All CMMI Process Areas are common to both the Continuous and Staged Representations.

Challenges with Implementing the CMMI in Small Settings

At the 2009 North American SEPG Conference in San Jose last week, I was the first presenter in the Small Settings track. This was a well attended presentation and I wanted to share it on my blog with those of you who were not able to attend this year. I also wrote a companion article published by ExecutiveBrief that you can read at Small Business and the CMMI: Sink or Swim.

Challenges with Implementing the CMMI in Small Settings

View more presentations from Henry Schneider.

CMMI Implementation

I recently joined a company where there is no process and management recruited me to implement the CMMI. The organization has different business units. Though everyone sits together, they work very differently. I conducted a Gap analysis based on the CMMI Level 2 processes and here are the findings:

1. Project Planning & PMC -- they create project plans and they have the regular project team meetings and they share the minutes. Each team has their own format and templates. The projects don't really do estimations. Can we satisfy the PP & PMC PA'ss without doing any estimation? I know it can't be that way, but can it be tailored?
2. Requirements Management: Some of the business units have CCBs to discuss change requests and other business units discuss requirements changes in their project team meetings. The most significant gap I found is in Requirements Traceability. Traceability of Customer requirements to the Functional Requirements and Traceability of Use cases to the Test cases are missing. Is this reason enough to fail the RM PA? One of the Engineering directors asked me how much traceability you need to satisfy this condition. At that time I said 100% of all the requirements. Then I also read from somewhere that it is OK to define that we maintain traceability for at least the MUST BE CUSTOMER REQUIREMENTS. Traceability of other requirements can be made optional. Can it be possible like that?
3. Configuration Management: The projects thought they have a CMP which is embedded in the project plan. What I found missing are the Configuration Audits ( PCA & FCA). Is it possible to satisfy the Configuration Management PA without doing Configuration Audits to check the document status, builds, and backup strategy?
4. PPQA: One of the business units has a Software Quality Assurance plan, but it is done by one of the testers from another project. As a part of PPQA the SQA will do some spot checks based on a pre-defined checklist, which includes Project Planning, Risk Management, Project Monitoring and Control, Integration and releases. But I guess this can be improved by my role as a independent software quality engineer.
5. M&A: I am very much worried with this process area, as of now the organization status is nil with respect to metrics collection, they don't have a metrics database and no metrics have been defined yet. Is it OK to start now to form a team to do some reasearch and come up with metrics definitions, deploy them and start collecting data? My question is how much data do we need to collect to satisfy this PA? And do we need to provide evidence of analyzing these collected data and show some improvements steps taken at the time of SCAMPI apprisals? How long will it take in general to satisfy the Measurement & Analysis PA?
6. SAM: can we tailor this PA if we are not dealing with suppliers? If yes how can it be possible?
   

The directive from the Leadership team is to acheive CMMI Level 3 by end of 2009. I was baffled to hear this. Under these circumstances, what are the chances of getting CMMI Level 3 or my traget is at least CMMI Level 2? That is what my initial target. Can I acheive CMMI Level 2 by the end of 2009? If so, what are the things I need to address?

Here are some of the things I have already started:

1. CMMI Overview training to all the teams
2. Dailogue session on metrics identification
3. Looking into some Requirements tools which provide Traceability
4. Need to push the project team to have configuration audits.

In addition we already have established a process data base and the processes are defined and templates are being used from the parent organization. Since our company is a multi-site company, one of our counter parts has already acheived CMMI Level 3. We will be using the same process database and their templates. I thinking of providing their training on each Process Area as well. Is this a correct way to use the processes and templates of our parent organization? If not, do we need to establish our own local process data base?

First of all, I sympathize with you and the challenges you face. I applaud the fact that you had the foresight to conduct a Gap Analysis of the organization. You have highlighted a number of key weaknesses within the organization. However, to provide you meaningful feedback on all of your points would require working directly with you and your company.

1. What is your CMMI experience? Have you taken the SEI’s Introduction to CMMI class? If not, I strongly recommend that you and possibly those others in your company who are responsible for your processes take the three day class. The class should provide you a more thorough understanding of the CMMI, its interpretations, and material for constructing an internal Overview class.
2. You have identified some serious deficiencies within the organization in all of the ML 2 Process Areas. These need to be analyzed, addressed, corrected, solutions implemented, and then re-evaluated some months into the future before you can consider a formal SCAMPI at any Maturity Level. The length of time before the next evaluation is a function of a number of factors: number of people in the organization, number of projects, typical project duration, how much time and other resources are dedicated to process improvement, etc.
3. The organization needs to first implement Maturity Level 2 to form a firm foundation before considering moving to Maturity Level 3. The issues you have identified are fairly typical. Basically, it sounds like your organization does not perform PPQA or MA and is challenged with Project Management, Requirements Management, and Configuration Management. The first steps here should be to identify the necessary skills-based training classes you need to bring in-house and train your staff on these concepts. If you just purchase tools and push for audits, you most likely will not achieve the desired effect. You have to understand your process first and the reasons for why it is important to perform each of the steps.
4. Since another division has already achieved ML 3, it is a good idea to learn from their mistakes. But be very careful of the temptation to “clone” their processes and procedures. You have to implement the processes and procedures that match the way you conduct business today.
5. Based on what you have outlined, and given how much time and effort it could take just to address the ML 2 issues, I would say that ML 3 is out of the question for 2009. You could conduct a ML 3 SCAMPI A by the end of this year, but in all likelihood it would not be successful.
6. The best suggestion I have for you is to hire a CMMI consultant and Lead Appraiser to provide you with the proper advice and guidance. Otherwise, you could be spending a lot more time and effort than originally anticipated.

Small Business and CMMI: Sink or Swim?

For the past two decades, the number of organizations implementing maturity models has steadily increased. While the initial adopters were the large defense, aerospace, and telecommunications corporations, as the benefits of using models like the CMM and now the CMMI were demonstrated and recognized by industry, other smaller organizations followed suit. Of course, with this increased demand, there is also an increased emphasis in implementing the models and appraising organizations with fewer than twenty-six people.

ExecutiveBrief just published this article I wrote about the challenges faced by small organizations trying to implement the CMMI. You read the entire article at http://www.executivebrief.com/article/small-business-and-cmmi-sink-or-swim/

List of Appraised Companies

How can I see a list of CMMI appraised companies across the globe for all levels and years?

With the release of CMMI v1.2 in August 2006, the SEI instituted a new policy regarding the expiration of appraisal results. All appraisal results expire three years from the anniversary date of the appraisal. The list of published appraisal results is available from the SEI at http://sas.sei.cmu.edu/pars/pars.aspx. Once the appraisal results reach their third anniversary date, they are automatically removed from this list. For example you could check the list today and find the results for an appraisal conducted December 2, 2005. Wait a day or so and you will no longer find the record. You can sort this list based on year, organization name, Maturity Level, etc.

Keep in mind that once the appraisal results have expired, they are no longer valid and the organization should have been re-appraised in order to continue to claim a particular Capability or Maturity Level.

What is the cost of a CMMI v1.2 L3 certification?

Our company is interested to go for CMMI v1.2 ML3 certification. Can you answer the following questions:

1. What are the costs involved (Internal & External)?
2. Are there any SEI cerfication bodies in India?

First of all let me make one clarification to your query. There is no such thing as a CMMI certification. What an organization receives are the results of a SCAMPI A appraisal that indicate the Maturity Level of the organization on the day the appraisal concludes. The organization is not certified. And there is no such thing as an SEI certification body anywhere in the world. What do exist are authorized SEI partners that are allowed to provide CMMI consulting, training, and appraisal services. Visit this web site http://partner-directory.sei.cmu.edu/ and you will be able to find the SEI-authorized partners in India.

The answers to your questions are highly variable depending on the size and scope of your organization and your geographical location. The best place to obtain realistic estimates is to ask several local SEI-authorized CMMI consulting and appraisal providers for their cost proposals, then you will have a handle on the external costs. Internal costs really cannot be determined until you figure out how much work you have to do in order to implement the CMMI and prepare for an appraisal. Suffice it to say, your internal costs will most likely be greater than your external costs.

Can organizations still claim CMM?

If I remember correctly SEI retired the CMM and that organizations can no longer advertize their CMM maturity level. If an organization continues to claim on their web site that they are CMM level 4 - even today - and in addition it is claiming that it will be assessed shortly for CMMi Level 5 for more than a year and half - should we ignore it or bring it to the notice of SEI?If you suggest that we should bring such instances to SEI notice please give me the email id.

The short answer is that any claim of a CMM Maturity Level is no longer valid. As for the ML 5 notice, that is fine as long as the web site states that the organization is working towards ML 5, but I don't see how that is a marketing point. It is similar to a graduate student stating that he or she is in the Doctoral Program and have everything completed except for his or her thesis.

The SEI is not in the business of investigating false claims. Buyer Beware: The only official location to verify an organization's Capability or Maturity Level is the SEI's Published Appraisal Results site http://sas.sei.cmu.edu/pars/pars.aspx. Since the appraisal results are only good for three years, the results are automatically removed on the anniversary date. Just check this site daily for a week or two and you will be able to verify this for yourself. The best approach is to contact the offending organization to inform them of their mistaken claims as they may be unaware of the changes to the SEI's appraisal program. And if you still feel that the SEI should be notified, I would suggest that you contact Jill Diorio who is the SEI Ethics person at jdiorio@sei.cmu.edu.

Query on Process Change Management

Processes are meant for Doing things Right, First time, Every time. This is one of the core concepts I have seen people referring to during process formulation exercises. I presume the whole idea behind this is to make an organisation process driven instead of people driven.In my limited experience, (esp. in small to medium size organisations) I have seen new unit/department heads within a short span of time after their recruitment, devise a series of Continuous Improvement Requests (CIRs) and posted it to the EPG, who on most occasions weigh the CIRs against department and compliance goals, and if they don't see any adverse effect due to these changes, they approve it.One of the premise for approving the changes is to promote positive initiatives in the organisation.

Now, my questions are:

1. Will adopting the practices prescribed by a new department head, which is based on his experiences, affect his subordinates' work( who are the actual practitioners) in an adverse manner?
2. Will organic growth of existing practices (due to collective experience of the practitioners) be ruined due to implementing new practices?
3. Will allowing practice changes from new department heads make an organisation fall behind from process to people driven? (even though this may last until the organisation get accustomed to the new practices) And is this permissible, if we consider the organisation's overall development?

First off, the impacts depend upon the organization’s Maturity Level. A Maturity Level 2 organization doesn’t necessarily have standard procedures for all projects to follow, though I have seen many ML 2 organizations take this approach. Therefore at Maturity Level 2 you can have multiple ways of doing the same thing, from project to project and from manager to manager.

When the organization matures to Maturity Level 3, the premise is that the organization has examined the multiple ways of performing a given practice and determined the Best Practice for the organization and then documents these Best Practices as the set of standard processes for the organization. This examination, coordination, and distribution of the standard processes is typically the responsibility of the Process Group. The Process Group manages the processes and is responsible for coordinating all process changes.

Now having said this, a new department head can make any process changes he or she wants to make. At ML 2 these changes could provide a Best Practice for consideration or additional information on things not to do. However, at ML 3 the organization should have established OPF and OPD processes for making process changes. The new department head would have to follow these change processes to propose his new processes. The Process Group would evaluate his proposals and pilot them as appropriate so the changes could be evaluated in a controlled manner. The outcome of the pilot(s) would determine whether or not the changes are made.

By following these steps, there shouldn’t be any of the problems you allude to in your note. However, if your organization does not have processes in place for making changes to the organization’s processes or the new department head mandates process changes without following the process, then you do have some serious issues to address.

1. Making uncontrolled process changes will impact the practitioners, most likely adversely. People most likely will be frustrated because of the changes.
   
2. Replacing existing procedures with new ones in an uncontrolled manner will adversely disrupt any process improvements and process evolution you have already made.
   
3. Making uncontrolled process changes can cause the organization to regress in Maturity Levels, probably drop from whatever ML you are currently at to ML 1.

CMMi 1.2 Level 3 Query

We have planned to use CMMI 1.2 model for our Organization for process improvement and we are targetting to reach maturity Level 3. The constraint here is we have a very small team in development. E.g. there are only 3 members for database management, 1- 2 team members for front end development (the same is true for middleware development), and a few for production support projects. I am not sure how to manage peer reviews and many other aspects. In all there are around 20 members in the development team. Please let me know the challenges we may face during our journey to maturity Level 3, based on your experience.

Also I am driving the CMMi initiative. Is there any mandate that I should be an SEI-Certified Assessor? I have the required experience in Quality Management System for driving the CMMi initiative, but unfortunately I have not taken any formal Certification on CMMI. Please let me know your thoughts on this point as well.

There are many challenges with process improvement and implementing the CMMI regardless of your size. However, for small organizations, the challenges can be even greater. The biggest challenge is probably budget. Small organizations usually do not have a lot of extra funds for activities not directly associated with producing a product or service. Therefore, you are faced with adding the responsibilities of mapping, defining, and documenting your processes and procedures to your normal 40+ hour/week job. Industry averages over the past two decades show that Process Improvement is roughly 3 – 5% of the organization size. Configuration Management takes another 3 – 5%, as well as PPQA. Worst case the total could be 15% of the organization. So for a development team of about 20 people, you would need 1 person full time on Process Improvement, 1 person full time for CM, and 1 person full time for PPQA. Senior Management is usually reluctant to set aside this much budget when you begin your journey. There is no visible business case for the additional people and what happens is that people have to wear multiple hats to cover these new positions until the burden gets so big that either you stop these activities or management agrees to the additional funding.

Beyond this much it is difficult to provide more information without a better understanding of your organization, management commitment, line of business, etc. There are many ways available to you to scale the CMMI to your organization. You just have to be very careful not to implement something because you think the CMMI requires it, but there is no business value to you. That is the situation that gives process improvement a bad name. Everything that you do with the CMMI must be value-added. About the only way that I know of to avoid mistakes and/or potential obstacles is to work with an experienced CMMI consultant and Lead Appraiser. Over the years we have seen what works and what doesn’t work and there is no need for you to reinvent the “process improvement” wheel one more time.

A third point is that your description implies that you are going directly to Maturity Level 3 without first establishing the foundation of Maturity Level 2. That approach can be a costly one and could jeopardize your program, unless you have a history of process improvement in the organization. The SEI and all Lead Appraisers that I know always recommend that you implement one Maturity Level at a time. The CMMI Staged Representation is a foundational model. You must first establish a firm foundation for process improvement, and that is what you achieve by attaining Maturity Level 2. Then Maturity Level 3 builds upon the foundation of ML 2. Then ML 4 builds upon ML 3. And ML 5 builds upon ML 4. Please keep in mind that I am not saying that you have to be appraised at each level with a SCAMPI A Appraisal. But you need some indication that you have implemented a Maturity Level. The big mistake many organizations make is skipping over ML 2 and going directly to ML 3. There are some fundamental differences in how Project Managers behave at ML 2 vs. ML 3. By skipping ML 2, you run the risk of having ML 3 processes documented but practiced as a ML 2 organization. Therefore, when you are appraised, the results have a high probability of being ML 2, which would NOT be a happy day.

There are no SEI requirements that the person in the organization responsible for implementing the CMMI be an SEI-authorized Lead Appraiser. There really is no benefit to you or your organization for you to become a Lead Appraiser, unless you have lots of internal opportunities to lead appraisals, or your company is in the business of providing CMMI services to other clients. Becoming a Lead Appraiser is an expensive proposition. You have to take at least three classes, which can be a total of $15,000. Before you can be accepted in the classes, you have to be an appraisal team member on at least two appraisals. You have to pass several exams and be observed leading an appraisal. Then you have to lead at least two appraisals over a three year period. In addition, a Lead Appraiser cannot lead an appraisal of his or her own organization.

My best advice to you is to hire a CMMI expert to help you on your journey.

CMMI Certifications & Career Development

I'm a graduate student and starting my degree in 2009. I have over 2 years experience (3 mini assessments) in Process Improvement, CMMI ML 3 and ML 5 evidence collection, and verification. I will be taking the Intro to CMMI class in December 2008.

As I am interested in researching the CMMI and Quality Assurance for my thesis and to shape up my career to be a CMMI consultant position; I contacted SEI. The SEI suggested that I seek the advice and guidance from a few registered Lead Appraisers in different parts of the world on how I should plan my future studies.

My questions are:

1. In the professional world job market is there a value for such research?
2. What other professional qualifications should I gather to be a CMMI consultant?
3. From your experience do you think its worth it (career development wise) to conduct appraisals externally rather than waiting for your organization to provide them free for you?
4. Any other advice you want to provide me in my career planning?

Your guidance in these questions are highly appreciated.

Here is my advice to you to help further your interests and your career.

1. There is always room in the professional arena for research. Research results are regularly presented at professional symposia and conferences. I am sure that the SEI would encourage you to submit an abstract for consideration at an upcoming SEPG Conference. If your research is credible, and you gain visibility in the community, that can only strengthen your credentials as a consultant. It also demonstrates that you are staying current in the field of process improvement.
2. To become a CMMI consultant, you would need practical experience, not necessarily additional professional qualifications. Take a look at the criteria for being on an appraisal team. That criteria also makes for a credible CMMI consultant. So I would recommend that you gain some experience in Project Management, as well as engineering experience, at least 3 to 5 years worth. If you were to start consulting immediately upon graduation, you may be looked upon as providing an academic approach to CMMI implementation.
3. Since implementing the CMMI can take several years and the expenses for appraising an organization are fairly high, there will not be many internal opportunities for appraisals. Especially if you want to become a Lead Appraiser. You may be able to satisfy the minimum requirements to become a Lead Appraiser with internal appraisals, but most likely you won’t be able to conduct enough internal appraisals to maintain your credentials. Therefore, I recommend that you conduct external appraisals. If you were to work for a consulting company specializing in the CMMI, then the company would most likely pay your expenses. Otherwise, you will be faced with financing them yourself.

PMI PMBOK - CMMI Process Map

I often meet managers trained in the PMBOK and are certified PMPs (Project Management Professionals) who do not know enough about the CMMI but continue to press for using PMBOK as a guide in improving IT project management processes. I have studied the PMBOK and believe that the CMMI is a better option for managing IT projects. I can help PMPs understand my views better if I can show a map of processes in both the PMBOK and CMMI processes and then showing additional features of the CMMI helpful in managing IT projects. I would appreciate it if you could lead me to any such study where the two are mapped, something similar to the CMMI - ISO 9001:2000 map.

Try this link from the SEI http://www.dtic.mil/ndia/2005cmmi/thursday/sherer.pdf, it will pull up a presentation that compares and contrasts the CMMI and PMBOK. In addition, this page http://www.sei.cmu.edu/cmmi/adoption/comparisons.html provides links to a number of comparisons between the CMMI and other models and standards.

Full Time Resources for Implementing the CMMI

I have been asked to estimate the number of full time resources required by my company to facilitate its drive to Maturity Level 3 PM, SYS, SW, HW and ACQ. Is there any documentation or published information that will help in putting together a robust estimate of resources required?

First and foremost the driving factor for estimating the number of full time resources needed to implement the CMMI is the size of the organization. Over time we have seen that it takes 3 – 5% of the organization to perform PPQA, 3- 5 % of the organization to perform CM, and 3 – 5% of the organization to perform the necessary CMMI implementation activities.

So, if your organization is about 20 – 30 people, then you may only need one full time resource. However, if your organization is about 100 people, then you may need 3 to 5 full time resources.

Other factors contributing to this estimate is how strong a ML 2 foundation is already in place and how much of what you currently have in place is at ML 3. Documenting the processes and procedures is the easy part, and it can be done by a small core group. The larger task is deploying the new processes and process assets and having people use them to change how they approach their jobs.

Interview Questions to Hire a CMMI Expert

We are implementing the CMMI within our organization and are looking to hire someone to help us achieve this goal. We don't necessarily need a certified Lead Appraiser as of yet, but would like to hire someone with CMMI experience and who may beinterested in becoming a Lead Appriaser. I have a couple of internal candidates that are not Lead Appraisers, but have had CMMI experience (according to their resumes anyhow). What would be some good questions to ask them in an interview to gauge how much experience they truly have? I appreciate any help I can get with this.

One word of caution first. It may not be in your best interests to hire someone who wants to become a Lead Appraiser. There usually aren’t enough internal appraisal opportunities for a candidate Lead Appraiser to get the minimum experience or to maintain their Lead Appraiser credentials, so the person would have to look for appraisal work outside of your organization or company.

Here are some questions that I would ask a candidate for a CMMI position:

1. Have you taken the SEI’s 3-day Introduction to CMMI class? If yes, when did you take the class? Who was your instructor?
2. Have you participated as an appraisal team member? If yes, how many times? What were your duties? What was the scope of the appraisal (Maturity Level)? Who was the Lead Appraiser? What would the Lead Appraiser say about your CMMI capabilities and performance on the appraisal team?
3. Have you helped implement the CMMI in an organization?
4. How long have you been working with the CMMI?
5. Please compare and contrast Capability Level vs. Maturity Level
6. What is the only Process Area that can be categorized as Not Applicable? SAM
7. Have you prepared a PIID? If yes, what was the most difficult task and why?
8. How many years of project management experience do you have?
9. How many years of engineering experience do you have?
10. What is your favorite Process Area and why?

Accepting Items for Use in the Process Asset Library

The Configurable Items (CI) in our organization are controlled CIs [Any Project Related Artifact (PRA) received from any source, on which the project team does not exercise any control]. For example, documents obtained from the client or reference technical material. Documents of external origin, such as the ISO Standard, SEI CMMI, etc. are controlled and managed.

Any Project Related Artifact (PRA) is created and managed by the project team and the changing of which does not need any explicit change request, for example, Software Configuration Plan, Review Plan, Audit Plans etc. A baselined CI is any PRA that is managed by the project team and changing it needs an explicit change request for example: Project Plan, SRS ( Software Requirements Specifications) etc.

I am the lead responsible for building our Process Asset Library (PAL) and would appreciate guidelines for what could be the mandatory or acceptable criteria by which the baselined CIs would be updated in the PAL for use by other groups in the organization. I feel, it would certainly help if the criteria could be defined so that people in the organization would know the parameters based on which they could help contribute or share best practices, lessons learned, and any other artifacts in the Process Asset Library for use by anyone in the organization.

I really hate to do this to you, but the answer to your question is it depends upon your needs. Your organization has to decide for itself the acceptance criteria for PAL items. The CMMI does not mandate any criteria for accepting input to the PAL.

From a practical standpoint, you want to encourage the practitioners, project teams, and managers to submit everything of use to you for consideration as candidate PAL items. As the lead responsible for building the PAL, you might consider reviewing each submitted item to determine if you want it in the PAL. I always advocate that in addition to providing a template in the PAL for use by the project teams that you also provide an example of how you want the template to be correctly filled out. Providing a good example can be problematic sometimes. So you would have to review each submitted artifact of the completed template to determine if you want to post that as an example in the PAL. Other project related information may need to be sanitized or normalized by you before you post it to the PAL for use by existing or new projects.

If someone wanted to share a best practice or make a process improvement suggestion, then you should have a process in place for allowing someone to submit a process change. Many companies use their established product/project Change Request system as the tool for submitting Process Change Requests.

The Bottom Line is that you should encourage and accept all data, information, and input as candidate PAL items. Then the Software Engineering Process Group (SEPG), Engineering Process Group (EPG), or Process Group (PG) reviews the input for inclusion in the PAL.