How to Start With the CMMI

If a private software company wants to do get a certificate of quality for CMMI Level 2, what must this company do in order to obtain Level 2? And also what are the steps that must be followed from the start (initial) to achieve CMMI Level 2 (Managed)?

First let me state that there is no certification of any type for the CMMI. Individual Lead Appraisers will issue something looks like a certificate to the organization that was appraised indicating the SCAMPI A results. But this is not a certification. The only things that the SEI certifies are the CMMI instructors and Lead Appraisers.

Here are the necessary steps for achieving Maturity Level 2 for the CMMI-DEV. These steps are not necessarily sequential, some can occur concurrently.

1. Hire an SEI-certified Lead Appraiser to conduct a Gap Analysis of the company to determine the current process strengths and weaknesses and help the company construct a Process Improvement Plan (PIP).
2. Obtain executive management sponsorship for the process improvement effort.
3. Train the people responsible for the company’s processes and for addressing the action items in the PIP on the 3-day SEI Introduction to CMMI v1.2 class.
4. Address the issues from the Gap Analysis, document the necessary processes and procedures, and begin conducting the PPQA process and work product audits.
5. Allow time for the new and/or modified processes to get some use on various projects.
6. Conduct a SCAMPI B appraisal as a dress rehearsal for the SCAMPI A. Identify any issues and weaknesses that are potential risks to achieving Maturity Level 2.
7. Create a new PIP to address the SCAMPI B identified weaknesses and risks.
8. Address these issues
9. Conduct the Maturity Level 2 SCAMPI A appraisal.

Advice on a Gap Analysis

For the first assessment, does the gap analysis have to be performed against practices or against work products?

There are no specified standard requirements for a Gap Analysis. The Gap Analysis is intended to identify major differences between a model standard and actual practice. A Gap Analysis may involve just reviewing documents, just interviewing people, or a combination of both. I like to evaluate a combination of documents and people for a Gap Analysis. This approach yields the best results, because in many cases the process as practiced is different from the process as documented.

CMMI Implementation

I recently joined a company where there is no process and management recruited me to implement the CMMI. The organization has different business units. Though everyone sits together, they work very differently. I conducted a Gap analysis based on the CMMI Level 2 processes and here are the findings:

1. Project Planning & PMC -- they create project plans and they have the regular project team meetings and they share the minutes. Each team has their own format and templates. The projects don't really do estimations. Can we satisfy the PP & PMC PA'ss without doing any estimation? I know it can't be that way, but can it be tailored?
2. Requirements Management: Some of the business units have CCBs to discuss change requests and other business units discuss requirements changes in their project team meetings. The most significant gap I found is in Requirements Traceability. Traceability of Customer requirements to the Functional Requirements and Traceability of Use cases to the Test cases are missing. Is this reason enough to fail the RM PA? One of the Engineering directors asked me how much traceability you need to satisfy this condition. At that time I said 100% of all the requirements. Then I also read from somewhere that it is OK to define that we maintain traceability for at least the MUST BE CUSTOMER REQUIREMENTS. Traceability of other requirements can be made optional. Can it be possible like that?
3. Configuration Management: The projects thought they have a CMP which is embedded in the project plan. What I found missing are the Configuration Audits ( PCA & FCA). Is it possible to satisfy the Configuration Management PA without doing Configuration Audits to check the document status, builds, and backup strategy?
4. PPQA: One of the business units has a Software Quality Assurance plan, but it is done by one of the testers from another project. As a part of PPQA the SQA will do some spot checks based on a pre-defined checklist, which includes Project Planning, Risk Management, Project Monitoring and Control, Integration and releases. But I guess this can be improved by my role as a independent software quality engineer.
5. M&A: I am very much worried with this process area, as of now the organization status is nil with respect to metrics collection, they don't have a metrics database and no metrics have been defined yet. Is it OK to start now to form a team to do some reasearch and come up with metrics definitions, deploy them and start collecting data? My question is how much data do we need to collect to satisfy this PA? And do we need to provide evidence of analyzing these collected data and show some improvements steps taken at the time of SCAMPI apprisals? How long will it take in general to satisfy the Measurement & Analysis PA?
6. SAM: can we tailor this PA if we are not dealing with suppliers? If yes how can it be possible?
   

The directive from the Leadership team is to acheive CMMI Level 3 by end of 2009. I was baffled to hear this. Under these circumstances, what are the chances of getting CMMI Level 3 or my traget is at least CMMI Level 2? That is what my initial target. Can I acheive CMMI Level 2 by the end of 2009? If so, what are the things I need to address?

Here are some of the things I have already started:

1. CMMI Overview training to all the teams
2. Dailogue session on metrics identification
3. Looking into some Requirements tools which provide Traceability
4. Need to push the project team to have configuration audits.

In addition we already have established a process data base and the processes are defined and templates are being used from the parent organization. Since our company is a multi-site company, one of our counter parts has already acheived CMMI Level 3. We will be using the same process database and their templates. I thinking of providing their training on each Process Area as well. Is this a correct way to use the processes and templates of our parent organization? If not, do we need to establish our own local process data base?

First of all, I sympathize with you and the challenges you face. I applaud the fact that you had the foresight to conduct a Gap Analysis of the organization. You have highlighted a number of key weaknesses within the organization. However, to provide you meaningful feedback on all of your points would require working directly with you and your company.

1. What is your CMMI experience? Have you taken the SEI’s Introduction to CMMI class? If not, I strongly recommend that you and possibly those others in your company who are responsible for your processes take the three day class. The class should provide you a more thorough understanding of the CMMI, its interpretations, and material for constructing an internal Overview class.
2. You have identified some serious deficiencies within the organization in all of the ML 2 Process Areas. These need to be analyzed, addressed, corrected, solutions implemented, and then re-evaluated some months into the future before you can consider a formal SCAMPI at any Maturity Level. The length of time before the next evaluation is a function of a number of factors: number of people in the organization, number of projects, typical project duration, how much time and other resources are dedicated to process improvement, etc.
3. The organization needs to first implement Maturity Level 2 to form a firm foundation before considering moving to Maturity Level 3. The issues you have identified are fairly typical. Basically, it sounds like your organization does not perform PPQA or MA and is challenged with Project Management, Requirements Management, and Configuration Management. The first steps here should be to identify the necessary skills-based training classes you need to bring in-house and train your staff on these concepts. If you just purchase tools and push for audits, you most likely will not achieve the desired effect. You have to understand your process first and the reasons for why it is important to perform each of the steps.
4. Since another division has already achieved ML 3, it is a good idea to learn from their mistakes. But be very careful of the temptation to “clone” their processes and procedures. You have to implement the processes and procedures that match the way you conduct business today.
5. Based on what you have outlined, and given how much time and effort it could take just to address the ML 2 issues, I would say that ML 3 is out of the question for 2009. You could conduct a ML 3 SCAMPI A by the end of this year, but in all likelihood it would not be successful.
6. The best suggestion I have for you is to hire a CMMI consultant and Lead Appraiser to provide you with the proper advice and guidance. Otherwise, you could be spending a lot more time and effort than originally anticipated.

CMMI Maturity 3 Appraisal Process

We are planning to go to CMMI 3 level certification. I recently joined in my company. Please tell me the necesary processes and steps.

1. First off, just to be clear, there is no such thing as “CMMI 3 level certification.” An organization is appraised to the CMMI using the SCAMPI A appraisal method to determine either the organization’s Maturity Level or the Capability Level of the organization’s processes. The result of the SCAMPI A is not a certification, but simply a rating of the current Maturity Level or Capability Level.
2. Has your company already achieved Maturity Level 2? Has your company hired a CMMI consultant? Has your company hired an SEI-authorized SCAMPI Lead Appraiser? Has an SEI-authorized instructor provided the SEI Introduction to CMMI class to your company?
3. If the answer to all of these questions is NO, then hire a CMMI consultant and a Lead Appraiser. The Lead Appraiser cannot provide the CMMI consulting. Most Lead Appraisers are also authorized CMMI instructors, so the next step is to train your process group and any people who might be an appraisal team member on the CMMI.
   
4. Perform a Class C appraisal (gap analysis) to identify where you need to focus your CMMI implementation efforts. Use the findings from the Class C to write a process improvement plan, and use the plan to monitor and control your CMMI implementation efforts.
   
5. Implement CMMI Maturity Level 2 FIRST. Once you have established the firm project management foundation of Maturity Level 2, THEN consider implementing Maturity Level 3. If you try to implement BOTH Maturity Level 2 and Maturity Level 3 at the same time, you will encounter difficulties. There is a huge difference between managing projects at Maturity Level 2 and managing projects at Maturity Level 3.
   
6. Once you feel comfortable that you have addressed all of the findings from the Class C and you have had several project cycles to institutionalize the documented processes, then consult with your Lead Appraiser to determine if your organization is ready to conduct a benchmarking SCAMPI A appraisal.
   
7. There will be more training (appraisal team and PIIDs) and activities leading up to the SCAMPI A, but your Lead Appraiser will tell you exactly what you will need to do to prepare for the appraisal.