What is CMMI?

Definition and publisher

CMMI stands for Capability Maturity Model Integration. It is a process improvement model that sets out the practices an organisation is expected to have in place if it wants predictable, repeatable delivery. The model is owned and published by ISACA, the professional association that also publishes COBIT. It began at the Software Engineering Institute at Carnegie Mellon University, moved to the CMMI Institute when that body was formed in 2013, and passed to ISACA when ISACA acquired the CMMI Institute in 2016.

The important point to understand at the outset is that CMMI is not an ISO management system standard and there is no such thing as an accredited CMMI certification body. An organisation does not get certified to CMMI. It is appraised against the model by an appraisal team led by a CMMI Certified Lead Appraiser authorised by ISACA, and the resulting rating is published by ISACA in its Published Appraisal Results System, known as PARS. Any provider offering a CMMI certificate issued after a Stage 1 and Stage 2 audit is describing the ISO scheme, not CMMI.

What the model covers

CMMI is structured as a set of practice areas grouped into capability areas. Rather than one monolithic model, ISACA publishes several views so that an organisation adopts only the parts relevant to its work:

• CMMI for Development, for organisations that engineer and build products and software.
• CMMI for Services, for organisations that establish, manage and deliver services.
• CMMI for Supplier Management, for organisations whose delivery depends heavily on sourcing and managing suppliers.
• CMMI for Security and CMMI for Safety, which add security and safety practice areas on top of the core model.
• CMMI for Data Management, People Management and Virtual Work, added in version 3.0, which ISACA released in April 2023.

Underneath these views sit familiar practice areas such as requirements development and management, technical solution, product integration, verification and validation, estimating, planning, monitoring and control, risk and opportunity management, configuration management, process quality assurance, causal analysis and resolution, and organisational training. Each practice area is written as a set of practices at increasing levels of maturity, so the model tells you both what good looks like and what the next step up would be.

Maturity levels and capability levels

CMMI expresses results in two ways. A maturity level rates an organisational unit as a whole across a defined set of practice areas. A capability level rates performance in a single practice area. The five maturity levels are:

• Level 1, Initial. Work gets done, but delivery is reactive and results depend on individuals rather than on any defined way of working.
• Level 2, Managed. Projects are planned, monitored and controlled. Requirements, estimates and commitments are recorded and managed.
• Level 3, Defined. There is an organisational set of standard processes, tailored for each project, with organisational training and measurement behind it.
• Level 4, Quantitatively Managed. Quality and performance objectives are set numerically and managed using statistical and other quantitative techniques.
• Level 5, Optimising. The organisation improves performance against those quantitative objectives through causal analysis and deliberate process innovation.

Most organisations that pursue CMMI for contractual reasons target Level 3, because that is the level at which a defined, organisation wide way of working can be evidenced. Levels 4 and 5 require a genuine measurement baseline and are not realistic without one.

How a CMMI rating is actually awarded

Conformity for CMMI is demonstrated through an appraisal conducted under the CMMI appraisal method, not through a certification audit. ISACA defines several appraisal types:

• Benchmark Appraisal. The full appraisal that produces an official maturity level or capability level rating. It is led by a CMMI Certified Lead Appraiser and carried out by a team of at least four appraisal team members. The resulting rating is valid for three years and is published in ISACA’s PARS.
• Sustainment Appraisal. A shorter appraisal that allows an organisation that already holds a rating to sustain it. It uses a smaller team and the resulting rating is valid for two years. An organisation may use a limited number of consecutive Sustainment Appraisals before a further Benchmark Appraisal is required.
• Evaluation Appraisal. An internal readiness or gap appraisal. It produces findings that are useful for planning but no official rating and no PARS entry.
• Action Plan Reappraisal. A focused reappraisal used where specific findings need to be closed after a Benchmark Appraisal, conducted within a defined window after the original appraisal.

There is no Stage 1 and Stage 2 sequence in CMMI, there are no annual surveillance audits, and no accreditation body such as UKAS or Emirates International Accreditation Centre is involved. The controls on quality come from ISACA itself, which authorises Lead Appraisers, licenses Partner organisations and maintains PARS as the single public record of who holds which rating and until when. Anyone can search PARS to confirm whether a claimed CMMI rating is real and current.

How Univate supports CMMI adoption

Univate works with organisations that need a CMMI rating for client or tender requirements and with organisations that want the process discipline for its own sake. Typical engagement components include:

• A gap analysis of current ways of working against the practice areas in the relevant CMMI view and target level.
• Design of the organisational process assets, including the standard process set, tailoring guidelines, templates, measurement definitions and the process asset library.
• Deployment support on live projects so that evidence is generated as a by product of real delivery rather than assembled for the appraisal.
• Training for project managers, quality assurance staff and the process group.
• Readiness review before a Benchmark Appraisal, and coordination with an independent CMMI Certified Lead Appraiser who conducts the appraisal itself.

Univate does not conduct the Benchmark Appraisal that awards the rating. That independence is a requirement of the appraisal method, and any consultancy claiming to both implement and rate the same organisation should be treated with caution.

Frequently asked questions about CMMI

Is CMMI a certification?

No. CMMI is a process improvement model and organisations are appraised against it, not certified to it. An appraisal led by a CMMI Certified Lead Appraiser produces a maturity level or capability level rating, and that rating is published in ISACA’s Published Appraisal Results System. Certification language is borrowed from the ISO world and does not apply.

Who owns and publishes CMMI?

ISACA owns and publishes CMMI. The model originated at the Software Engineering Institute at Carnegie Mellon University, transferred to the CMMI Institute in 2013, and came under ISACA when ISACA acquired the CMMI Institute in 2016.

How long does a CMMI rating last?

A rating from a Benchmark Appraisal is valid for three years. A Sustainment Appraisal, which is available to organisations that already hold a rating, produces a rating valid for two years. Both are recorded in PARS with their expiry.

Does CMMI involve Stage 1 and Stage 2 audits and annual surveillance?

No. That two stage audit sequence with annual surveillance visits belongs to accredited ISO management system certification. CMMI uses an appraisal method instead, and there are no surveillance audits between appraisals.

Can an ISO certification body issue a CMMI rating?

No. Only an appraisal team led by a CMMI Certified Lead Appraiser authorised by ISACA can award a CMMI rating. An ISO certification body accredited for management system standards has no standing to appraise CMMI.

Which CMMI maturity level should we aim for?

Level 3 is the usual target where the driver is client or tender eligibility, because it evidences a defined organisational process set that is tailored and used across projects. Levels 4 and 5 depend on quantitative performance management and are only realistic once a measurement baseline genuinely exists.

How can we verify someone else’s CMMI rating?

Search ISACA’s Published Appraisal Results System. Every official Benchmark and Sustainment Appraisal rating is listed there with the organisational unit, the model view, the level and the expiry date. If a rating is not in PARS, it is not an official rating.

Planning a CMMI Benchmark Appraisal or unsure which model view and target level fit your delivery? Talk to the Univate team about a readiness assessment.

Univate Global delivers ISO certifications, data privacy compliance, and cybersecurity frameworks across 9 markets.