CMMI FAQ - brutally honest, totally hip, no nonsense answers (a public service of Entinex)

Is CMMI for us?

A: We should start the answer to this question with a quick sentence about what CMMI itself *is*.

CMMI is about improving performance through improving operational activities. In particular, it's improving work associated with managing how organizations develop or acquire solution-based wares and define and deliver their services. So we should ask you a few questions before we answer yours:

Do you feel that you ought to be looking at improving your performance?
What business performance improvements would you like to see from your operations?
What worries you most about your business performance?
Could you handle all the work if you won all the work you're pursuing?
What's the first thing that will break as soon as you reach capacity?
Is your workstream continually delivering or is there more work piling up in your workstream than what's being delivered?

SO, is CMMI right for you? Obviously this depends on what you're trying to accomplish. And to be perfectly honest, CMMI doesn't always have the fastest or best answers to these questions. But that doesn't mean you can't use CMMI to shed light on what's going on.

Now, for the rest of the response... Sometimes it's best to "divide and conquer". How you view CMMI is frequently influenced by an organization's world view. We'll divide the world into two groups: those who develop wares and provide services for US Federal and other governmental agencies (or contractors) and those who don't.

Those of you in the former group will probably come across CMMI in the form of a pre-qualifier in some RFP. As such, you're probably looking at the CMMI as a necessary evil regardless of whether or not you feel your processes need to be addressed in any way. If you're in this group, there aren't many loop-holes.

One strong case for why your company might not need to mess with CMMI would be if you are selling a product of your own specification. Something that might be called "shrink-wrapped" or even COTS (Commercial Off-The-Shelf). While looking at CMMI for improvement wouldn't be a bad idea, the point is that unless you are developing wares from scratch to a government (or a Prime's) specification, you ought to be able to elude having someone else require or expect you to pursue CMMI practices when you otherwise might not do so.

A couple of exceptions to this "rule of thumb" would be (a) if you are entering into the world of custom wares for the Feds, even though you currently aren't in it, and/or (b) if the extent to which your product might need modifications or out-of-spec maintenance for it to be bought/used by the government. Governments have an all-too-regular habit of buying a product "as is" functionally, and then realizing that what they need kinda only looks like the original product but is really different. Knowing this, some agencies and prime contractors are using the CMMI's appraisal method as part of their due diligence before wedding themselves to a product or vendor. (Though this is fading from common practice.

If you're in the latter group, (remember... those who don't sell to the Feds or their Primes) then the question is really this, "what's not working for you with your current way of running your operation?" You'll need to get crystal clear about that. Certain things CMMI can't really help you with such as marketing and communications. OK, it could, but if managing your customers and marketing are your biggest challenges, you've got other fish to fry and frying them with CMMI is a really long way around to get them into the pan. Don't get us wrong, there are aspects of CMMI that can be applied to anything related to *how* you do business. But, if you are worrying about where the next meal is coming from, you might be hungry for a while before the ROI from CMMI will bring home the bacon.

Having said that... If you're finding that

customer acquisition, satisfaction, or retention, and/or
project success, profitability, predictability, or timeliness, and/or
employee acquisition, satisfaction, or retention, and/or
service level accuracy, predictability, cycle or lead time

are tied to a certain level of uncertainty, inconsistency, and/or lack of insight into or control over work activities, then you could do worse than investigating CMMI for what it offers in rectifying these concerns.

Let's be very clear up front: There are many business performace issues. CMMI can help put you into a better position to deal with these issues, but it can't solve all issues. CMMI can shed light onto issues and you can even be applying practices as intended and achieving the value of the practices as desired. If performance is still not improving then you must ask yourself whether you're learning from your performance issues or just covering them with practices. Performing practices without measuring the performance of the practices on the operation misses the opportunities to improve any business results afforded by CMMI. The key is to ask "WHY" the performance is what it is. And to keep asking this question to more deeply understand the contribution of decisions that lead to the results.

Is CMMI Dead?

A: NO.

NOTE: This answer assumes you know a thing or two about CMMI, so we won't be explaining some terms you'll find answered elsewhere in this FAQ.

In the US, the DOD no longer mandates use of CMMI as a "minimum pre-qualification", but it does view CMMI as a benefit in offerors' proposals. In addition, CMMI continues to be among the ubiquitous differentiators in proposals among non-defense agencies. And, most (if not all) of the "big integrators", defense, infrastructure and aerospace firms who use CMMI continue to use and expect the use of CMMI by their subcontractors.

In short, CMMI is far from dead, and, with new initiatives (in content and appraisal approaches) under way and planned for at the CMMI Institute, the relevance and applicability of CMMI to the broader market is expected to continue for the foreseeable future.

How many processes are there in CMMI?

A: NONE. Zero. Zip. Nada. Rien. Nil. Bupkis. Big ol' goose-egg. There's not a single process in all of CMMI. They're called Practice Areas (PAs) in CMMI, and we're not being obtuse or overly pedantic about semantics. It's an important distinction to understand between processes and Practice Areas (PAs).

So contrary to anything you've heard before, there are *no* processes in CMMI. No processes, no procedures, no work instructions, nothing. This is often very confusing to CMMI newcomers. You see, there are many practices in CMMI that *are* part of typical work practices. Sometimes they are almost exactly what a given project, work effort, service group or organization might do, but sometimes the practices in CMMI sound the same as likely typical practices in name only and the similarity ends there. Despite the similar names used in typical work practices and in CMMI, they are *not* to be assumed to be referring to one-in-the-same activities. That alone is enough to cause endless hours, days, or months of confusion. What CMMI practices are, are practices that improve the performance of existing work, but do not *define* what that work must be for any given activity or organization.

The sad reality is so many organizations haven't taken the time to look at and understand the present state of their actual work, so as a result not only do they not know everything they would need to know to merely run their operation, they then look to CMMI as a means of defining their own practices! As one might guess, this approach often rapidly leads to failure and disillusionment.

How you run your operation would undoubtedly include practices that may happen at any point and time in an effort and during the course of doing the work. Irrespective of where these activities take place in reality, the CMMI PAs are collections of practices to improve those activities. CMMI practices are not to be interpreted as being necessarily in a sequence or to be intrinsically distinct from existing activities or from one CMMI practices to another. Simply, CMMI practices are the activities intended to achieve some value. Value, we might add, that ought to be tied to business objectives more substantial than simply achieving a level rating. There's so much more to say here, but it would be a site unto itself to do so. Besides, we never answered the question....

... in the current version of CMMI there are 25 Practice Areas (PAs).

These Practice Areas can be sliced and diced and viewed in levels, capability areas, practice groups, and ways no one's thought of in many combinations and permutations to suit a user's needs.

Each Practice Area (PA) is broken down into:

Required Information, and
Explanatory Information

The Required information is further broken down into:

Intent,
Value, and
Additional Required Information.

For example, there's a Practice Area called "Decision Analysis and Resolution" abbreviated, "DAR".

The intent of DAR is to "Make and record decisions using a recorded process that analyzes alternatives."

The value of DAR is to "Increases the objectivity of decision making and the probability of selecting the optimal solution."

When trying to understand your processes, you are encouraged to ask yourselves, "are we getting this value?" and, "are we meeting this intent?"

If you're planning on having an appraisal—and we're guessing you're here because you are—you can be that the appraisal team will be asking these questions about your processes.

Then, there's another layer inside the PA. As stated above, there are practices. The practices are, by far, the majority of the CMMI model material. Each practice is labeled and broken into required and explanatory information. And the required information is then broken into a practice-specific value tied to its practice statement. The explanatory information provides examples and guidance and other useful tidbits for understanding the practice.

For example, the first practice in DAR is labeld, DAR 1.1.

The Practice Statement is: "Define and record the alternatives."

The Value is that "A clear definition and understanding of the alternatives to be made reduces potential rework." You might already notice that the practice isn't telling you how to do the practice. If you're thinking ahead, you'll realize that a process that merely states "Define and record the alternatives" probably won't work very well in practical terms. Details such as when, why, how, and where aren't explained in "Define and record the alternatives". You can bet that an appraisal team will pick up on that.

On the other hand, if your organization has a process for doing trade-off analyses (for example), it likely already does this practice. And, if doing this practice is part of making decisions objectively and selecting optimal solutions, you're likley all set with that one.

The 25 Practice Areas and their intent are provided for you here in alphabetical order by PA. Keep in mind, these are all of the current practice areas. It is highly unlikely that you will be using all of them. We have not yet explained which are reqired for you. There is no requirement that you use all of them. *Some* organizations may use all of them, but that is extremely rare. You are more likely to use a subset of them targeted at particular capabilities (or requirements) relevant to your organization.

You are advised to obtain a copy of the "Model At-A-Glance" for the next step in obtaining further details.

Causal Analysis and Resolution (CAR)

Configuration Management (CM)

Continuity (CONT)

Decision Analysis and Resolution (DAR)

Estimating (EST)

Governance (GOV)

Implementation Infrastructure (II)

Incident Resolution and Prevention (IRP)

Managing Performance and Measurement (MPM)

Monitor and Control (MC)

Organizational Training (OT)

Peer Reviews (PR)

Planning (PLAN)

Process Asset Development (PAD )

Process Management (PCM)

Process Quality Assurance (PQA)

Product Integration (PI)

Requirements Development and Management (RDM)

Risk and Opportunity Management (RSK)

Service Delivery Management (SDM)

Strategic Service Management (STSM)

Supplier Agreement Management (SAM)

Supplier Source Selection (SSS)

Technical Solution (TS)

Verification and Validation (VV)

How are the ~~processes~~ Practice Areas organized?

A: As they say in American pop culture, this is the 64 Thousand Dollar Question.

The Practice Areas can be viewed in several constructs.

Depending on your needs, you can organize the PAs however suits those needs. If an appraisal is among your needs, there are several ways to view the PAs that align to the scope of the appraisal. In fact, *unless* you need to have an appraisal, the formal organization of the PAs has little impact on how you use CMMI to improve your performance.

To help provide some food for thought not necessarily related to appraisals, CMMI V2.0 organizes the PAs according to ten (10) "Capability Areas". You can think of Capability Areas as groups of 2-4 PAs that work together in somewhat distinct ways. (One Capabiity Area currently only has one PA in it, but that's likely to change sometime in the near future.) You can further break the Capability Areas down into five (5) broad activities. This structure is best captured in this image taken from the CMMI Institute's "Model At-A-Glance":

Because we this site is not a replacement for structured, official CMMI training, we won't get into all the different ways of viewing CMMI. And again, because any formalized organization of the PAs only matters—materially—for the purposes of appraisals, we'll leave any further discussion to that section of this FAQ.

What is each ~~process~~ Practice Area made up of?

A: How'd you miss this? Go back to here and read again.

We will, however, take this opportunity to expound upon the matter of the "Explanatory" information found in each of the PAs and practices. This informative material is very useful. It's specific to each PA and their practices. Readers are well-advised to focus on the explanatory information in the context of the Intent and Values in each PA. When it comes time to be appraised, the teams determine whether your work demonstrates the practices meet the intent and achieve the value. WORD TO THE WISE: DO NOT merely read the practice area names and practice statements and just make up your own meanings. If your objective includes an appraisal to demonstrate that you are effectively using CMMI, not reading the explanatory information is suicide.

For more on what matters in an appraisal go here. If all you want is improvement, and appraisals are not necessarily important, then it doesn't really matter how the model is organized. Use anything in it to make your operation perform better!

How do the Levels relate to one another and how does one progress through them?

A: At the risk of invoking the need to have knowledge of prior versions of CMMI, we'll point out that V2.0 greatly improves on the concept of levels. If you know about prior versions you'll see what we mean. If you aren't familiar with "levels" from prior versions of CMMI, don't worry. You don't really need to know anything about them for our purposes.

This is really a two-part question. The first question is, "how do the levels relate to one another". Let's take that firt.
Levels are tied to practices. Each PA is comprised of practices. These practices are broken out into levels 1-5 with one or more practices in each level. Practices increase in sophistication as the levels increase. For example, a level 1 practice might be something like, "Identify and record [things] and keep them updated." Then the level 2 practices are "Analyze [the things recorded in the level 1 practice]", and "Monitor [the things recorded in the level 1 practice]". And the level 3 practices are something like, "Use the analysis...; Make plans based on...; Establish strategies for..." You can intuitively see that Analyzing and Monitoring are more sophisticated than merely Identifying and Recording and basing decisions and plans on the monitoring and analysis are even further sophistication. These levels within the PAs are essentially levels of Capability.

These levels accumulate an operation's capabilities in any particular area of work. This isn't terribly different from an individual's capabilities as they grow with experience and new knowledge.

When an operation is capable in several different areas (much like any one of us) it has greater maturity. For purposes of establishing a consistent reference system (and, one that is somewhat backwards compatible with prior versions of CMMI), the CMMI Institute defines a "maturity level" as a specific set of PAs with each PA in that set being performed at a defined level of capability—regardless of the total levels available within the PA.

While the maximum Maturity Level is 5, Capability levels do top out at level 3. Since you're new, it probably won't be obvious why this is so. The simplest explanation is that the capabilities required to mature beyond level 3 include too many dependencies across PAs (i.e., maturity). Another piece of the explanation has to do with the applicability of practices in levels 4 and 5 and where these practices are typically applied. Again—a discussion that's a bit advanced for beginners.

Levels are also covered in a nice page by the CMMI Institute.

We don't want to forget the 2nd part of the question, "how does one progress through them?"

Referencing back to our repeated mantra about performance improvement vs. appraisals, we'll again remind you, dear reader, that when improving performance is the desire, certain aspects of the CMMI only ever matter in the context of appraisals. Yes, there's a logical argument one can make about how the levels provide a rationalized path for that improvement, but under scrutiny that argument feels too much like a schill for the product itself. OK. Stepping off the soapbox... The defined maturity levels can be worked through as you'd expect: start with something lower and work your way to something higher. The contents of the maturity levels are nicely depicted about a third of the way down this page.

Since capability levels only depend on the levels within PAs (plus some other appraisal-related requirements we'll address later), the "progression" through capability levels is merely starting in any PA with level 1 practices and adding level 2 practices, then level 3, etc.

Incidentally, all current PAs have at least 3 levels to them except one, Configuration Management (CM).

And, we might as well be complete with our answer, the following PAs have up to four (4) levels:

Governance (GOV),
Process Management (PCM),
Planning (PLAN), and
Supplier Agreement Management (SAM)

And, these are the only PAs with five (5) levels:

Causal Analysis and Resolution (CAR) and
Managing Performance and Measurement (MPM)

I've heard the term process institutionalization. What does that mean?

So, you're wondering what's this business about institutionalization. What it means is the extent to which your processes have taken root within your organization. It's not just a matter of how widespread the processes are, because institutionalization can take place in even 1-project organizations. So then, it's really about:

- how they're performed,
- how they're managed,
- how they're defined,
- how they're supported,
- the attention the receive from leadership,
- the extent to which people have the time and resources to deal with them,
- who can suggest and make process changes,
- what you measure and control the processes by,
- how you go about continuously improving upon them, and
- how they're keyed to make decisions about how business performs because of them.

If we look at what it takes to manage any effort, service, or project, we will find that it takes these same things to manage a process.
In fact, these are just the beginning.
In CMMI V2.0, process institutionalization refers to the organization's processes, NOT the CMMI itself—as was long misunderstood in prior iterations of CMMI. And, in V2.0 (not that you care about V2.0 compared to earlier versions) there are two entire Practice Areas explicity authored to deal directly with institutionalization:

Implementation Infrastructure (II), and
Governance (GOV)

Earlier we eluded to a detail we left out about Capability Levels in appraisals. Now is the palce to tie off that loose end.

II and GOV are the only PAs that are absolute minimum requirements for any appraisal at any level in any construct of the CMMI. For example, let's say you want just an appraisal for Capability Level 2 in Planning. That appraisal would include the Level 2 practices in Planning PLUS the II and GOV PAs up to and including the Level 2 practices in both II and GOV.
(This paragraph applies to certain types of appraisals. There are several types which, if you've been reading from the top of this section, we haven't yet explained. Nonetheless, if you've heard anything about CMMI, it's probably included some rumors about appraisals and the statements in this paragraph apply to the type you're likely thinking about.)

This poses an interesting thought: if these two PAs are all about showing that your operation deals effectively with processes—as an abstraction—and these PAs are the minimum scope of even the smallest "Benchmark" appraisal (that's what the the most common appraisal is called—when it matters) this absolutely means that they can be appraised as stand-alone practice areas in their own Capability Level appraisal, demonstrating to the world that your operation knows its stuff when it comes to managing processes.

Importantly, keep this in mind: These two practice areas are not self-referential. They don't myopically apply back to Practice Areas. Yes at some point they do interoperate with other PAs, but the focus of these PAs are your organization's operating processes, not the CMMI practice areas or practices. And, they can apply to all of an organization's processes, NOT only to those covered by CMMI practice areas. And in fact, they are entirely about leadership putting its energies and resources into performance improvement.

We repeat this important distinction. These two practices areas are not about CMMI practices, they are about the organization's processes and their senior management. In fact, in keeping with the concerted effort to separate CMMI practices and practice areas from an organization's processes we should note, again, that PAs in CMMI V2.0 (as they were previously) are not the definition of processes, just a means of improving organizational processes. Not only those processes associated with PAs in CMMI, but all of their processes. (The scope of an appraisal will limit the processes being evaluated, but the intent and value of the II and GOV PAs are universal and will be evaluated as such.)

This is a BFD.

This puts your organization's leadership of process in the hot seat. And, with the Intent and Value of the PAs up to the appraisal team to judge, CMMI has taken off its gloves when it comes to being serious about true improvement commitment. We dare say no other broad-spectrum performance improvement framework has taken this step. Not even ISO 9000, for those familiar with it. Not the way CMMI has.

Be warned.

What's High Maturity About?

A: "High Maturity" refers to practices at level 4 and level 5. Even though a Maturity Level 4 or Maturity Level 5 appraisal includes a predefined set of PAs, and even though there is no such thing as Capability Level 4 or 5, in casual conversation any practices above level 3 are likely to be referred to as "High Maturity". Interestingly, there's nothing stopping an organization from using level 4 and 5 practices regardless of the scope of their efforts. In fact, regardless of the scope of an operation's improvement needs, we strongly encourage all users to deeply study all 5 practice levels of the Managing Performance and Measurment (MPM) and Causal Analysis and Resolution (CAR) PAs. Organizations that understand what's going on in these PAs—even if they're not going to have an infrastructure for continually operating them—will be in a better frame of mind and will approach other PAs more comprehensively and more efficiently. We are also confident that organizations that internallize the ideas in these PAs will address II and GOV more professionally and effectively.

Collectively, the level 4 and 5 practices are all about making decisions about projects, work, processes, and operational performance based on a data-driven, quantitative understanding of the business. Not opinions, not compliance, not politics, not emotion, not instinct alone, and eventually not on "rearward-looking" deterministic data, or empirical data alone rather, forward-looking and predictive analysis, heuristics, and probabilities.

They're not just any numbers, but numbers that tie directly into the organization's business and performance goals, and not just macro-level goal numbers but numbers that come from doing the work on projects and services that are fed back into the planning of those projects and services to predict performance and direct activities.

This sort of quantity-centric ability is enabled by a baseline understanding of the organization's current capabilities coupled with predictive analysis of the organization's processes. These provide the organization with an idea of what their processes are really doing and what they can actually do for the bottom line. This sort of quantitative modeling is not typically based on macro-level activities, but are based on activities that can be contained and controlled and whose systems effects are understood.

How many different ways are there to implement CMMI?

A: Infinite, but 2 are most common.

But before we get into that, let's set the record straight. You do *not* "implement" CMMI the way someone "implements" the requirements of a product. The only thing getting "implemented" are your organization's work flows along with whatever "standard processes" and associated procedures your organization feels are appropriate—not what's in CMMI. CMMI has nothing to do with how you actually make money. CMMI is behind the scenes. It's not part of your value stream. If it is, it's in the way. You're doing it wrong.

CMMI is just a set of practices to help you *improve* the performance of whatever you've got going on. CAUTION: If whatever you've got going on is garbage, CMMI is unlikely to help. The most CMMI will do is brutally and painfully expose that your operation is in flames. AND, if you create your organization's processes only using CMMI's practices as a template you'll not only never get anything of value done but your organization's work flows will be dreadfully lacking all the important and necessary activities to operate the business!

Let's say that again: You need to know what makes your business work. You need to know how to get work done. You need to know what your own work flows are. And your need to know the measures that you control that are important to your success BEFORE you will get anything good from CMMI. CMMI is awful as a process template! The *BEST* way to use any CMMI practice is to read that practice and ask yourself any of the following questions:

"Where in our workflow does *that* happen?"
"How does *that* show up?"
"What do we do that accomplishes *that*?"
Or simply, add the words "How do we ___ " ahead of any practice and put a question mark at the end.

Then you compare your answers to these questions to the Intent of the Practices and Intent and Value of the PA and ask yourself, "Are we meeting that intent? Are we getting that value?" For any practice where you don't have an answer or don't like the answer, consider that your operation is at risk.

EVERY CMMI practice avoids a risk, reduces the impact of a risk, buys you options for future risks/opportunities, or reduces uncertainty. EVERY.SINGLE.ONE.

You might need a bit of expert guidance to help you refactor the practice so that it appears more relevant and useful to your particular needs, but there is a value-add or other benefit to every practice. Truly.
(Admittedly, whether or not there's value to *your* business to modify your behavior to realize the benefit of a given practice is an entirely different question. The unfortunate reality is that too many businesses are in the unenviable position of having to demonstrate CMMI ratings despite many practices in the model being dimly relevant to their success or risks.)

Now, as far as the "2 most common approaches". There's what we call the blunt-object (or silo'd or stove-piped or pathological box-checking) approach, which is, unfortunately, what seems to be the most common approach—in our observation—among companies who don't really need CMMI for anything useful as well as among those companies who give marketing lip-service to just about everything they do anyway.

In this approach CMMI is implemented with the grace and finesse of a heavy, blunt object at the end of a long handle—impacting organizations and managers' collective craniums. This is most commonly found among organizations who care not one wit about actual performance improvement and only care about advertising their ratings.

And then, there's the reality-based approach. In which, processes are implemented in such a way that work and service personnel may not even know it's happening. And, the way in which they're implemented convey that they meet the intent of the model practices. Can you guess which one we advocate?

The blunt-object approach resembles what many performance improvement experts call "process silos", "stove pipes", or "layers". Psychologists will often refer to this behavior as pathological box-checking. (Appraisers can be this way as well.) This approach is also often implemented *to* a development team *by* some external process entity with brute force and very extreme prejudice. So, not only does the blunt approach employ some very unsavory techniques, subjecting its royal subjects to cruel and unusual process punishment, it also (in its design) is characterized by a "look and feel" of a process where each process is in its own vacuum, without any connection to other processes (or to reality, for that matter), and where the practices of the processes are somehow expected to be performed serially, from one to the next, in the absence of any other organizational context. Not only that, but the organization's processes somehow magically mirror the names of the CMMI PAs, and the practices within them. In order. Gee, how did that happen?

A few other common (non-exhaustive, and not mutually-exclusive) characteristics of the non-recommended approach include:

Heavy emphasis on compliance irrespective of performance.
Little or no input from staff on what the processes should be.
Using CMMI practices as project or process "requirements".
Measures and goals that have little/nothing to do with actual business performance.
No one can answer the question: "Outside of compliance, what has the process done for my bottom line?"
Complaints about the "cost of compliance" from people who actually watch things like the bottom line.

If so many implementations of CMMI are guided by an (internal or external process) "expert", one might (justifiably) wonder how and why CMMI processes could ever be implemented in such an obviously poorly conceived approach!

There are two (sometimes inter-related) reasons:

Lack of understanding of the model, and
Being an expert process auditor, and not a performance improvement expert.

Unfortunately, being an expert process auditor does not make someone a performance improvement expert. However, one need not prove themselves an expert in performance improvement to train, consult, or appraise in the CMMI. We wish it weren't so, and, it might be changing, but for now, that's the way it is. So, what you have are many people who become "experts" in CMMI, but they're really only experts in the model's text and in appraising an organization's ability to read the text and produce text-book artifacts. They're not necessarily experts in performance improvement or performance excellence, in general, or in implementing CMMI in particular.

We've come across countless examples of organizations' attempts to implement CMMI while being led by someone (or plural) who was at least one of the two types of persons, and too frequently, both at once. Frightening, but true. The jury is still out on whether it's worse to be led by such a non-expert or to attempt "Do-It-Yourself" CMMI implementation. What the jury is definitely in agreement on is that if your focus is on CMMI and not on improving business performance, you're really wasting your time. Again, we digress....

Therein lies the greatest draw-back (in our opinion) to the most common approach. Instead of performance improvement being an integral and transparent characteristic of everyday work, it becomes a non-productive layer of overhead activity superimposed on top of "real" work. And yet, this seems to be the prevalent way of implementing CMMI! Crazy, huh?

Why is it so prevalent?

That's where the two reasons of poor implementation, above, come in. People who don't understand the model as well as people who don't know process performance from business performance (and therefore may have a weak understanding of the model) don't truly "get" that the model is not prescriptive, and so they attempt to make it a prescription. Auditing and appraising to a prescription is far easier and less ambiguous than auditing and appraising to a robust integrated process infrastructure. Frankly, the "common" approach suits the lowest common denominator of companies and appraisers. Those companies and appraisers who aren't after true improvement, and are only after level ratings, and who are willing (companies—unknowingly—(sometimes)) to sacrifice the morale and productivity of their projects for the short-term gain of what becomes a meaningless piece of paper—a testament to the lengths some companies will go to achieve the disenfranchisement of staff.

Alright already! So what's the reality-based approach about?!

The reality-based approach starts with a premise that a successful organization is already doing what it needs to be doing to be successful, and, that performance improvement activities can be designed into the organization's existing routines. Furthermore, the reality-based approach also assumes that, as a business, the organization actually *wants* to increase their operational performance. Note the use of "designed into". This is crucial. This means that for reality-based performance improvement (reality-based CMMI implementation), the operational activities must be known, they must be definable, and, they must be at work for the organization. Then, activities that achieve the Intent and Value of CMMI can be designed into those pre-existing activities.

This whole business of designing performance improvement activities into product/project activities illuminates a simple but powerful fact: effective performance improvement (CMMI included) requires processes to be engineered. Sadly, a recent Google search on "process engineering" turned up few instances where the search term was associated with software processes, and most of those positive hits were about software products, not performance improvement. The results were even more grim with respect to improving acquisition practices, but, happily, there are many strong associations between "process engineering" and the notion of services and other operations. There is hope.

Besides the reality of what's already working, other attributes of our preferred implementation approach is that we don't expect the processes to be done by someone else, and, we don't expect them to magically apparate into existence. For both of those attributes to be in place, the reality-based approach doesn't rely on process descriptions to make the processes happen. Instead, the practices that achieve the value and meet the intent of the practice areas are built into the very product, service and project activities of the organization's work, and, the process descriptions simply describe where in that work to find the practices happening.

For what it's worth, this approach is what we at Entinex call AgileCMMI

Do we have to do everything in the book? Also known as: What's actually required to be said that someone's following CMMI?

A: You have to have processes that operate your business effectively. Everything else is mostly details.

Really.

Honest.

Let's be frank (as if we haven't been frank thus far). The only time whether or not you're doing what's in CMMI (or not) matters is if/when you're aiming to be officially appraised. Otherwise, you'd just do whatever you want to get the most improvement out of and ignore what you don't need.

Having said that, the context of this answer is then about what's required for people who want bragging rights for "doing" CMMI, and for the most part, this means that they're going to determine this via a benchmark appraisal. In fact, nowhere in the CMMI model literature does it discuss CMMI "requirements" for process or performance improvement. The II and GOV PAs come close, but they don't actually dictate anything black and white. The model (i.e., CMMI) is very careful to use terms that point the practices at the Intent and Value contained within the PAs. The PAs are broad references to an organization's activities. It's up to you which PAs you want to use to improve performance. Appraisals play a role in the choice of PAs, but ultimately the choice to do an appraisal is yours.

"Managing Performance and Measurement" isn't a single process. It's something that either gets done or doesn't get done. Your operation either manages performance and measurement or it lets performance and measurements flag in the wind. Oh, you *do* manage performance and measurement? Well, good then! Do you collect and record measures? Use them to identify performance issues? Yes? Great! Why do you do this? Can you show how you do that? Beautiful! You're a level 1 company and Managing Performance and Measurement! What?! No? Are you an idiot? (Seriously, you're an idiot if you're not doing this.) Then what they he!! do you do? Oh, you collect revenue and monitor expenses. Oh, you have a P&L and a balance sheet. Well... that's a start. Let's dig into that a little... (And so on.)

We went through the parts of the model that are "required" and not as much "required" here. Hopefully you've seen that. We won't repeat it here. However, the form factor of your processes, how you improve performance, and the manner in which you convey and demonstrate

Appraisals are based on evidence. You will have to show evidence for the practices in scope of the appraisal. Organization must be performing some kind of activity that accomplishes the intent of practices in order to objectively convey that the practice is done. How directly, indirectly, automatically, manually, cleanly, or convolutedly it gets done is not a scale against which the evidence is measured.

If an organization is *doing* something, then it must be resulting is some form of identifiable, tangible output. However, not every organization does the same thing, therefore not every organization produces the same outputs, or uses the same jargon and therefore additional explanatory information is provided, often including examples, to help an organization's understanding of the PAs and practices.

What does this mean for an appraisal or the appraiser? It means that in order to demonstrate that an organization's pursuit of a practice area is satisfied, they might not be able to solely rely on what's in the model. This means that not only might it be a good bit of work before an appraisal for the appraiser(s) to get up to speed and elbow-deep into an organization's processes, but it could even drag with it the need to be somewhat competent in the kind of work an organization does or tools they use. DANGER! That kind of in-depth involvement puts appraisers (and consultants) at some risk: they might be exposed for not being competent in the ways and means of modern operations! (Did we just say that?) Well, in for a penny... let's go the whole way... We have a saying around here, the first part most people have heard of [even if we, ourselves, don't like it]:
Those who cannot do, teach. [We added this next corollary:] Those who cannot teach, audit.

It's much easier on the appraiser if the text in the model were investigated as is and if some of the expanatory materials were also expected or required in order to fit into their comfort zone—at your business' expense. This is closely tied to our discussion above regarding the implementation approaches. But until now, we didn't have enough background to get into it. The blunt approach to CMMI is replete with verbatim practices (which is often fine—except where they're just floating out there without being tied to everyday work) and verbatim reproductions of examples. You can, we hope, see how this now smells a little fishy. Rote reproduction of model elements are a tell-tale signs of an organization that doesn't really understand CMMI, or an appraiser/consultant who's just plain lazy (or worse, incompetent)!

Why does it cost so much?

A: Well that's a loaded and ambiguous question! What qualifies as "so much"? We'll just tell you what goes into the costs here and you can determine whether it's reasonable for you or how you can go about minimizing cost or maximizing value.

Here are the variables that go into the factors that affect cost:

Where you are *now* with respect to your implementation of performance improvement—whether or not using CMMI? (i.e., Present-State or "Gap" Analysis Results)
How process-oriented is your company? Do you understand performance improvement? Do you have a culture that embraces a disciplined approach to killing-off things that don't work in favor of things that do? Are you well-read on the subject? Do you have performance improvement professionals on staff? Are you dedicating explicit resources to managing your performance improvement activities?
How much performance improvement implementation work will your company do on its own? vs.
How much performance improvement implementation work will your company need outsider help doing?
How much progress do you think you'll be able to make? Meaning, how fast can you absorb change? Will implementing performance improvement always be competing for resources from other work? Will all the time for implementing a performance improvement system be outside ordinary billable hours?
Does your company tell a really good story about performance improvement or does it tend to buy certifications in a box?
Does your company look at process-related work as something to BS their way through on proposals, or do they genuinely see how it matters? And,
How quickly do you want to make progress?

Other considerations include your organization's size, the kind of work you do, the kind of products you build and, techniques and tools you employ to build them, the kind of contracts you find yourself in, your relationship with your clients, the way you manage your projects, skills your people have and the nature and composition of your organization and management structures. NOT trivial.

Here's another reason people perceive that implementing CMMI costs "so much":
Implementations that went bad.

There are far more bad implementation stories than success stories. By "bad" we simply mean those implementations that, while many of them did achieve a level rating, and all the while they were spending lots of time and money, they were also causing disillusionment, cynicism, and processes that fundamentally didn't work! It's very easy to screw-up performance improvement efforts—with or without CMMI. Because CMMI is a very comprehensive model, it has the side-effect of potentially complicating improvement. Users misconstrue CMMI as all they need. Therefore the easiest way to screw it up is to attempt to implement the CMMI model as a standard and/or as a checklist and/or by buying so-called CMMI-enabling "tools".

While there are also many ways to being a CMMI implementation "success story", what these stories share in common are the following attributes:

Treat performance improvement with the same rigor as a revenue work.
Have and follow an operating model for how real work is done, then find where/how that reality can be improved as a system.
Executive management understands and takes an active role in performance matters beyond "top line". They understand what's being done, what's going to change, how *their* jobs will change, and the meaning of commitment.
The organization is a learning organization. "Learning" includes experimenting, failing, and trying new things without fear.
Create and sustain a culture of improvement.
Recognize that improvement takes time and discipline, exactly like a nutrition and exercise program. And,
Improvement can't be done *to* the work or the people, it's done *by* the people by the very nature of their work, not by any explicit "CMMI activities"

But, we are not in a position to give numbers. We hope you now understand why.

Why does it take so long?

A: That's a loaded and ambiguous question! What qualifies as "so long"? We'll just tell you what goes into the time frames here and you can determine whether it's reasonable for you or how you can go about minimizing time or maximizing progress. Please see the previous question.

Why would anyone want to do CMMI if they didn't have to do it to get business?

A: Because they must be perceiving that the way they operate now isn't giving them everything they want or need to be confident in their ability to produce the results they want/expect (profit, happy clients, low overhead, etc.) and to do it in a consistent way. If that's not you, move on. Otherwise, give CMMI a shot and check back here for more elaboration on this topic soon.

Isn't CMMI just about software development?

A: Nope. It can be used for any product developed, services delivered and supplier sourcing work as wel as other uses coming down the road soon.

What's the key limitation for approaching CMMI?

A: This question comes to us from one of our readers. We love our readers!

There really are no size or scope limitations to CMMI as far as an organization is concerned. CMMI can be put to good use in any sized organization doing any kind of solution development. The real driver (or limitation) is whether there's any need for improvement—and what part(s) of the operation need improving. It's a limitation based in business. As we've said here, CMMI is used as a basis from which to create improvement solutions that fit your particular organization in all its particular particularness. If an organization doesn't have an improvement need, there's no need for an improvement solution, we suppose.

The one limiting attribute of the model is that the organization pick the correct bits for the type of work they do. On the practical, implementation side however, there are many limitations. CMMI has broad applicability which necessitates a certain level of expertise about the decisions that go into affecting performance changes. If we were pressed to pick only one, we'd have to say that misplaced expectations is the #1 common cause, or limiter, in approaching CMMI. Especially the misplaced expectations of senior level organizational management

Misplaced expectations explains a lot about why CMMI efforts fail to meet their goals, or, if they succeed, they do so only at the expense of disillusionment, cynicism, lost moral, and employee turn-over, on top of the high monetary cost of the so-called "achievement" of a level rating.

Misplaced expectations lead to bad decisions in every aspect of life, and it is no different for CMMI. If we look at CMMI implementation like any other project—which it shouldn't be—it becomes very easy to spot what misplaced expectations lead to: insufficient resources, improper allocation of responsibilities, unrealistic time and cost estimates, insufficient training, inappropriate measures of success, burnout, counterproductive incentives, fear, lack of trust, lack of leadership insight or oversight, lack of leadership accountability for owning the effort and instilling the necessary discipline to make the project succeed, and a dearth of enthusiasm or buy-in from internal stakeholders.

Do you get the picture?

Simply setting one's expectations appropriately with respect to CMMI must be the next step once it is determined that there is something going on that CMMI can help with.

So, in the end, the only solution to mitigating misplaced expectations is to get smart about what the model is, what the model requires, what are the collateral implications of implementation, and how the appraisal works.

After all. implementing CMMI must be a strategic decision. Every respect an organization pays to other serious strategic decisions must be afforded to the decision to pursue CMMI.

We hate that this is the answer, because we wish it were more cut and dry. But the fact that it's not cut and dry is the same issue that leads people to ask about implementation cost and time long before any such answers ought to be sought. There are so many factors involved that the only way to really get around these challenges (limitations) is to get educated in performance improvement, CMMI, and in the appraisal process and requirements.

This FAQ can help a lot. When we set out to create it, we thought it would be helpful. Feedback has indicated that it's been more than helpful, it's a bonefide resource. But the FAQ can't address specific questions from specific companies. After all, those types of questions wouldn't be the "F" in "FAQ", would they?

The authors here believe that these answers ought to be provided to a potential CMMI traveller before they set out on the path. Unfortunately, like an inexperienced canyon hiker who doesn't wear the right shoes or take enough water, we've found that not enough CMMI travellers avail themselves of this information. However, much worse than that, an appallingly high number of CMMI consultants do not volunteer this information as part of their own due diligence to evaluate a potential client and to help the prospect (or new client) arrive at decisions most suitable to their circumstances and context, *That* is a true blemish on the industry.

What's the key effort required in CMMI implementation?

A: This question also comes to us from one of our readers. We love our readers!

Be sure to read the above question and answer as it is closely related to this one.

A key effort, in our opinion, in CMMI implementation is the identification of the organization's actual operating model and all its internal life cycles. It starts with taking a systems view of the operation and using systems thinking to understanding a business' "performance levers" In other words, what is their reality? What affects their reality? Any organization successfully operating and to some extent, profitably, growing must be doing something that *works* for *them* and delivers on customer expectations. Figuring out what that is is key to implementing CMMI. There's really no magic to it.

Identifying the operating model reflects the reality and describes where and how improvement takes place within that reality. If improvement isn't taking place, the need is exposed to insert improvement activities, and, you have some insight into how to best design the improvement solution for the organization. It is highly recommended that the process of designing the improvement solution receive guidance from someone who knows how to do this, as well as someone who understands the CMMI and how it is appraised. Such a person could be a hired gun or a smart hire depending on the needs and resources of the organization.

The important consideration to note is that it requires the combined knowledge of each organization's reality-based context as well as knowledge of the CMMI model and of the appraisal to come together to implement CMMI well.

And therein lies an assumption we've made in answering this question: That the organization wants to implement CMMI "smartly", and, in a way that results in lasting value that persists beyond the appraisal. There are other ways to just make it through an appraisal, but since we at CMMIFAQ don't advocate those approaches we're not gonna write about them. If you keep reading, you'll probably figure out what those approaches are. Bottom line: design your improvement efforts into your revenue-generating activities and you will not only benefit from the improvements, you will also find yourself with a robust improvement system which requires no evidence production when it comes time to perform appraisals. It becomes a simple matter of just doing the work of the business and allowing the outputs of that work to speak improvement for themselves.

How do we determine which bits of CMMI to use?

A: This question (paraphrased) also comes to us from one of our readers. We love our readers!

For many users, it's not immediately easy to determine whether they're providing services or whether they're developing products. Especially when they are providing development services, such as DevOps or maintenance, or only part of the development process such as Independent Verification and Validation! Furthermore, many operations do everything. So, there are a number of questions to ask when trying to make this decision:

What work generates our revenue?
Are we paid for output, outcomes, or just time?
How do customers receive from us what we do? •Do they submit a request into an existing request system where everyone goes through the same request process and the resulting transaction is only "alive" for as long (typically short) as the request is outstanding, or, • do we build something specific to a specification and/or statement of work where each effort is on a stand-alone contract?
How do customers pay for what we do? Do they pay per request or do they pay for effort/results over time?
Is there a "Service Level Agreement" in place that we have to meet?
Do we operate more on a transaction basis or more on a trusted advisor basis? (Ignore, for now, what your marketing people say.)
What are we trying to improve? How we manage and develop products, or how we provide services?

Hopefully, the answers to these questions make the answer to which CMMI PAs to use self-evident. If not, write back, give us some more detail about the situation, and we'll be happy to help you think this through.

Appraisals/Ratings FAQs

How do we get "~~certified~~" rated, appraised?

A: OK, let's get something straight here and forever-after: You do not get "certified" in CMMI. At least not yet. In the US, the concept of a "certification" carries a specific legal expectation and companies who are *rated* (and that *IS* the right term) to a level of the CMMI are not being "certified" to anything.

The official site for explaining appraisals is here. That site, not this one, is official. But, might not have what you're looking for. Our charm.

So the correct question is, 'how do you get "rated"?'. And an even more complete question is, 'how do we get rated to level X?'

The short answer for how to get rated still leaves a lot of information on the table. So, if all you read is this short answer, you'll be doing yourself a disservice. The really short answer on getting a level rating is that you get appraised by an appraisal team led by an CMMI-Institute-Certified Lead Appraiser who determine to what extent you are meeting the intent the practices of the CMMI.

This answer is so loaded with hidden terms it's frightening. So just so you know that you've been warned that this answer is too short, we'll point out each of the terms in our previous answer that has hidden meaning in it:

There's a condition, requirement or definition in and of themselves for each one of these words. Don't get annoyed, SEI and those that owned CMMI after them aren't the first, last, only, or worst organization to create such things. Every non-trivial discipline is loaded with concepts that experts can do in their sleep but that requires effort to understand by everyone else. It's true of EVERY profession so, _CHILL_THE_F_OUT_. Need an example? Think of it like getting into shape. The short answer is "diet and exercise". Brilliant. Wonderful. What do you eat? How much? How often? What sort of work-out routine is right for you? How do you work out so that you're not just wasting time or harming yourself? See? Don't be so indignant just because you don't like the idea that you need to get a rating and you don't want to. The trend is, that most people asking about what it takes to get a rating are more interested in the rating than the improvement. That's OK... We understand. Sadly, too well.

Keep reading this FAQ. What else did you have to do today anyway?

Before you go, in case you don't read further, we should note that there are four (4) types of appraisals. Unless otherwise noted, the majority of this FAQ assumes readers are most interested in the type of appraisal that results in official ratings on the first try. These are called "benchmark" appraisals. We will briefly explain the other three (3) types later on. If you're impatient, you can see this page on the CMMI Institute's site.

How long does it take?

A: Here's another one of those dead give-away questions that a company is more interested in the rating than the improvement.

OK, that's a little unfair. Let's just say that as often as we hear this question, our judgmental attitude holds for ALMOST everyone who asks it. Alright, so maybe you are the exception. The truth is, it's a fair question. For every company.

A rare few companies don't care how long it takes. Lucky them. Applying a generous dose of benefit of the doubt, we can assume that the question is asked not for "how soon can we get this out of the way?" as much as from "are there any rules that dictate a minimum time before performing an appraisal?" How we can tell whether the company is interested in the improvements vs. the rating is simply a linear function of how long into the conversation we are before it gets asked. All-too-often, the source of the question is less ignorance of the process and more ignorance of the point behind going through the process.

Performance improvement purists wish more people were more interested in the journey than in the destination. We are performance improvement pragmatists. We know you're not looking at CMMI because you had nothing better to do with your time and money. That's for Bill Gates and his very worthy charitable endeavors. The company he's famous for founding is still in business for the money. FAST. So, how long it takes is a real question regardless of how you spend your money.

Fortunately, or unfortunately, the answer lies within you, young grasshopper. Really. We can't give you a much better answer than that. What we can do, however, is give you a list of the attributes that you can use to estimate how long it will take you, and give you a few example cases and some very general time-ranges.

Let's start again with our favorite analogy. Say you're carrying around about 40lbs (18.18kg) of excess body fat you've lost use for. How long will it take you to lose the fat? A year? Two? 6 months? Can one person do in 6 months what another person needs 2 years? We all know the answer to these questions. "IT DEPENDS!"

EXACTLY! How quickly a company can become rated to a pre-determined point in the CMMI's rating scale depends entirely on them and their circumstances. It depends on:

their level of commitment,
their tolerance for and ability to implement change,
how busy they are,
what they know about performance improvement in general and CMMI in particular, and
it depends on where they are as a starting point,
their willingness to learn and try new things, even getting things wrong, and
how much of the organization they want to include in the rating.

Working backwards from the appraisal itself (NOT including changes to incorporate the CMMI practices or goals—only for planning and conducting the appraisal), the absolute minimum calendar time a company should expect between when the starting gun is fired and when they cross the finish line is a simple matter of logistics. Probably about a month if they're lucky. Two months would be more realistic. These 2 months, of course, are just the logistics and prep-work necessary to plan and conduct the appraisal and the activities that lead to an appraisal. Obviously, this time frame would only be realistic if the company was completely ready for the appraisal, had done all their homework, knew exactly what the state of their process implementation was and were literally trying to do nothing more than figure out how much time they had before they could conduct the appraisal. Of course, such a company wouldn't be asking the question. They'd already know.

So then there's almost everyone else. Everyone else needs time to first determine where they are in their meeting the intent of CMMI practices. This is like saying, first we need to find out how much excess fat we're carrying around. A trip to the right physician would answer this. For CMMI, it's often called a "Gap Analysis" (a term we, here, don't like because it presumes something's missing where we prefer to merely look at the "Present State") and can take a week or two. This event can be as formal or informal as the organization desires. The official term for the formal version of a "Present State Analysis"is called an "Evaluation appraisal". Then, depending on those factors bulleted earlier, the gap found by the analysis would need to be filled with practice implementation to meet the intent of the practices. This is the part where a company would need to figure out what it's optimum sustainable diet and exercise routine should be, and, how long to stick with it to see the desired results.

In CMMI V2.0 there are 25 Practice Areas. The duration of the gap closure activities would clearly be a function of how many Practice Areas (and which ones) will be appraised. Each of the Practice Areas (PAs) could be analogous to some aspect of a healthy lifestyle such as food choices, food quantity, shopping, cooking, meal planning, exercises, frequency, repetitions, technique, equipment, blood work, rest, stress management, work environment, time management, and so on. Obviously, the more of the lifestyle someone wanted to adopt, the longer it would likely take.

Once a gap is filled (i.e., the weight is lost and/or new muscle mass is added), an organization should give itself at least 2-3 months to 12-18 months to incubate and actually use their processes. The time depends on the type of work being done and the amount of work flowing through the operation required to cycle through all it's new processes. This would provide them with enough data to reasonably conduct an appraisal. However, the actual metric isn't the calendar, it's the cycle-time of their operating models. Clearly, work that gets from estimate to delivery ("life-cycle") quickly are going through their processes and generating artifacts of doing so. This is the value to index moreso than the clock.

On the fat-loss analogy, this would be like finding that point where diet and exercise are enough to keep the weight off and one is able to demonstrate to themselves (or others, as needed) that they can, in fact, live and sustain a healthy lifestyle—in the face of temptation and other uncertainties.

Once people internalize how performance improvement works, how long it takes to earn a rating is a question such people stop asking (hint hint). Like fat loss and getting into shape, performance improvement is a discipline backed by many recommended practices. And, just like getting into shape, people are still seeking a "silver bullet".

We, on the other hand, stick to a healthy diet and exercise program. When we're off track we know it. We gain fat and feel like crap. When we're on it, we see the results.

Make sense?

How much does it cost?

A: If you've read the answer to the previous question and are still asking this question then you must really only be wondering about fees, attributes of cost or other general costs. Otherwise, go and read the answer to "How long does it take?" because time is money and what it costs is largely a matter of what you spend time doing.

As for fees, attributes of cost and other general costs, here's break-down of things that can or will cost you money towards being rated to a capability or maturity level of the CMMI:

Lead Appraiser

"performance report"

Except for a few employees of the Institute, Lead Appraisers DO NOT work for the CMMI Institute. The are either employees of other companies or operate as independent contractors. The CMMI Institute merely certifies that they are allowed to perform official duties as lead appraisers. Lead Appraisers are free to charge whatever they want. Their prices are not regulated.

Someone will need to provide Appraisal Team Training to the people you plan to have on the Appraisal Team. If they've not had training before, this can take a day or two. The appraisal's Lead Appraiser must confirm that the training was provided and that it met the needs of the appraisal. Often the hired lead appraier will provide this training.

So, plan on the Lead Appraiser needing about 1-3 weeks to do the preparatory work for an appraisal, including Appraisal Team Training and at least one Readiness Review, and then 1-3 weeks to perform the appraisal itself (depending on the scope), then another day or two to wrap-up all the paperwork.

Appraisal Team Members

Performance Improvement Consulting

Fees

Consulting firms can charge whatever they want and call it whatever they want, but if anyone is implying that there are CMMI Institute-mandated "fees" for consulting, or using evidence tools, they're only implying this. Yes, if they are certified by the CMMI Institute they have to pay licensing fees, and so forth. But how they recover these expenses is their business. The Institute doesn't pass fees to customers for consulting. Other General Costs
As above, the only other general costs associated with an appraisal are:

Official training, and
Your employees' time on the clock.

NOTICE what's *NOT* in the list above: TOOLS.

There is NO requirement for the purchase or use of any tool. Anyone saying that in order to "comply" with CMMI (or the appraisal) that you must purchase a tool, they're full of *crap!*

Some consultants do use tools as part of their work and as part of you hiring them you are also buying a license to use the tool. That's OK. Since you will end up using the tool after they're gone, it's reasonable that you should pay for using something that is either the consultant's intellectual property, or something they bought and are bringing to the table. And, it's up to you if you want to hire that company. It's not reasonable for you to hire a consultant who tells you they use a tool and then tell them not to use it so you don't have to pay for their tools. Many consultants work their pricing structure into the productivity and efficiencies they gain by using a tool and asking them to stand by their rates when you've asked them to leave their tools in the shed is not playing nice. On the other hand, anyone telling you that if you don't buy their tool then you are not going to "meet the CMMI's requirements" or "pass" the appraisal is FLAT OUT LYING LYING LYING!!! and should be reported to the CMMI Institute! And, you can do that by taking a number of actions listed here (see bottom).

What's involved (in getting a rating)?

A: Um... that's a little broad, don'chya think? But, we get that question frequently enough so we might as well answer it. At least at a very high altitude.

There are three broad steps towards achieving a level rating:

1. Know where you are now.
This is usually called a "gap analysis" or "present state analysis". An "evaluation appraisal" is the official version of this activity. Though, you do not need this to be official. The right person to do this is someone who really understands the CMMI and how to appraise for the CMMI IN YOUR CONTEXT. Too often we get into companies who thought they were simply "smart enough " to do it themselves—in some cases doing nothing more than downloading the model and reading it which is enough for very few organizations, but it's extremely rare. Even taking licensed introduction courses seldom provides enough of an understanding to determine, without any other direct experience, how closely your company is meeting the intent of the CMMI's practices. This will also not likely be sufficient to determine how your particular implementation of the practices will fare in an appraisal. Also, please don't make the following mistake: Assume you're "golden" just because you've been through an ISO 9000 audit, you've won the Malcolm Baldridge Award, or even been carved out of an organization previously appraised. We've actually found that prior experience with other process-oriented bodies of work can work against a company's true understanding of what CMMI is about, how to implement it effectively, and how to appraise their practices.

Once you know what and where your gaps are in implementation you're ready for the next broad step.

2. Address your "gaps".
This is usually called, in CMMI circles, "Process Improvement". Although this step implies that your processes aren't up to the task as they stand now, what it really implies is that you will likely be making some changes to your current processes as you work to meet the intent of CMMI's practices. The idea is that you follow a method of process improvement and not simply a re-skinning of your paper trail. The entire purpose behind CMMI is that of performance improvement via continuous improvement, and companies that simply slap a layer of CMMI-looking processes over top of what they're currently doing is not process improvement, it's death by process; it's WASTE.

It's come to our attention that CMMI has a reputation as being "death by process" as it is. We firmly believe that it's the latter approach towards CMMI, as described in the previous paragraph, that causes this, not CMMI. To be blunt (you're used to it by now, yes?), slapping CMMI over top of your existing process, those processes that you feel have been working all along, is a STUPID way to implement CMMI.

On the other hand, if you do find value in practices CMMI promotes, then what you want to be doing is implementing them in a way that continues to provide you with the value-proposition of the things you like about your current processes and replacing or adding with CMMI those things that could use some strengthening. The smoothest way to this approach is by following CMMI as a guide to building a systemic continuous performance improvement infrastructure. Again, please be advised that doing this on your own without a CMMI expert (employee or consultant) is not advisable for the same reasons having an expert is best for performing the present state analysis.

One last comment on this step (and it's a bit of an unsung truism about the CMMI): companies who are honestly thrilled with their current process and really have a handle on the outcome of their efforts are probably doing a lot of what the CMMI would have you doing. Such companies may call their activities by different names, they might get value out of their activities in a less direct way, but ultimately, they are getting the job done and are still in business, so they must be doing things right. (Or at least doing the right things.) If this is you, then your effort towards implementing CMMI is going to be quite painless and enjoyable.

Oh, OK... there really is one other important point: CMMI says precious little about organizational culture and leadership qualities necessary to make any of this work. While the GOV PA does aim directly at leadership, it doesn't lay out any required characteristics of "good continuous improvement" attributes. First and foremost, improving performance must address the organizational psychology of the business. If/when there are issues with the organizational psychology, they are nearly always a negative effect on improvement. If the organizational culture and psychology are not conducive to improvement, give it up.

3. Get appraised.
Getting appraised with a "Benchmark" appraisal is what most people think about when they are looking at CMMI. The appraisal is what gives an organization their official "Level". Once the appropriate expert can make a sound call on your organization's implementation of the CMMI practice intent and value, you can start planning for an appraisal. Details of the appraisal are answered elsewhere in this FAQ.

How does the appraisal work?

A: NOTE:The appraisal process is guided by something called the Method Definition Document (MDD). At this time, copies are only available to certified individuals.

If you are not familiar with the appraisal process already (which you aren't 'cause you're asking the question), you don't want to try to read this anyway. (Unless you're doing some whacky exercise in self-hypnosis.)

Just so you understand that the complete answer to this question is ordinarily delivered in days' worth of training. We're obviously limited in what we can explain here.

We're going to pick up the appraisal with the portion of the event that most people think about: the on-site period. That part when people usually show up and start asking questions. That's when there's a full appraisal team at your company and they're looking at your evidence and conducting interviews (or performing some other accepted form of verbal or written affirmation). It's at the end of this period that a company gets the results of the appraisal and, when all goes well, a rating.

The projects and organizational functions that are evaluated in the appraisal are based on a "randomly generated sample (RGS)" of projects. The total population of projects that go into the algorithm from which the RGS is cranked out are the subset of the organization's projects to which the appraisal results will apply. Except in smaller organizations, this subset of projects is seldom the entire organization. The RGS is, then, a subset of the subset.

The randomly generated sample mitigates the risk that companies coach only specific projects into being "appraisal ready". When the organization can pick and choose which projects are evaluated, it's too easy to stack the deck in their favor while avoiding exposing the true nature of their improvement activities that might, shall we say, be something less than pretty by comparison.

The RGS is generated sufficiently in advance to allow the organization to plan for the logistics of those personnel to be involved as well as for the opportunities to request changes to the sample for operational purposes. Also, some projects can be explicitly excluded from being chosen in the first place, also for logical reasons such as bad timing, classification, resource availability, etc.

The RGS report lists the projects and which PAs they will be asked to provide evidence for. One advantage to the RGS is that raises the confidence that continuous improvement is broadly implanted in the organization without having to involve too many projects, even from larger organizations.

So... that's pretty much what happens at the appraisal: A team lead by a Lead Appraiser as team leader looks at evidence from a subset of projects and makes a judgment on that evidence regarding the extent to which the it conveys that the intent and value CMMI's practices are being met. There are 2 types of objective evidence: Artifacts and Affirmations.

Artifacts are, as the name implies, *things* an appraisal team can look at, read, hold, touch, etc. Affirmations are verbal data gathered by interacting with people doing the work.

For each practice in the scope of the appraisal the evidence is looked at collectively for that practice and a determination is made regarding the extent to which projects and the organization meets the intent and achieves the value of the practice. This is called "practice characterization" The characterization scale is: Fully Meets, Largely Meets, Partially Meets, and Does Not Meet. There's also "Not Yet" which gets a bit too complicated for this medium to address.

The characterizations are then looked at in aggregate according to rules in the MDD across all projects and the organizational support functions. Basically, after aggregating the characterizations across all projects, no single practice can be characterized as less than Largely Meets (in aggregate) or it will spell disaster. Even then, if certain practices are found even universally "Largely Meets", and the appraisal team believes there's a pattern of weaknesses in what they're seeing that causes these practices to only be found as "Largely Meets", the team may still choose to say that whatever's causing these practices to not be Fully Meeting is worrisome enough to preclude the organization from satisfying the Practice Area, and if any level (correctly called a "practice group", in case anyone asks) in a Practice Area isn't satisfied, then it can't be said that the whole Practice Area is being satisfied, can it? And, that, our friends, is how the appraisal works: it's a search for whether the organization is meeting the intent and achieving the value the practices of those Practice Areas in scope of the appraisal.

NOTE: Project are drawn from "Subgroups". Subgroups are distinguished by a set of key factors that differentiate one Subgroup from another.

The minimum list of subgroup Sampling Factors are:

Location: if work is performed in more than one location (can be near, far—not limited, what matters is whether or not the processes and other relevant attributes are different).
Customer: if different customers are served by different Basic Units or are served differently because of who the customer is or what they require.
Size: if work is performed differently based on the size of the Basic Unit, or Support Function, or the size of the effort.
Organizational Structure: if work is performed differently in different parts of the organizational structure.
Type of work: if there is more than one distinct type of work done in the organization (mobile apps vs. mainframe, hardware vs. software, systems of systems vs. electronic components).

Once you distinguish Subgroups based on these factors (and others, that you and your lead appraiser may determine to be relevant), the entire lot of projects delineated by subgroup are submitted to the CMMI Institute to be sampled by the random sample generator.

The key to the Sampling Factors are to identify the most likely sources of process differences. The important outcome of this sampling process is the analysis of the sample, not to force the organization to split-up its work into tiny pieces. If, after the analysis, it is determined that one or more of these factors do not change the processes, then the factors can be eliminated as influential on the processes—thereby eliminating unnecessary and possibly artificial barriers across the organization's work, which would also unnecessarily increase the appraisal's complexity. While the analysis during planning has increased, the idea is not to increase the appraisal burden while also increasing confidence in the results and allowing the organization's processes to be more reflective of the work being evaluated.

Who can do the appraisal?

A: Another quick and easy question, thanks!

A Certified Lead Appraiser. Certified by who? The CMMI Institute.
Lead Appraisers (as of this writing) have to qualify by surviving the following activities in this order
(sort-a):

Building Organizational Capability Course Series—

Advancing Organizational Capability Course Series—

Mastering Organizational Capability Course Series—

There are exams along the way as well as having to participate in a certain number of appraisals (before ev, plus a Validation of Education and Experience all wrapped up in being observed performing an appraisal by one of a very few number of people the CMMI Institute trusts to do that sort of thing.

NOTE: There is a distinction for "High Maturity" appraisals, Lead Appraisers, and appraisal team members. "High Maturity" are appraisals performed to a target maturity level 4 or 5. Certified "High Maturity" Lead Appraisers (CHMLA) are required to take more coursework, more exams (written and oral), and to qualify in much greater depth of experience and knowledge in concepts found in the Maturity Level 4 and 5 practices.

IMPORTANT!
The organization being appraised needs to have a contractual relationship with the Partner Organization sponsoring the Lead Appraiser performing the appraisal in order for the appraisal to be valid.

In other words, Lead Appraisers who aren't directly working for a Partner (or, who aren't themselves representative of a Partner), can't contract to perform an appraisal without the contractual involvement of a Partner. That's not to say that money needs to be involved, and, it also doesn't mean that the appraiser needs to negotiate their dealings through Partners, however, it does mean that the Partner at least knows about the appraisal and the relationship being established with the organization being appraised.

Can we have our own people on the appraisal?

A: Yes! Absolutely Yes! In fact, it's encouraged.

The appraisal team must be at least 4 people strong (including the Lead Appraiser), and with your company's employees on the appraisal team you increase the odds of buy-in to the appraisal process, results, and any recommended follow-up and follow-through. There are a number of qualifications potential team members must meet, the most logistically challenging of them being that candidate team members must have had a licensed delivery of the Foundations of Capability + the relevant Building ____ Excellence class (typically 3 days, total in person) before going into the appraisal activities (which begin a month or more before the actual on-site period). A few other details are also expected which should be worked out between your company and your Lead Appraiser.

Can we have observers at the appraisal?

A: Let's first start by defining what an observer is. An "observer" is someone who is not qualified to be on the appraisal team, or, despite being qualified is not actually on the appraisal team, but is hanging around with the appraisal team while they do their thing. OK, got that?

So, the answer is: No.

To preserve the non-attribution and confidentiality of the appraisal, per the Method Definition Document (MDD), observers are not permitted on SCAMPIs. In fact, the MDD includes an explicit table of who is/isn't permitted for various aspects of the apraisal process. Furthermore, the MDD exclusively calls out the only exceptions to "observers" as being a certified language translator/interpreter, or an official CMMI Institute observer who is there as part of an appraisal audit (of the appraisal, not the organization) or as part of the qualification process for the lead appraiser.

The primary rationale has to do with the nearly invariable experience that observers (being either untrained and/or sometimes not involved with any of the work leading up to the event) tend to be inadvertently disruptive to the discussion and proceedings, and, have no accountability. However, the most important consideration is that observers are not bound to maintain the confidentiality or the non-attributional aspects of the proceedings. And, there are no provisions in the method and no recourse through the CMMI Institute to address issues that may be caused by non-participants breaking confidentiality or non-attribution policies or any other method rules. Another concern is that of the comfort level of the participants to be open and honest when people who aren't committed to the results may be present, and, should there be any unfavorable findings, there may engender a concern for the influence of observers on the outcomes.

While all of the above rationale might be manageable by a competent appraisal team leader, the probability of problems outweigh the possibility of that everything will be fine. If there are unique circumstances whereby the conditions exist for the risks to be fully mitigated, a lead appraiser may request a waiver from the CMMI Institute during appraisal planning. (We wouldn't hold our breaths that it would be granted.)

What sort of evidence is required by the appraisal?

A:We've covered this here.

We will, however, take the opportunity to point out that evidence does not have to be written in stone or divinely received. Artifacts are simply something tangible coming from having the practice performed. Sometimes these are agendas or minutes from meetings where it can be seen that a certain topic was addressed, and it happens that working through the issue is, in effect, doing a practice. Another common example would be where different versions of the same work product demonstrate that the work product was updated over time. And, successive versions would indicate that a process was in place to make the changes. If the practice says to keep track of changes, these versions could be used to demonstrate that changes were made, and one could infer that there was some way to keep track of them even though the fact that changes were made isn't actually the same as keeping track of changes. Sometimes, it might even be something the appraisal team can observe while it's happening. All of which are tangible.

How much of our company can we get appraised?

A: The part of your company that gets the actual rating is called the "Organizational Unit". This can be the entire company or only parts of it as determined by the types of work (and as such, the types of processes) the company wants the appraisal to be performed on, and as a result, the appraisal results to apply towards.

For the appraisal to apply to an entire company, work that represents all the sorts of efforts that the company does would need to be evaluated in the appraisal. One instantiation of a type of work that consumes the entire company, and is the only work that company has and does would result in the appraisal on that one effort and that company could say that it's entire company has achieved the level rating awarded by an appraisal on that work.

The actual composition of the organizational unit is something that needs to be defined up-front during appraisal planning. The Lead Appraiser must analyze the selection of work the company desires to be accounted for in the appraisal results to ensure that the work used in the appraisal does, in fact, represent the organizational unit of the appraisal results. The more variety in the kinds of work in the organizational unit, the more types of work will be needed. Also, the broader the application of the appraisal results, the broader the scope of included work. Meaning, for example, if the company has a number of sites, and, the company wants "the entire" company included in the appraisal results, work representing each site must be included. Multi-site work efforts are OK, but using one location's part of the work to represent another will not, uh, work. There are a number of facets that are analyzed called "sampling factors" which we discussed in more detail above. Also there we explained the role of the Randomly Generated Sample (RGS).

How many projects need to be appraised?

A: Project are sampled as a cross-section of Practice Areas and number of projects in scope.

Projects (also referred to as "instances" when used for sampling purposes) to provide evidence for appraisals are providing them for Practice Areas (PAs). In many cases, projects will not provide evidence for all the PAs. If there are more than one project in the organizational unit, barring any valid rationale, different projects will provide evidence for different PAs. Naturally, when the number of projects is fewer than the number of PAs, projects provide evidence for more than one PA. In fact, projects are often chosen to provide artifacts for groups of related PAs (commonly, Capability Areas. The minimum number of projects to provide artifacts for each PA is as follows:

Total Project in the OU	Minimum number of Projects (Instances) per PA
1 to 10	1
11 to 40	2
41 to 200	3
201 to 400	4

More than 400 active projects, it's best you stop reading and ask yourselves whether you should be seeking help from an FAQ.

Can we have more than one appraisal and inch our way towards a rating?

A: No, At least not yet. Well, at least not in the way you're thinking.

You can have as many appraisals as you want, however, at this time, if you want a Maturity Level rating (or even a Capability Level rating), you will only achieve that if the appraisal looks at all the evidence for all the Practice Areas in the scope of the appraisal in a single appraisal. This appraisal could span many weeks—up to 90 days—but it would still be considered a single appraisal. Only one rating would take place. (OK, there are some nuances we're leaving out about handling a large organization that wants to bookend a massive model scope and multiple OUs under the umbrella of one event, but as stated elsewhere, if that's you it's best you stop reading and ask yourselves whether you should be seeking help from an FAQ.

If we go for a "level" now, do we have to go through it again to get to the next "level"?

A: Yes. Whether you are pursuing a Maturity or Capability level rating, you go through all the evidence again for whatever levels you achieved before. One reason is that at this time there are no mechanisms in place to allow for "cumulative" appraisals, which is what would be necessary to make a non-recursive approach work. However, even more fundamentally, the appraisal team and Lead Appraiser can't be expected to assume that there would be evidence from the lower levels to support the higher levels' activities or that nothing would have changed in between the events. Even more basic than that is the fact that the levels support one another and it would be very unlikely that appraising to a higher level could be accomplished without evidence from the earlier levels.

The only exception to this is if an appraisal is spread out over a period of time, and is, in fact, one long appraisal. The time-limit for completing a single appraisal is 90 days.

How long does the "~~certification~~" rating last?

A: Appraisal Results are recognized by the CMMI Institute for three (3) years from date of the appraisal's acceptance by the CMMI Institute.

Under certain circumstances, this rating validity can be extended by up to two (2) years, three times by performing a "Sustainment Appraisal". As long as a sustainment appraisal is performed before the expiration of the prior validity period, the total validity period when maximized is nominally 9 years, 3+2+2+2.

While qualifying for a sustainment appraisal could possibly be a hurdle to some organization, the benefits are steep: Sustainment appraisals evaluate about a third of the original PA scope in depth and require half the minimum appraisal team. This reduced scope means reduced effort and shorter durations. The smaller appraisal team also has savings. Therefore, for some organizations, the effort savings alone recovers the costs of conducting the appraisals slightly more often.

If you're reading this you probably haven't had your first benchmark appraisal yet, so don't get ahead of yourself.

What is the difference between the appraisal types?

A: The differences boil down to scope and the level of rigor, and, as reflection of the level of rigor, to what the outcomes can be.

There are four (4) appraisal types:

Benchmark:

Sustainment:

Action Plan Reappraisal:

Since we discuss the benchmark at length above, and we mention the sustainment appraisal here, explaining the others in this FAQ makes no sense. This area is for beginners and the other appraisals are not for begineers.

How do we pick a consultant or lead appraiser?

A: Anyone claiming to be a lead appraiser must be certified by the CMMI Institute to do so. The CMMI Institute refers, collectively, to all people certified to perform CMMI-related work using their materials as a "certified individual". Thus, all actual lead appraisers are "certified individuals". You can search/sort a list of such people here, and, specifically limit your search to lead appraisers. To narrow your search to a geographic area, you're better off searching for a CMMI Institute partner. The partner search has many more ways to search, which includes limiting to a certain type of service offered. And then, once you find a partner, you can see the authorized individuals associated with that partner.

However, one need not be a lead appraiser to consult on CMMI. In fact, there are many people very well experienced in implementing CMMI and with appraisal experience who are not credentialed to do appraisals or official training. Many more experienced people than there are authorized or certified individuals. Frequently, because they don't carry authorizations, they're not able to charge as much as those who are authorized. The trick is: finding them. Many work for partners, so once you find a partner, you might ask about the authorizations of their consultants as a gauge of what you can expect to pay. Many people experienced in CMMI work for large organizations who need their services full-time, on site, and moonlight as consultants. Others are just independent consultants and get much of their work by word-of-mouth. Certifications below Lead Appraiser mostly means you sit in class and take exams well. However, Lead Appraisers and instructors are vetted by a rigorous process including observations.

Though, the question isn't "how do we find a consultant or lead appraiser" but, "how do we pick from all the ones out there?!?!?".

As you can guess, there's not a simple answer, but we can say two things:

Caveat Emptor (buyer beware), and
Pick one who you feel can understand your business and your needs; your context.

WHY must the buyer beware? Because interpreting models for how a given implementation can be done, and also recognizing that a given implementation of a model is a legitimate interpretation of the model are far from exact science.

CMMI is a model not a standard, as we've said many times before. It's not something that, when applied, will look the same each time. Furthermore, as we've said, the practices in the model are not processes themselves, they are practices to improve performance. It takes skill to effectively interpret the model and implement it in a given situation, and, it takes contextual relate-ability to appraise whether the model has been implemented or interpreted properly/effectively.

There are (in our opinion) far too many lead appraisers (and consultants) who don't know how to/don't want to/don't appreciate (or are too lazy to) do what it takes to help clients design contextually appropriate process solutions, and/or to allow for contextually-driven interpretations of model practices when performing an appraisal. Symptoms of such an appraiser or consultant are in what they consider valid evidence of the practices, or valid descriptions of the processes, or how they describe their approach towards working with an organization to build up their practices.

An appraiser or consultant may not be suitable to a given buyer if they only expect to create, see, or will accept specific things as evidence, or if they expect to see, create, or will accept process descriptions with each CMMI practice spelled out, or if they expect organizations starting out to generate artifacts that address model practices but don't add value to the product development process. None of these characteristics are required (or prevented) by CMMI or the appraisal method. Therefore, buyers must be able to select the CMMI service provider whose attitude, knowledge, and experience suits their needs. After all, the model and appraisal process can allow for a wide variety of strategies, tactics, and contexts, but not every consultant or appraiser will (or can) allow for it.

What this means, in practical terms, is that buyers of CMMI services must be able to interview potential consultants and lead appraisers for their attitude towards, and knowledge and experience in practice implementation, evidence of practice implementation, and artifacts of the implementation. Furthermore, buyers must interview providers for the ability of the provider to pick up on, adapt, and appreciate the context in which the model has been or will be implemented.

The easiest example(s) to provide readers with relate to whether the consultant or lead appraiser can communicate with the buyer in terms the buyer understands such as: being a small outfit, or using Agile development methods, or being embedded with the client and using the client's practices as well as their own. Another relevant inquiry is if the buyer can give or ask for some examples of practices as actually carried-out in or envisioned for their organization, and gauge the response from the potential CMMI service provider as to what they think of those practices.

The challenge in conducting such an interview is that the buyer must have enough of an understanding of the model and the appraisal process to be able to determine whether what they're hearing is the provider's opinion/approach or whether what they're hearing is dictated by the model or the appraisal process. Sounds like an impossible task. Fear not, some CMMI service providers will give you this sort of unbiased advice or even a quick education for free. This FAQ and its contributors are aimed at providing this sort of advice because we feel it's to the detriment of the entire CMMI enterprise not to do so. Sadly, rough estimates of the number of such providers puts the figure at about 5-10% of the entire authorized population. As a character in a pretty good movie once said, "choose wisely".

Good luck!

Where can we see a list of organizations that have been appraised?

A: Finally! A question with a simple, straight-forward and easy answer!

Simply visit the CMMI Institute's Published Appraisal Results System, (PARS) and put in your query. It's fairly uncomplicated.
There are, however, a few points to keep in mind:

Not all organizations have asked to be listed in the system, not appearing does not guarantee they have not been appraised.
If an organization has changed their name after being listed, they will *not* be listed with their subsequent name(s), organizations are only listed with the name they had when the appraisal was performed.
Pay close attention to the Organizational Unit (OU) (discussed on this FAQ here) of the appraisal. Though you may be interested in validating whether a company has been rated, it's rare that entire companies are rated (especially if the company is not small). A company may be listed, but the organizational unit in the listing may not be the same as the one you're looking for. Or, there may be several organizational units within a single company. Do not take for granted that the organization you are researching is (or its people are) the same as the one appearing in the system.
Once all the appraisal data is fully completed and submitted to the CMMI Institute, it can take days before appearing in the PARS. Most common causes of taking longer include:
» appraisal team or sponsor not completing their appraisal experience surveys,
» appraisal sponsor not signing the appraisal disclosure statement (ADS), or
» issues with the results that are being investigated by CMMI Institute's QA process.

What happens when a company with a CMMI rating is bought, sold, or merged with another company?

A: Appraisals are patently rearward-looking. Furthermore the sampling factors distinguish important characteristics of the organizations being appraised that may cause the circumstances and therefore the processes to change from one part of the operation to another. As such, the only valid statements that can be made about an organization and appraisals performed on the organization are statements related to the specific organization named in the appraisal results at the time of the appraisal.

In other words: when two (or more) organizations come together or are split apart due to mergers, sales, or acquisitions, appraisal results do not convey, combine, confer, assume or transfer with, from, or to the new entity/entities in any way whatsover. The appraisal results remain attributed to the original entity/entities and the circumstances that characterized the original entity/entities at the time of the appraisal. Furthermore, it is not possible to combine appraisal results from two or more entities or to assume the highest or newest of two or more ratings when independently appraised organizations combine in any way.

We hope that's clear.

What's the official record of the appraisal results?

A: The Appraisal Disclosure Statement (ADS) is the sole and entirety of the official results of the appraisal, regardless of what does or does not appear in the CMMI Institute's Published Appraisal Results System, (PARS). Nothing in any appraisal presentation, and unlikely anything to be found framed and on the wall at a company, or printed on a large banner and hung from a footbridge are official or complete indication of what exactly was appraised and the meaning and context of the results of an appraisal. (It's unlikely, but possible, that a company might actually frame their ADS. It's several pages long; but in the spirit of avoiding any absolutes we can't prove, above, we used the phrase "...and unlikely anything to be found...".) In any case, the ADS is generated by the Lead Appraiser after all the other data has been collected and submitted to the appraisal system. It's signed by the appraiser and the sponsor, and contains all the details of the appraisal, its circumstances, the explicit organizational unit to which the results apply, and the results themselves. If someone were serious about determining whether an organization has been appraised, when, to what end, and to what scope, they should request to see the non-confidential parts (if any are even confidential) of the ADS.

Can we go directly to Maturity Level 5?

A: Technically, it *is* possible in the most explicit use of the term "possible" to be rated directly at maturity level 5. All this means is that the organization was appraised performing all the practice groups (levels) of all the predefined in-scope PAs. The fact that they were not level-rated before this results in the organization having appeared as achieving ML5 "directly".

However, in reality, it's not likely that any organization would proceed to implement all relevant process areas without ever having performed any appraisals between the start of their CMMI journey and their appraisal for ML5. What is more likely is that at certain points the organization will conduct appraisals to gauge their progress. Whether or not these intermediate appraisals were used to generate a level rating would be up to them. There's no requirement that appraisals generate ratings, so an organization appraising at ML5 and receiving a rating may appear to have gone directly to ML5, when in fact they had several appraisals before then—none of which generated a rating.

Of course, there's another reality to consider: the CMMI Institute reviews all high maturity appraisals very carefully. If an organization has never had a CMMI appraisal prior to their appraisal for ML5, it will be viewed with even more scrutiny, and both the Lead Appraiser and the organization appraised can expect to get a call from the CMMI Institute's QA team. Not to mention that not having any appraisals prior to the one aiming for ML5 is extremely risky.

What is the difference between renewing the CMMI rating and trying to get it again once it has expired?

A: Generally, the difference is only in how much preparation it takes the organization. In our collective experience, most 1^st-time ratings require some amount of transition from the original "present state" of the organization's practices to some "new" present state of practice in later future such that they can attain the desired level rating.

Assuming the organization in question didn't change much, and/or that they were successful in maintaining their practices over the years and have kept-up with their institutionalized practices and processes, then they would have little or no "gap" in practice performance. They would merely need to put in some sweat equity towards collecting the evidence for the appraisal beforehand.

The mechanics of an appraisal are no different. (Sustainment appraisals follow the same mechanics, just with a smaller scope of deep-dive PAs.) The lead appraiser (appraisal team leader) must still plan and prepare for the appraisal. The appraisal team must still be qualified and briefed. A pre-appraisal readiness review must be performed by the appraisal team leader. And, the on-site portion of the appraisal must still be performed.

Appraisal team members from prior appraisals can be re-used as long as they have the most up-to-date qualifications as required by the scope and method of the appraisal in question. There is no need for going through lengthy training for prior appraisal team members whose prior training still keeps them qualified for the scope and method of the appraisal planned. (These are Q&A for the lead appraiser. If you don't yet have one, we can probably answer them for you but we'd need some more information from you, so please contact us.)

If the organization has not changed the state of its practices since their prior rating event (i.e., Benchmark or Sustainment appraisal), there is no compelling reason to perform a new "present state" (a.k.a. "gap") analysis or to invest in any "improvement" consulting. However, if there is some concern that practices may have dropped off or slipped from the tracks since the last appraisal, a current present state analysis might be a good idea so that the required readiness review can be more productive with fewer risks and unknowns going into the next Benchmark (or Sustainment) appraisal.

In our experience, renewal appraisals have cost 25%-40% of the original appraisal costs since the original costs included coaching, training, and consulting to bring the organization up to the point where they are ready for the appraisal.

Q: Can my organization go directly to a formal Benchmark without any Evaluation appraisals? Is it mandatory that before a formal Benchmark, a formal Evaluation appraisal should be completed?

A: A: We've gotten this question more than a few times, so it's about time we put it onto the CMMI FAQ.

There is no requirement to perform an Evaluation appraisal prior to a Benchmark.
This is true for *any* Benchmark—regardless of whether it is your second, tenth, or first, or any other Benchmark.

Under certain conditions, an Evaluation appraisal is recommended, and there are many good reasons to perform one (which is why they exist) but under no circumstances are they required.

CMMI, Agile, LifeCycles and other Process Concepts FAQs

What if our development life cycle doesn't match-up with CMMI's?

A: CMMI isn't a development life cycle. The end.
It's a model for building an improvement system to continuously improve very particular areas of what goes on in your work, regardless of the life cycle. This is a central tenet of our approach to CMMI, by the way. Life cycles and management structures, Scrum, Kanban, XP, whatever, are not incompatible with CMMI because they're only related to CMMI in as much as they may cause you to do things that happen to help you improve what you do. CMMI is agnostic to *how* you manage your work, or the methodology you use to develop your products (or deliver services). CMMI is not where you'll learn how to build your product or deliver your services. CMMI will not tell you how to operate your business. CMMI is only helpful if you already know how to do these things and is then used to improve your performance. Lifecycles are how you get things done. You choose them and CMMI can help you improve within them.

Doesn't the CMMI only work if you're following the "Waterfall" model?

A: NO! CMMI is not about development life cycles. While a fair criticism of CMMI is that many of the contributors come from a "Waterfall"- centric or a "Big Plan Up Front", "top-down" way of developing wares, they were at least careful not to box anyone into following a specific development method. Nonetheless, it takes very deep understanding of the CMMI to implement it, regardless of which life cycle you follow. Meanwhile, you can browse over to our this blog.

How does CMMI compare with ISO/TL 9000 and ITIL? (or other standards?)

A: While there is considerable overlap between these models, frameworks, and "best" practices, they are different from each other and used for different purposes. People who ask this question come from one (or both) of two camps:

They're just totally unfamiliar with CMMI (and/or the others), and are asking innocently enough, and/or
They just look at CMMI (and the others) as some standard they need to comply with, and not as something that can make a positive difference in the operations of business.

(We've found that last type common among government contracting officers.)

Let's address a question of "standards" first.

The practice areas and the practices within them are not intended on being or replacing any technical "standard" for doing anything. Some practice areas that share names with other familiar activities have volumes of "standards" already written for how to perform those activities. Many of the engineering-oriented practice areas come immediately to mind such as Configuration Management and Requirements Development and Management. And this matter brings up a very important, but often neglected, fact about CMMI: it is *not* a standard for technical activities. And, for whatever CMMI *is* supposed to be used for, it does *not* a prescribe how to do anything in it.

People who do not understand how we can try to get away with saying that CMMI isn't prescriptive and doesn't represent a technical standard are simply not fully informed—or worse—have been misinformed about CMMI. We'd really love an opportunity to set the record straight.

CMMI is about improving performance associated with developing products, delivering services, and aquiring good and services. CMMI is not about the technical processes needed to actually do the developing and delivering. The CMMI "practice areas" are what the authors believe to be important elements that contribute to a systematic ability to affect continuous improvement in and among (the management of) those processes and practices that actually develop and deliver the products and services.

In essence, CMMI's practice areas are many of the things needed for continuous improvement of technical activities, not the activities themselves.
What CMMI is saying is:
In order to improve your performance, you need to manage your requirements, risks, and configurations; you need to plan, monitor, and control your work, you need to measure, analyze and manage the output of your efforts; you need to actually pay attention to the performance of your project to how well they follow processes and to whether your processes are working out for you.
CMMI then says: if you really want to get good at these things you'd have be making a focused effort on your processes, leadership would give a sh*t about performance via processes, you'd have standardized process assets, an organization-wide training program, and a formality to your technical activities that might otherwise be left to fend for themselves.
For the true process zeal: you'd be able to quantify the performance of your projects and processes and you'd be able improve them by focusing on what numbers tell you to focus on, not just what people gripe about the most. CMMI also says that if you're going to do a process, you should have a policy for doing it, a plan for it, resources, assignments, process-level training, stakeholder involvement, and other activities to make them stick.

If improvement is what you want, it only makes sense, doesn't it?
(The types of activities mentioned here are from the practice areas, in case they weren't familiar to you.)

You see, CMMI has a number of practice areas that are needed for technical activities, but their presence in CMMI is because the process they refer to are also needed for process design just as much as they are needed for technical engineering.

SO, if we disassemble a practice area into its intent and value in light of the above understanding we will see that the intent and value are not oriented at technical activities, they're oriented towards continuous improvement. We can hope that in this context, the matter of whether CMMI is a technical standard can be laid to rest, and, we hope that we bring a deeper appreciation for how CMMI works.

With that, we can simply explain that ISO/TL 9000 and ITIL have a different focus than CMMI, and just like CMMI has practices that sound similar to technical engineering processes, these other bodies of knowledge also have their similar-sounding activities that are needed and relevant for the purpose they each represent. Since this isn't a FAQ about ISO/TL 9000 or ITIL, we hope it's enough of an answer for now to explain that wherever CMMI has a practice that seems like it's also in another body, CMMI does not innately conflict with the others... there are ways of implementing CMMI that can make them all work well... however, an organization can go about implementing any practice under the sun that could conflict with some other practice, CMMI or otherwise, but it would not be because of anything in CMMI.

Aren't CMMI and Agile / Kanban / Lean methods at opposite ends of the spectrum?

A: Not at all. We've got A LOT of content on this subject! Instead of being very redundant by putting something here, please check out the blog on that topic, and the SEI's Technical Note, CMMI or Agile: Why Not Embrace Both!.

We will, however, leave you with this: There is nothing inherently *in* Agile/Kanban/Lean methods that make them incompatible with CMMI. However, both CMMI and the family of approaches commonly and collectively called "agile" have a very wide (perhaps infinite) range of ways of being interpreted and implemented. For example, nothing in CMMI requires that everything be "documented", though, many organizations take this (silly) approach to using CMMI. Similarly, nothing among the agile values or practices insist that a team produces *no* documentation, but that doesn't prevent teams from being just as silly.

Faux agile doesn't help matters any more than rigid waterfall does.

One more point: Most of the incompatibilities we've seen—beyond interpretation and implementation misfires—come from focusing on the practices (either CMMI or agile) and on tools and/or artifacts (again, either CMMI or agile) instead of the values and principles behind them. Focusing on the wrong thing will most often lead you to the wrong place. Believe it or not, both CMMI and Agile come from the same source. They merely take different routes to get to the same desired outcome, but when used incorrectly, neither is likely to save you from failure.

How are CMMI and SOX (SarBox / Sarbanes-Oxley) Related?

A: They're not. Well... at least not in the way that many people think they might be.
See, many people think that because the Sarbanes-Oxley Act of 2002 (which we'll just call SarBox) frequently involves business process and IT infrastructure and related systems, that it involves CMMI. But, in actually, the connection to CMMI is rather weak and always is a function of the organization's intentional effort to connect the two.

SarBox is about public company corporate governance. It is a US law that aims to eliminate the excuse by corporate leaders of public companies that they "didn't know" some bit of information about their company that could result in mistakes (or outright lies) about accounting, work-in-process, inventory, earnings reports, valuations, sales/revenue forecasts, and so on.

Its origin is in the several accounting scandals revealed in the late 1990's and early 2000's.

The intersection of SarBox and CMMI is only in that companies working towards SarBox compliance are very often relying on systems and software to help them achieve their compliance. When a company says to an auditor, "our software (or systems) are capturing the data, and we rely on that data to be SarBox-compliant," then they might get into questions about the system's requirements, design, configuration, etc.

A company in such a position might look towards CMMI for ways of improving the management of their development practices if, in fact, they are relying on those practices to maintain their SarBox compliance.

The simple answer is this: SarBox and CMMI are not related and don't have similar practices, EXCEPT that some companies *make* them related because of the context in which they're using technology to be SarBox-compliant, and, their reliance on technology development disciplines and/or institutionalization of process improvement disciplines to make sure they have a handle on how they run the company.

That said, another quick connection between SarBox and CMMI is that a company already familiar with CMMI might want to use the GPs and perhaps a few PAs to deploy whatever they need to deploy to "establish and maintain" SarBox compliance. (Sorry, couldn't resist!)

There's another angle to mention:

Many executives seem to have the nasty trait of putting anything that looks, smells, sounds, tastes or feels like "compliance" requirements into the same "bucket".

When they make this mistake, they then jump to a conclusion that goes something like this:

"This is compliance, that is compliance, and that over there is compliance too. They must all be related, and therefore redundant. Which is best? Which is easiest? Which is cheapest? Which should I do first?"

This, of course, is utter nonsense, but it happens. The fact that implementation of these process-related concepts must be driven by the context of the business is just ignored. It is a symptom of an organization looking for the marketing benefit of some auditable achievement and not the benefit of the concepts behind the effort.

Though, in fairness, companies that must comply with SarBox don't have a choice, unless they can afford to go private by buying back all their stock.

SEI / CMMI Institute / ISACA FAQs

Why was CMMI Taken Out of the SEI then sold to ISACA?

A: CMMI and its predecessors had been worked on by SEI for over 25 years. Much of it was funded by the US Department of Defense (DOD). The DOD stopped funding CMMI several years prior to being carved out of the SEI. However, SEI is still an FFRDC (see here) funded by DOD. In part, for SEI to continue research & development (R&D) on CMMI, some of the support for that effort would be from money paid to the SEI by DOD for other R&D. In 2012 the DOD decided that it wanted the SEI to focus all of its resources on evolving other technologies more urgent to DOD than CMMI and that the CMMI is mature enough to support itself. So, instead of dropping CMMI entirely, Carnegie Mellon University (CMU) created the "CMMI Institute" as a wholly-owned spin-out to operate CMMI (and People-CMM and a few other things, eventually). CMMI Institute evolved CMMI in directions independent of the path it was on while within SEI.

A few years into the CMMI Institute's independence from SEI, CMU decided to sell the CMMI Institute to ISACA. The integration of the CMMI Institute into ISACA will complete in the year 2020.

Who Will Operate the CMMI

A: CMMI will continue to be operated by the CMMI Institute as an enterprise of ISACA.

What Will Happen to CMMI? Will CMMI Continue to be Supported?

A: CMMI will continue to be supported by CMMI Institute. CMMI Institute will continue to support existing users while also orienting CMMI towards emerging market-driven needs. We can expect CMMI and its related products and services (such as appraisals) to be evolved in directions that make sense to meet many market segments and to appeal to audiences more broadly than the market it had been serving.

Will CMMI Change? What's the Future of CMMI?

A: As you've seen CMMI has just undergone a significant update to V2.0. The current version and architecture of CMMI are a step evolution from prior versions. Under ISACA CMMI can evolve along many new paths. For example, CMMI can branch so that there are different versions or different products for different markets. It could sliced and diced and re-packaged for different uses/users. Different types of appraisals can be created to meet demands not suitably addressed yet.

Imagine, for example, versions of CMMI and of appraisals that focus on ongoing fiscal improvement, or versions that meet the specific targeted needs of start-ups and their venture backers.
Imagine appraisers and consultants specifically qualified to work with lean, agile, start-ups, enterprise, operational services, technical debt, Cyber, or DevOps, each with a version of CMMI, training, and appraisals suited specifically to their business and without the ambiguity currently experienced with only one version of everything for everyone. These are the sorts of things possible with new markets and resources.

Will We Still Be Able to Work with Our Current "CMMI Partner"?

A: All current CMMI Partners in good standing will be offered the opportunity to have their licenses continue to oeprated under ISACA. Other than changes to references to SEI, CMU, or the CMMI Institute and online real estate, the change of relationship between the Partners and CMMI Institute will not change the relationship between you and your Partners.

Do the Lead Appraisers work for the CMMI Institute or ISACA?

A: Almost none of them. The rest are licensed to appraise and teach through Partners. CMMI Institute does, however, administer and train people to be certified to take leadership roles and responsibilities for leading appraisals and delivering official instruction.

In particular, CMMI Institute controls very closely how and when it allows people to become Lead Appraisers. Even still, while the cadre of people with the authority to observe candidate Lead Appraisers on behalf of the CMMI Institute is small, only a few of them are actually CMMI Institute employees. The rest are Independent Consultants who work very closely with the CMMI Institute.

How do we report concerns about ethics, conflicts of interest, and/or compliance?

A: Waste, Fraud, Abuse, and Noncompliance with Policies Harms Everyone. If you have concerns about the truth behind an organization's rating, or about the ethics, compliance or conflict-of-interest of a consultant or appraiser, we strongly encourage you to report these concerns to the CMMI Institute. You may also want to review their Partner policies, here, as well to ensure your concern is properly supported. All authorized and licensed individuals and organizations must operate through a Partner, so all investigations will include an inquiry to the Partner.

The Ethics and Compliance information is here, there you can also see other information on expectations and how to report your concerns.
The direct reporting email address for Ethics and Compliance concerns is: ethics-compliance@cmmiinstitute.com.

We sincerely hope you never have to use any of them, but if you do, we're very sorry. And, we hope you are undeterred from your process improvement aspirations.

Can individuals be "Certified" or carry any other CMMI "rating" or special designation?

A: Individuals can be Professionally "Certified" for career enhancement purposes as well as for carrying out official activities within the CMMI Product suite.

There area number of professional CMMI certifications that only demonstrate that an individual has taken classes and exams. These certifications do not convey any special rights or privileges to the individuals who have them that they can apply for other parties.

To lead offical appraisals or provide official training recognized by the CMMI Institute, a person must be specifically certified to do so, and their license fees must be up-to-date.

There are no designations conferred on individuals specific to CMMI level ratings. In other words, John Q. Public cannot claim that they, as a person, are "CMMI Level X". The organizational unit Mr. Public worked for can make that claim, but Mr. Public as an individual cannot. Anyone claiming something ridiculous like that (we've seen this on many resumes) represents a gross misunderstanding by the individual and/or a terrible lack of communication/training by the organization.

Also, to be clear, taking CMMI courses does not create any official designation as a "certified" or "authorized" CMMI consultant. (We've seen that too.)

Please refer to the CMMI Institute's learning site for further information.

license to the CMMI viewer

Training FAQs

Is there required training to "do" CMMI?

A: That depends on what you want to accomplish.

Crash Course

CMMI Associate

Foundations / Fundamentals

Building Excellence

Lead Appraiser

High Maturity

Who can provide CMMI-related training?

A: The CMMI Institute itself, and people certified by the CMMI Institute *and* working through a Partner can deliver any training they are authorized to deliver—if the expectation is that there will be some official registration of the that training event. If there is no such expectation of a Certificate of Completion, or, if there is no intention of using the training as a pre-requisite to future activities, the training is not controlled by the CMMI Institute since they would never know about it. Be sure to be clear with whoever you are receiving the training from about their authority to deliver the expected outcome. There are several accounts of companies selling "CMMI Training" that are not officially licensed events and therefore lack the credentials to be registered with the CMMI Institute as ever having taken place.

At this time, the CMMI Institute is the only source for official CMMI-related model training materials and registration. The CMMI Institute also controls the exams.

What sort of CMMI-related training is there?

A: Please go here for training information.

How can we learn about the appraisal process?

A: For that we have some bad news.
There are only four ways to learn about the appraisal process. One of them is not recommended, one requires a lot of commitment, and a you wouldn't be here if you were doing the third. This leaves the fourth. See here:

Ask a certified individual to share the CMMI Appraisal Method Definition Document with you and study them.
Go through all the training requirements of becoming a Lead Appraiser.
Go through an appraisal.
Hire someone who has done #2 to explain it you.