CMMI® Maturity Levels
| ||||||
| CMMI, CMM, and Capability Maturity Model are registered in the U.S. Patent and Trademark Office. |
The information below is taken directly from CMMI® for Development v1.2 pages 35 - 40.
Understanding Maturity Levels
To support those using the staged representation, all CMMI models reflect maturity levels in their design and content. A maturity level consists of
related specific and generic practices for a predefined set of process areas that improve the organization’s overall performance. The maturity level of an
organization provides a way to predict an organization’s performance in a given discipline or set of disciplines. Experience has shown that
organizations do their best when they focus their process improvement efforts on a manageable number of process areas at a time and that those
areas require increasing sophistication as the organization improves.
A maturity level is a defined evolutionary plateau for organizational process improvement. Each maturity level matures an important subset of the
organization’s processes, preparing it to move to the next maturity level. The maturity levels are measured by the achievement of the specific and
generic goals associated with each predefined set of process areas.
There are five maturity levels, each a layer in the foundation for ongoing process improvement, designated by the numbers 1 through 5:
1. Initial
2. Managed
3. Defined
4. Quantitatively Managed
5. Optimizing
Remember that maturity levels 2 through 5 use the same terms as capability levels 2 through 5. This was intentional because the concepts of maturity
levels and capability levels are complementary. Maturity levels are used to characterize organizational improvement relative to a set of process areas,
and capability levels characterize organizational improvement relative to an individual process area.
Maturity Level 1: Initial
At maturity level 1, processes are usually ad hoc and chaotic. The organization usually does not provide a stable environment to support the
processes. Success in these organizations depends on the competence and heroics of the people in the organization and not on the use of proven
processes. In spite of this chaos, maturity level 1 organizations often produce products and services that work; however, they frequently exceed their
budgets and do not meet their schedules.
Maturity level 1 organizations are characterized by a tendency to over commit, abandonment of processes in a time of crisis, and an inability to repeat
their successes.
Maturity Level 2: Managed
At maturity level 2, the projects of the organization have ensured that processes are planned and executed in accordance with policy; the projects
employ skilled people who have adequate resources to produce controlled outputs; involve relevant stakeholders; are monitored, controlled, and
reviewed; and are evaluated for adherence to their process descriptions. The process discipline reflected by maturity level 2 helps to ensure that
existing practices are retained during times of stress. When these practices are in place, projects are performed and managed according to their
documented plans.
At maturity level 2, the status of the work products and the delivery of services are visible to management at defined points (e.g., at major milestones
and at the completion of major tasks). Commitments are established among relevant stakeholders and are revised as needed. Work products are
appropriately controlled. The work products and services satisfy their specified process descriptions, standards, and procedures.
Maturity Level 3: Defined
At maturity level 3, processes are well characterized and understood, and are described in standards, procedures, tools, and methods. The
organization’s set of standard processes, which is the basis for maturity level 3, is established and improved over time. These standard processes are
used to establish consistency across the organization. Projects establish their defined processes by tailoring the organization’s set of standard
processes according to tailoring guidelines. (See the glossary for a definition of “organization’s set of standard processes.”)
A critical distinction between maturity levels 2 and 3 is the scope of standards, process descriptions, and procedures. At maturity level 2, the
standards, process descriptions, and procedures may be quite different in each specific instance of the process (e.g., on a particular project). At
maturity level 3, the standards, process descriptions, and procedures for a project are tailored from the organization’s set of standard processes to
suit a particular project or organizational unit and therefore are more consistent, except for the differences allowed by the tailoring guidelines.
Another critical distinction is that at maturity level 3, processes are typically described more rigorously than at maturity level 2. A defined process clearly
states the purpose, inputs, entry criteria, activities, roles, measures, verification steps, outputs, and exit criteria. At maturity level 3, processes are
managed more proactively using an understanding of the interrelationships of the process activities and detailed measures of the process, its work
products, and its services.
At maturity level 3, the organization must further mature the maturity level 2 process areas. The generic practices associated with generic goal 3 that
were not addressed at maturity level 2 are applied to achieve maturity level 3.
Maturity Level 4: Quantitatively Managed
At maturity level 4, the organization and projects establish quantitative objectives for quality and process performance and use them as criteria in
managing processes. Quantitative objectives are based on the needs of the customer, end users, organization, and process implementers. Quality and
process performance is understood in statistical terms and is managed throughout the life of the processes.
For selected subprocesses, detailed measures of process performance are collected and statistically analyzed. Quality and process-performance
measures are incorporated into the organization’s measurement repository to support fact-based decision making. Special causes of process variation
are identified and, where appropriate, the sources of special causes are corrected to prevent future occurrences.
A critical distinction between maturity levels 3 and 4 is the predictability of process performance. At maturity level 4, the performance of processes is
controlled using statistical and other quantitative techniques, and is quantitatively predictable. At maturity level 3, processes are typically only
qualitatively predictable.
Maturity Level 5: Optimizing
At maturity level 5, an organization continually improves its processes based on a quantitative understanding of the common causes of variation
inherent in processes. (See the definition of “common cause of process variation” in the glossary.)
Maturity level 5 focuses on continually improving process performance through incremental and innovative process and technological improvements.
Quantitative process improvement objectives for the organization are established, continually revised to reflect changing business objectives, and used
as criteria in managing process improvement. The effects of deployed process improvements are measured and evaluated against the quantitative
process improvement objectives. Both the defined processes and the organization’s set of standard processes are targets of measurable improvement
activities.
A critical distinction between maturity levels 4 and 5 is the type of process variation addressed. At maturity level 4, the organization is concerned with
addressing special causes of process variation and providing statistical predictability of the results. Although processes may produce predictable
results, the results may be insufficient to achieve the established objectives. At maturity level 5, the organization is concerned with addressing common
causes of process variation and changing the process (to shift the mean of the process performance or reduce the inherent process variation
experienced) to improve process performance and to achieve the established quantitative process improvement objectives.
Advancing through Maturity Levels
Organizations can achieve progressive improvements in their organizational maturity by achieving control first at the project level and continuing to the
most advanced level—organization-wide continuous process improvement—using both quantitative and qualitative data to make decisions.
Since improved organizational maturity is associated with improvement in the range of expected results that can be achieved by an organization, it is
one way of predicting the general outcomes of the organization’s next project. For instance, at maturity level 2, the organization has been elevated
from ad hoc to disciplined by establishing sound project management. As your organization achieves the generic and specific goals for the set of
process areas in a maturity level, you are increasing your organizational maturity and reaping the benefits of process improvement. Because each
maturity level forms a necessary foundation for the next level, trying to skip maturity levels is usually counterproductive.
At the same time, you must recognize that process improvement efforts should focus on the needs of the organization in the context of its business
environment and that process areas at higher maturity levels may address the current needs of an organization or project. For example, organizations
seeking to move from maturity level 1 to maturity level 2 are frequently encouraged to establish a process group, which is addressed by the
Organizational Process Focus process area that resides at maturity level 3. Although a process group is not a necessary characteristic of a maturity
level 2 organization, it can be a useful part of the organization’s approach to achieving maturity level 2.
This situation is sometimes characterized as establishing a maturity level 1 process group to bootstrap the maturity level 1 organization to maturity
level 2. Maturity level 1 process improvement activities may depend primarily on the insight and competence of the process group staff until an
infrastructure to support more disciplined and widespread improvement is in place.
Organizations can institute specific process improvements at any time they choose, even before they are prepared to advance to the maturity level at
which the specific practice is recommended. In such situations, however, organizations should understand that the success of these improvements is
at risk because the foundation for their successful institutionalization has not been completed. Processes without the proper foundation may fail at the
very point they are needed most—under stress.
A defined process that is characteristic of a maturity level 3 organization can be placed at great risk if maturity level 2 management practices are
deficient. For example, management may commit to a poorly planned schedule or fail to control changes to baselined requirements. Similarly, many
organizations prematurely collect the detailed data characteristic of maturity level 4, only to find the data uninterpretable because of inconsistencies in
processes and measurement definitions.
Another example of using processes associated with higher maturity-level process areas is in the building of products. Certainly, we would expect
maturity level 1 organizations to perform requirements analysis, design, integration, and verification. These activities are not described until maturity
level 3, however, where they are described as the coherent, well-integrated engineering processes that complement a maturing project management
capability, put in place so that the engineering improvements are not lost by an ad hoc management process.
Understanding Maturity Levels
To support those using the staged representation, all CMMI models reflect maturity levels in their design and content. A maturity level consists of
related specific and generic practices for a predefined set of process areas that improve the organization’s overall performance. The maturity level of an
organization provides a way to predict an organization’s performance in a given discipline or set of disciplines. Experience has shown that
organizations do their best when they focus their process improvement efforts on a manageable number of process areas at a time and that those
areas require increasing sophistication as the organization improves.
A maturity level is a defined evolutionary plateau for organizational process improvement. Each maturity level matures an important subset of the
organization’s processes, preparing it to move to the next maturity level. The maturity levels are measured by the achievement of the specific and
generic goals associated with each predefined set of process areas.
There are five maturity levels, each a layer in the foundation for ongoing process improvement, designated by the numbers 1 through 5:
1. Initial
2. Managed
3. Defined
4. Quantitatively Managed
5. Optimizing
Remember that maturity levels 2 through 5 use the same terms as capability levels 2 through 5. This was intentional because the concepts of maturity
levels and capability levels are complementary. Maturity levels are used to characterize organizational improvement relative to a set of process areas,
and capability levels characterize organizational improvement relative to an individual process area.
Maturity Level 1: Initial
At maturity level 1, processes are usually ad hoc and chaotic. The organization usually does not provide a stable environment to support the
processes. Success in these organizations depends on the competence and heroics of the people in the organization and not on the use of proven
processes. In spite of this chaos, maturity level 1 organizations often produce products and services that work; however, they frequently exceed their
budgets and do not meet their schedules.
Maturity level 1 organizations are characterized by a tendency to over commit, abandonment of processes in a time of crisis, and an inability to repeat
their successes.
Maturity Level 2: Managed
At maturity level 2, the projects of the organization have ensured that processes are planned and executed in accordance with policy; the projects
employ skilled people who have adequate resources to produce controlled outputs; involve relevant stakeholders; are monitored, controlled, and
reviewed; and are evaluated for adherence to their process descriptions. The process discipline reflected by maturity level 2 helps to ensure that
existing practices are retained during times of stress. When these practices are in place, projects are performed and managed according to their
documented plans.
At maturity level 2, the status of the work products and the delivery of services are visible to management at defined points (e.g., at major milestones
and at the completion of major tasks). Commitments are established among relevant stakeholders and are revised as needed. Work products are
appropriately controlled. The work products and services satisfy their specified process descriptions, standards, and procedures.
Maturity Level 3: Defined
At maturity level 3, processes are well characterized and understood, and are described in standards, procedures, tools, and methods. The
organization’s set of standard processes, which is the basis for maturity level 3, is established and improved over time. These standard processes are
used to establish consistency across the organization. Projects establish their defined processes by tailoring the organization’s set of standard
processes according to tailoring guidelines. (See the glossary for a definition of “organization’s set of standard processes.”)
A critical distinction between maturity levels 2 and 3 is the scope of standards, process descriptions, and procedures. At maturity level 2, the
standards, process descriptions, and procedures may be quite different in each specific instance of the process (e.g., on a particular project). At
maturity level 3, the standards, process descriptions, and procedures for a project are tailored from the organization’s set of standard processes to
suit a particular project or organizational unit and therefore are more consistent, except for the differences allowed by the tailoring guidelines.
Another critical distinction is that at maturity level 3, processes are typically described more rigorously than at maturity level 2. A defined process clearly
states the purpose, inputs, entry criteria, activities, roles, measures, verification steps, outputs, and exit criteria. At maturity level 3, processes are
managed more proactively using an understanding of the interrelationships of the process activities and detailed measures of the process, its work
products, and its services.
At maturity level 3, the organization must further mature the maturity level 2 process areas. The generic practices associated with generic goal 3 that
were not addressed at maturity level 2 are applied to achieve maturity level 3.
Maturity Level 4: Quantitatively Managed
At maturity level 4, the organization and projects establish quantitative objectives for quality and process performance and use them as criteria in
managing processes. Quantitative objectives are based on the needs of the customer, end users, organization, and process implementers. Quality and
process performance is understood in statistical terms and is managed throughout the life of the processes.
For selected subprocesses, detailed measures of process performance are collected and statistically analyzed. Quality and process-performance
measures are incorporated into the organization’s measurement repository to support fact-based decision making. Special causes of process variation
are identified and, where appropriate, the sources of special causes are corrected to prevent future occurrences.
A critical distinction between maturity levels 3 and 4 is the predictability of process performance. At maturity level 4, the performance of processes is
controlled using statistical and other quantitative techniques, and is quantitatively predictable. At maturity level 3, processes are typically only
qualitatively predictable.
Maturity Level 5: Optimizing
At maturity level 5, an organization continually improves its processes based on a quantitative understanding of the common causes of variation
inherent in processes. (See the definition of “common cause of process variation” in the glossary.)
Maturity level 5 focuses on continually improving process performance through incremental and innovative process and technological improvements.
Quantitative process improvement objectives for the organization are established, continually revised to reflect changing business objectives, and used
as criteria in managing process improvement. The effects of deployed process improvements are measured and evaluated against the quantitative
process improvement objectives. Both the defined processes and the organization’s set of standard processes are targets of measurable improvement
activities.
A critical distinction between maturity levels 4 and 5 is the type of process variation addressed. At maturity level 4, the organization is concerned with
addressing special causes of process variation and providing statistical predictability of the results. Although processes may produce predictable
results, the results may be insufficient to achieve the established objectives. At maturity level 5, the organization is concerned with addressing common
causes of process variation and changing the process (to shift the mean of the process performance or reduce the inherent process variation
experienced) to improve process performance and to achieve the established quantitative process improvement objectives.
Advancing through Maturity Levels
Organizations can achieve progressive improvements in their organizational maturity by achieving control first at the project level and continuing to the
most advanced level—organization-wide continuous process improvement—using both quantitative and qualitative data to make decisions.
Since improved organizational maturity is associated with improvement in the range of expected results that can be achieved by an organization, it is
one way of predicting the general outcomes of the organization’s next project. For instance, at maturity level 2, the organization has been elevated
from ad hoc to disciplined by establishing sound project management. As your organization achieves the generic and specific goals for the set of
process areas in a maturity level, you are increasing your organizational maturity and reaping the benefits of process improvement. Because each
maturity level forms a necessary foundation for the next level, trying to skip maturity levels is usually counterproductive.
At the same time, you must recognize that process improvement efforts should focus on the needs of the organization in the context of its business
environment and that process areas at higher maturity levels may address the current needs of an organization or project. For example, organizations
seeking to move from maturity level 1 to maturity level 2 are frequently encouraged to establish a process group, which is addressed by the
Organizational Process Focus process area that resides at maturity level 3. Although a process group is not a necessary characteristic of a maturity
level 2 organization, it can be a useful part of the organization’s approach to achieving maturity level 2.
This situation is sometimes characterized as establishing a maturity level 1 process group to bootstrap the maturity level 1 organization to maturity
level 2. Maturity level 1 process improvement activities may depend primarily on the insight and competence of the process group staff until an
infrastructure to support more disciplined and widespread improvement is in place.
Organizations can institute specific process improvements at any time they choose, even before they are prepared to advance to the maturity level at
which the specific practice is recommended. In such situations, however, organizations should understand that the success of these improvements is
at risk because the foundation for their successful institutionalization has not been completed. Processes without the proper foundation may fail at the
very point they are needed most—under stress.
A defined process that is characteristic of a maturity level 3 organization can be placed at great risk if maturity level 2 management practices are
deficient. For example, management may commit to a poorly planned schedule or fail to control changes to baselined requirements. Similarly, many
organizations prematurely collect the detailed data characteristic of maturity level 4, only to find the data uninterpretable because of inconsistencies in
processes and measurement definitions.
Another example of using processes associated with higher maturity-level process areas is in the building of products. Certainly, we would expect
maturity level 1 organizations to perform requirements analysis, design, integration, and verification. These activities are not described until maturity
level 3, however, where they are described as the coherent, well-integrated engineering processes that complement a maturing project management
capability, put in place so that the engineering improvements are not lost by an ad hoc management process.