Capability Maturity Model

The Capability Maturity Model (CMM) is a framework to analyze and improve the maturity of an organization’s software development processes.

In the 1980s, several US military projects, involving software subcontractors, ran over-budget and late, if at all. To learn why, the US Air Force funded a study by the Software Engineering Institute (SEI) at Carnegie Mellon University (CMU). Active development on the model began in 1986 when Watts Humphrey joined the SEI, after retiring from IBM. Humphreys had already been developing maturity models for IT in the later stages of his career at IBM. He has been called the "father of software quality".

Watts Humphrey’s Capability Maturity Model (CMM) was first published in 1988, and as a book, Managing the Software Process, in 1989.

The term "maturity" relates to the degree of formality and optimization of processes. The most immature software development processes are ad hoc, while the most mature are predictable and efficient, and continuously improving based on feedback loops.

The CMM describes five levels of process maturity:

  1. Initial: Ad hoc chaotic, undocumented processes.

  2. Repeatable: The process is at least documented sufficiently that it can be repeated.

  3. Defined: The process is a standard business process.

  4. Managed (aka. Capable): The process is optimized to achieve quantifiable metrics.

  5. Optimizing (aka. Efficient): The process incorporates continuous improvement.

There are other aspects to the CMM, but it is the concept of these five levels of process maturity that is the most widely cited.

In 2006, the SEI developed an update to the CMM, known as the Capability Maturity Model Integration (CMMI). It has since been revised in 2010 (v1.3), 2018 (v2.0), and 2023 (v3.0). It is still based on the original five levels of maturity defined in the CMM.

The Standard CMMI Appraisal Method for Process Improvement (SCAMPI) is the name of the SEI’s method to "appraise" organizations against CMMI, and so reveal strengths and weaknesses in current processes. SCAMPI has been used in internal process improvement programs, and also as a basis for evaluating prospective suppliers.

Other maturity models have been developed, using the CMM as a basis, including the People Capability Maturity Model (PCMM) and the Testing Maturity Model.

There have been a few humorous extensions to the CMM. Anthony Finkelstein’s 1992 ACM paper titled "A Software Process Immaturity Model" stated that many "organizations lie well below the merely chaotic" and added levels 0, -1, and -2 to the CMM. In 1996, Capt. Tom Schorsch of the US Air Force published an article in Cross Talk magazine titled "The Capability Im-Maturity Model (CIMM)", in which he changed the names of Finkelstein’s and added level -3:

  • 0. Negligent: The organization makes much fanfare about implementing proper processes but lacks the capability to carry through the necessary changes.

  • -1. Obstructive: Adherence to process is the measure of success. But the processes tend to be ineffective and counterproductive, obstructing rather than enabling the organization’s ability to deliver.

  • -2. Contemptuous: The organization’s ineffectiveness has become more widely known. In response the organization turns a blind eye, or actively attempts to neutralize, the unfavorable publicity. Measurements are fudged to make the organization look better than it really is. For example, certifications of best practice are presented as evidence that the organization is performing optimally.

  • -3. Undermining: The organization routinely works to downplay, and even sabotage, the efforts of rival organizations, especially those successfully implementing processes common to CMM level 2 and higher.