Capability Maturity Model (CMM) & it’s Levels in Software Engineering

What is CMM?

Capability Maturity Model is used as a benchmark to measure the maturity of an organization’s software process.

CMM was developed at the Software engineering institute in the late 80’s. It was developed as a result of a study financed by the U.S Air Force as a way to evaluate the work of subcontractors. Later based on the CMM-SW model created in 1991 to assess the maturity of software development, multiple other models are integrated with CMM-I they are

Capability Maturity Model

What is Capability Maturity Model (CMM) Levels?

  1. Initial
  2. Repeatable/Managed
  3. Defined
  4. Quantitatively Managed
  5. Optimizing

Capability Maturity Model (CMM) Levels

What happens at different levels of CMM?

Levels Activities Benefits
Level 1 Initial
  • At level 1, the process is usually chaotic and ad hoc
  • A capability is characterized on the basis of the individuals and not of the organization
  • Progress not measured
  • Products developed are often schedule and over budget
  • Wide variations in the schedule, cost, functionality, and quality targets
None. A project is Total Chaos
Level 2 Managed
  • Requirement Management
  • Estimate project parameters like cost, schedule, and functionality
  • Measure actual progress
  • Develop plans and process
  • Software project standards are defined
  • Identify and control products, problem reports changes, etc.
  • Processes may differ between projects
  • Processes become easier to comprehend
  • Managers and team members spend less time in explaining how things are done and more time in executing it
  • Projects are better estimated, better planned and more flexible
  • Quality is integrated into projects
  • Costing might be high initially but goes down overtime
  • Ask more paperwork and documentation
Level-3 Defined
  • Clarify customer requirements
  • Solve design requirements, develop an implementation process
  • Makes sure that product meets the requirements and intended use
  • Analyze decisions systematically
  • Rectify and control potential problems
  • Process Improvement becomes the standard
  • Solution progresses from being “coded” to being “engineered”
  • Quality gates appear throughout the project effort with the entire team involved in the process
  • Risks are mitigated and don’t take the team by surprise
Level-4 Quantitatively Managed
  • Manages the project’s processes and sub-processes statistically
  • Understand process performance, quantitatively manage the organization’s project
  • Optimizes Process Performance across the organization
  • Fosters Quantitative Project Management in an organization.
Level-5 Optimizing
  • Detect and remove the cause of defects early
  • Identify and deploy new tools and process improvements to meet needs and business objectives
  • Fosters Organizational Innovation and Deployment
  • Gives impetus to Causal Analysis and Resolution

Following diagram, gives a pictorial representation of what happens at different CMM level

Different Levels of CMM

How long does it Take to Implement CMM?

CMM is the most desirable process to maintain the quality of the product for any software development company, but its implementation takes little longer than what is expected.

  • CMM implementation does not occur overnight
  • It’s just not merely a “paperwork.”
  • Typical times for implementation is
  • 3-6 months -> for preparation
  • 6-12 months -> for implementation
  • 3 months -> for assessment preparation
  • 12 months ->for each new level

Internal Structure of CMM

Each level in CMM is defined into key process area or KPA, except for level-1. Each KPA defines a cluster of related activities, which when performed collectively achieves a set of goals considered vital for improving software capability

For different CMM levels, there are set of KPA’s, for instance for CMM model-2, KPA are

  • REQM- Requirement Management
  • PP- Project Planning
  • PMC- Project Monitoring and Control
  • SAM- Supplier Agreement Management
  • PPQA-Process and Quality Assurance
  • CM-Configuration Management

Likewise, for other CMM models, you have specific KPA’s. To know whether implementation of a KPA is effective, lasting and repeatable, it is mapped on following basis

  1. Commitment to perform
  2. Ability to perform
  3. Activities perform
  4. Measurement and Analysis
  5. Verifying implementation

Limitations of CMM Models

  • CMM determines what a process should address instead of how it should be implemented
  • It does not explain every possibility of software process improvement
  • It concentrates on software issues but does not consider strategic business planning, adopting technologies, establishing product line and managing human resources
  • It does not tell on what kind of business an organization should be in
  • CMM will not be useful in the project having a crisis right now

Why Use CMM?

Today CMM act as a “seal of approval” in the software industry. It helps in various ways to improve the software quality.

  • It guides towards repeatable standard process and hence reduce the learning time on how to get things done
  • Practicing CMM means practicing standard protocol for development, which means it not only helps the team to save time but also gives a clear view of what to do and what to expect
  • The quality activities gel well with the project rather than thought of as a separate event
  • It acts as a commuter between the project and the team
  • CMM efforts are always towards the improvement of the process


CMM was first introduced in late 80’s in U.S Air Force to evaluate the work of subcontractors. Later on, with improved version, it was implemented to track the quality of the software development system.

The entire CMM level is divided into five levels.

  • Level 1 (Initial): Where requirements for the system are usually uncertain, misunderstood and uncontrolled. The process is usually chaotic and ad-hoc.
  • Level 2 (Managed): Estimate project cost, schedule, and functionality. Software standards are defined
  • Level 3 (Defined): Makes sure that product meets the requirements and intended use
  • Level 4 (Quantitatively Managed): Manages the project’s processes and sub-processes statistically
  • Level 5 (Maturity): Identify and deploy new tools and process improvements to meet needs and business objectives