IT capability levels

At last Friday's open meeting I passed out a description of the Capability Maturity Model developed by the Software Engineering Institute. The CMM is for IT organizations similar in purpose to Six Sigma and Lean Six Sigma for manufacturing organizations.

The CMM maintains that to improve your IT processes, you must:

• manage requirements, risks and configurations;
• plan, monitor and control your projects;
  
• measure and analyze the output of your efforts;
  
• focus on
  
• how well you're following your processes,
• whether the processes are working.
  

To succeed at this, an IT organization must:

• adopt and standardize effective processes,
  
• measure and assess what the processes accomplish,
• focus on process improvement,
  
• dedicate planning, resources, and training to the effort,
• involve stakeholders.
  

How well you do can be expressed in terms of capability levels, of which there are five.

• Our IT processes are mostly at level 1, with some moves towards level 2.
  
• We need to reach level 3, and to consider reaching for level 4 for some mission-critical functions.
• We need to change some of our thinking and our behaviors to have a chance to reach level 3.
  
• The organizational structure we adopt must be one that helps us get there, rather than getting in our way.

One note: focusing on processes and process improvement is not appropriate only for companies like GM, as somebody said at the meeting. We can benefit greatly from it, too.

---

Here's a summary of the capability levels:

Level 1 - Initial

Processes are usually ad hoc and inconsistent across the organization.

• Success depends on the heroics of the people in the organization, and not on the use of proven processes.
  
• In spite of this ad hoc environment, maturity level 1 organizations often produce products and services that work, but often exceed the budget and schedule of their projects.

Level 2 - Repeatable

Software development successes are repeatable, but the processes may not repeat for all the projects in the organization. The organization may use some basic project management to track cost and schedule.

• Process discipline helps ensure that existing practices are retained during times of stress. Project status and the delivery of services are visible to management at defined points (for example, at major milestones and at the completion of major tasks).
• Basic project management processes are established to track cost, schedule, and functionality. The minimum process discipline is in place to repeat earlier successes on projects with similar applications and scope. There is still a significant risk of exceeding cost and time estimates.
  

Level 3 - Defined

The organization’s set of standard processes are established and improved over time. These standard processes are used to establish consistency across the organization. Projects establish their defined processes by the organization’s set of standard processes according to tailoring guidelines.

• The organization’s management establishes process objectives based on the organization’s set of standard processes and ensures that these objectives are appropriately addressed.
• A critical distinction between level 2 and level 3 is the scope of standards, process descriptions, and procedures.
  
• At level 2, the standards, process descriptions, and procedures may be quite different in each specific instance of the process (for example, on a particular project).
  
• At level 3, the standards, process descriptions, and procedures for a project are tailored from the organization’s set of standard processes to suit a particular project or organizational unit.
• Effective project management system is implemented with the help of good project management software.
  

Level 4 - Quantitatively Managed

Using precise measurements, management effectively controls IT efforts. In particular, management can identify ways to adjust and adapt the process to particular projects without measurable losses of quality or deviations from specifications.

• Organizations at this level set quantitative quality goals for both software process and software maintenance. Sub-processes are selected that significantly contribute to overall process performance. These selected sub-processes are controlled using statistical and other quantitative techniques.
• A critical distinction between maturity level 3 and maturity level 4 is the predictability of process performance. At maturity level 4, the performance of processes is controlled using statistical and other quantitative techniques, and is quantitatively predictable. At maturity level 3, processes are only qualitatively predictable.
  

Level 5 - Optimizing

The organization focuses on continually improving process performance through both incremental and innovative technological improvements.

• Quantitative process-improvement objectives for the organization are established, continually revised to reflect changing business objectives, and used as criteria in managing process improvement.
  
• The effects of deployed process improvements are measured and evaluated against the quantitative process-improvement objectives. Both the defined processes and the organization’s set of standard processes are targets of measurable improvement activities.
• Process improvements to address common causes of process variation and measurably improve the organization’s processes are identified, evaluated, and deployed.
• Optimizing processes that are agile, adaptable and innovative depends on the participation of an empowered workforce aligned with the values and objectives of the organization. The organization’s ability to respond rapidly to changes and opportunities is enhanced by finding ways to accelerate and share learning.
• A critical distinction between maturity level 4 and maturity level 5 is the type of process variation addressed.
  
• At maturity level 4, processes are concerned with addressing special causes of process variation and providing statistical predictability of the results. Though processes may produce predictable results, the results may be insufficient to achieve the established objectives.
  
• At maturity level 5, processes are concerned with addressing common causes of process variation and changing the process (that is, shifting the mean of the process performance) to improve process performance (while maintaining statistical probability) to achieve the established quantitative process-improvement objectives.