Capability Maturity Model Integration (CMMI)

Capability Maturity Model Integration (CMMI) is a process improvement framework developed by Carnegie Mellon University's Software Engineering Institute (SEI) that provides organizations with a structured model for assessing and improving the maturity of their development, engineering, and service delivery processes, rated on a five-level scale.

What is CMMI?

CMMI consolidates several earlier capability maturity models (CMM for software, SECM for systems engineering, IPPD and SA-CMM for management and acquisition) into a unified framework. The current version (CMMI V3.0) encompasses models for Development (CMMI-DEV), Services (CMMI-SVC), and Data Management (CMMI-DMM).

The five maturity levels characterize progressively more disciplined process capability: Level 1 (Initial), processes are unpredictable and reactive; Level 2 (Managed), projects are managed with some discipline and repeatable processes; Level 3 (Defined), standard processes are defined across the organization; Level 4 (Quantitatively Managed), processes are measured and controlled using quantitative methods; Level 5 (Optimizing), continuous process improvement is the organizational norm.

CMMI appraisals are conducted by CMMI Institute-licensed Lead Appraisers using the Standard CMMI Appraisal Method for Process Improvement (SCAMPI). Achieving and maintaining a CMMI appraisal rating (most commonly Level 3) requires significant investment in process documentation, tool implementation, training, and ongoing measurement. Appraisal results are published in the CMMI Institute's Published Appraisal Results database.

Many DoD solicitations, particularly for software development and systems engineering, require bidders to demonstrate CMMI Level 3 appraisal. GSA's ALLIANT 2 vehicle requires CMMI Level 3. The contract for Alliant 3 similarly weights CMMI ratings.

Why CMMI matters for government contractors

CMMI Level 3 or higher is a competitive requirement or strong advantage on many major IT and systems engineering contracts. Contractors without a current CMMI appraisal may be disqualified from proposals that require it, or may score lower in past performance and management approach factors compared to appraisal-holding competitors. CMMI investment typically pays for itself through access to contract vehicles and solicitations that require it.

Example

A defense IT contractor maintains a CMMI Level 3 Development appraisal covering its 200-person engineering organization. When the Army issues an RFP for a $75M software engineering support contract that requires CMMI Level 3, the contractor includes its current appraisal certificate and the Lead Appraiser's summary report in its proposal. Competing firms without a current appraisal must propose to achieve Level 3 within 18 months as a contract condition, a less compelling offer than an existing appraisal.

Frequently Asked Questions

How long does a CMMI appraisal take and what does it cost?

A CMMI Level 3 appraisal for a medium-sized development organization typically takes 3-6 months of preparation and a 2-week on-site appraisal. Total costs, including Lead Appraiser fees, staff preparation time, process documentation, and tooling, commonly range from $200K to $500K depending on organizational size and current process maturity.

How long is a CMMI appraisal valid?

CMMI appraisal results are valid for three years from the date of the appraisal. After three years, organizations must undergo a maintenance appraisal to maintain their certification. Contractors should plan re-appraisal efforts to maintain continuous coverage, as appraisal lapses create eligibility gaps on solicitations requiring current appraisals.

Is CMMI the same as ISO 9001?

No. ISO 9001 is a quality management system standard that certifies an organization's quality processes are documented and followed. CMMI is a process maturity model that characterizes the sophistication and integration of development and engineering processes. Both may be required on some contracts, but they are different frameworks addressing different aspects of organizational capability.

What is the difference between CMMI-DEV and CMMI-SVC?

CMMI-DEV (Development) focuses on product and system development processes, requirements management, design, coding, testing, and delivery. CMMI-SVC (Services) focuses on service delivery processes, service level management, incident resolution, and continuous service improvement. IT services firms often pursue CMMI-SVC; defense system developers pursue CMMI-DEV.