Relationship between CMMI Maturity Levels and ISO/IEC

15504 Processes Capability Profiles

Antanas Mitašiūnas,Saulius Ragaišis

Faculty of Mathematics and Informatics,

Vilnius University, Lithuania

Baltic DB&IS 2006

Vilnius, 2006-07-04

Purpose

To detail and adjust the relationship between

CMMI maturity levels and

ISO/IEC 15504 processes capability profiles

Main Concepts

(Software) Process: the entirety of activities performed to develop and/or maintain software products and/or provide software services.

Process Area: the set of activities that, when performed collectively, are important for making software process improvement, i.e. activities are grouped according to contribution to process capability.

(Named) Process: the set of activities grouped according their goals in software life cycle.

Process Areas (SW-CMM)

Named Processes (ISO/IEC 15504)

Main Concepts (2)

Process Capability: the range of expected results that can be achieved by following a process, i.e. ability (probability) to achieve the goals of the process.

Capability Level: the measure in the discrete scale of the achievement of process capability (improvement). Capability levels as a rule apply to a named process’ capability.

Process Maturity: the measure in which the process is managed, defined, quantitatively managed and optimizing.

Maturity Level: Degree of process improvement across a predefined set of process areas in which all goals within the set are attained. Maturity levels apply to an organization’s overall maturity.

Process Capability dependence on Maturity Level

Main Concepts (3)

Software Process Model: definition of the essential elements for assessment of process maturity and/or capability and process improvement.

Staged Software Process Model: provides the means for assessment of the organization’s overall maturity and the predefined sequence of improvements. Result of the assessment is maturity level of the organization (it’s software process). Examples: SW-CMM, CMMI Staged.

Continuous Software Process Model: provides the means for assessment of individual named processes’ (process areas’) capability. Result of the assessment is processes capability profile. Examples: SPICE, ISO/IEC 15504, CMMI Continuous.

Comparison of Models

Provides a predefined sequence of improvements (suitable for ~80% of organizations)

Measurable steps of process improvement are big

Provides a single rating for the organization so enabling comparison of organizations (very suitable for marketing purposes)

Allows you to select the order of improvement that best meets the organization’s business objectives

Improvement of single process could measured

Provides rating for each named process (very suitable for process improvement purposes but it is complicated to compare organizations)

Hot topic of research: target profiles

Staged Model Continuous Model

CMMI Staged Representation

defines 5 maturity levels (ML) and assigns the process areas for them:

ML1: Initial 0 process areas (none)

ML2: Managed 7 process areas (RM, PP, PMC, SAM, MA, PPQA, CM)

ML3: Defined 14 process areas (RD, TS, PI, VER, VAL, OPF, OPD, OT,

IPM, RSKM, IT, ISM, DAR, OEI)ML4: Quantitatively Managed 2 process areas (OPP, QPM)

ML5: Optimizing 2 process areas (OID, CAR)

CMMI Staged Representation (2)

The rating elements in the CMMI are the specific and generic goals.

The rating of goals is performed on the basis of evidence recorded against

each specific and generic practice.

Therefore, the specific and generic practices are "indicators" of process performance and process capability in the terms of ISO 15504.

ISO/IEC 15504 Assessment ModelProcess dimension consists of processes and each

process is defined in terms of its purpose and outcomes.

Capability dimension defines 6 capability levels and thesets of process attributes (PA): Level 0 : Incomplete processLevel 1 : Performed process

PA1.1 Process performance

Level 2 : Managed processPA2.1 Performance management, PA2.2 Work product management

Level 3 : Established processPA3.1 Process definition, PA3.2 Process resource

Level 4 : Predictable processPA4.1 Process measurement, PA4.2 Process control

Level 5 : Optimizing process

PA5.1 Process measurement, PA5.2 Continuous improvement

ISO/IEC 15504 Assessment Model (2)

The process attributes are defined by stating theachievements to be implemented.

The achievement of PA1.1 is measured in terms ofprocess outcomes.

Consequently, the mapping should address for each process:

process outcomes (for level 1) and achievements (for levels 2-5).

Mapping SchemeISO/IEC 15504

Process

PA1.1

Process Area

PA2-PA5

Outcome

Achievement

CMMI

Generic Practice

Specific Practice

Existing Mapping

T.P.Rout, A.Tuffley, B.Cahill. CMMI Evaluation: Capability Maturity Model Integration Mapping to ISO/IEC 15504 2:1998, Software Quality Institute, Griffith University, Brisbane, 2001.

high level relationship is established between CMMI maturity levels and ISO/IEC 15504 processes capability profiles

It is referenced in:• Han van Loon. Process Assessment and ISO/IEC 15504. A Reference Book. Springer, 2004.

• Han van Loon. Process Assessment and Improvement. A Practical guide for

Managers, Quality Professionals and assessors. Springer, 2004.

Existing Mapping (2)

CUS.1.1 Acquisition Preparation Process

CUS.1.2 Supplier Selection Process

CUS.1.3 Supplier Monitoring Process

CUS.1.4 Customer Acceptance Process

CUS.2 Supply Process

CUS.3 Requirements Elicitation Process

CUS.4.1 Operational Use Process

CUS.4.2 Customer Support Process

ENG.1.1 System requirements analysis and design process

ENG.1.2 Software requirements analysis process

ENG.1.3 Software design process

ENG.1.4 Software construction process

ENG.1.5 Software integration process

ENG.1.6 Software testing process

ENG.1.7 System integration and testing process

ENG.2 System and software maintenance process

SUP.1 Documentation Process

SUP.2 Configuration Management Process

SUP.3 Quality Assurance Process

SUP.4 Verification Process

SUP.5 Validation Process

SUP.6 Joint Review Process

SUP.7 Audit Process

SUP.8 Problem Resolution Process

MAN.1 Management Process

MAN.2 Project Management Process

MAN.3 Quality Management

MAN.4 Risk Management

ORG.1 Organizational alignment process

ORG.2.1 Process establishment process

ORG.2.2 Process assessment process

ORG.2.3 Process improvement process

ORG.3 Human Resource Management process

ORG.4 Infrastructure process

ORG.5 Measurement Process

ORG.6 Reuse Process

CL1 CL2ML2

CL1 CL2ML3

CL3 CL1 CL2ML4

CL3 CL4 CL1 CL2ML5CL3 CL4 CL5

Existing Mapping (3)

Only high level relationship has been established:

- capability profile for “maturity level N” includes only processes with capability level N

- there are not included the processes that do not achieve the capability level N even if some of their outcomes and achievements are addressed during mapping

- detailed correspondence between the models, including all processes and detailed grading of their capability achieved is desired

The capability profiles presented for maturity levels 4 and 5 are doubtful

New Mapping

Processes Attributes (PA) achievements are expressed in grades using the scale:

N (Not performed/achieved): <= 15 %

P (Partial performance/achievement):15 % < and <= 50 %

L (Large performance/achievement):50 % < and <= 85 %

F (Full performance/achievement):85 % <

New Mapping (2)

CUS.1.1 Acquisition Preparation Process

CUS.1.2 Supplier Selection Process

CUS.1.3 Supplier Monitoring Process

CUS.1.4 Customer Acceptance Process

CUS.2 Supply Process

CUS.3 Requirements Elicitation Process

CUS.4.1 Operational Use Process

CUS.4.2 Customer Support Process

ENG.1.1 System requirements analysis and design process

ENG.1.2 Software requirements analysis process

ENG.1.3 Software design process

ENG.1.4 Software construction process

ENG.1.5 Software integration process

ENG.1.6 Software testing process

ENG.1.7 System integration and testing process

ENG.2 System and software maintenance process

SUP.1 Documentation Process

SUP.2 Configuration Management Process

SUP.3 Quality Assurance Process

SUP.4 Verification Process

SUP.5 Validation Process

SUP.6 Joint Review Process

SUP.7 Audit Process

SUP.8 Problem Resolution Process

MAN.1 Management Process

MAN.2 Project Management Process

MAN.3 Quality Management

MAN.4 Risk Management

ORG.1 Organizational alignment process

ORG.2.1 Process establishment process

ORG.2.2 Process assessment process

ORG.2.3 Process improvement process

ORG.3 Human Resource Management process

ORG.4 Infrastructure process

ORG.5 Measurement Process

ORG.6 Reuse Process

CL1 CL2ML2

N LP F

CL1 CL2ML3

N LP F

CL3 CL1 CL2ML4

N LP F

CL3 CL1 CL2ML5

N LP F

CL3

CMMI Target Profiles and Equivalent Staging

Name ML CL1 CL2 CL3 CL4 CL5

Requirements Management 2

Measurement and Analysis 2

Project Monitoring and Control 2

Project Planning 2

Process and Product Quality Assurance 2

Supplier Agreement Management 2

Configuration Management 2

Target

Profile

2

Decision Analysis and Resolution 3

Product Integration 3

Requirements Development 3

Technical Solution 3

Validation 3

Verification 3

Organizational Process Definition 3

Organizational Process Focus 3

Integrated Project Management 3

Risk Management 3

Organizational Training 3

Target

Profile

3

Organizational Process Performance 4

Quantitative Project Management 4

Target

Profile 4

Organizational Innovation and Deployment 5

Causal Analysis and Resolution 5

Target

Profile 5

Conclusions

The following research results have been gained:

all ISO/IEC 15504 processes addressed by key processes areas of CMMI maturity levels are included into corresponding processes capability profiles (previous mapping results have included into capability

profiles only processes that achieve the same capability level as the maturity level mapped);

the allocation of ISO/IEC 15504 processes to maturity levels is adjusted (e.g. ORG.4 Infrastructure process has been reallocated from the

capability profile corresponding maturity level 4 to the capability profile corresponding maturity level 3);

the processes’ capability ensured by CMMI maturity levels 4 and 5 is revised (capability levels 4 and 5 are not included in the mapping results

because maturity levels 4 and 5 of CMMI, as of a model, does not allow to state that anyone of ISO/IEC 15504 processes should have the capability level 4 or 5; of course, if the organization has maturity level 4 or 5 there at least some processes of the capability level 4 or 5).

Further investigation

could be oriented to:

composition of ISO/IEC 12207:2002-2004 processes capability profiles for CMMI maturity levels;

translation of organization process assessment results according to the model of one architecture to the assessment according to other architecture;

definition of minimal processes capability profiles ensuring each CMMI maturity level.