The Capability Maturity Model and
ISO 9000 Standards: Similarities and Differences

Table of Contents

• Introduction
• Overview of CMM
• Common Features of KPAs
• CMM Assessment Process
• Benefits of CMM on Software Process Improvement
• ISO 9000 Overview
• ISO Certification Process
• Similarities and Differences
• Conclusion
• Bibliography

Introduction

The Capability Maturity Model (CMM) and the ISO 9000 series of standards share a common concern with quality and process management. The two were created under the notion that to create a quality product, the underlying organization must be a quality driven. The purpose of this report will be to introduce the Capability Maturity Model and ISO 9000 as each relates to software development (ISO 9001), indicating their differences and similarities.

Overview of CMM

The Capability Maturity Model (CMM) is made up of five hierarchical levels that are used to grade an organization's ability to consistently and predictably create high quality software.[1] CMM does this by accessing the extent to which an IT organization uses predictable, manageable processes for building information systems. "By using record keeping and assessment tools based on this model, an IT organization can determine how its processes compare to a theoretical ideal and can see how quickly it is moving toward that ideal."[2] The underlining premise of CMM is that an organization that does not have a defined and standardized software development process is unable to provide a consistent and reliable product. The largest proponent of the Capability Maturity Model is the U.S. Department of Defense (DoD), which uses the model as a baseline to determine whether any specific organizations is qualified to bid on a US Military contract. Incidentally, the Software Engineering Institute (SEI), the author of CMM, was established by, receives its funding and mission from the DOD [3]

The purpose of CMM is to help organizations that produce software, improve the maturity of their software processes. The improvement is conceptualized as an evolutionary path from an AD-HOC, chaotic stage, to mature, disciplined software process. Each level within the CMM framework is referred to as a 'maturity level.' Each maturity level consists of several key processes areas (KPA) that identify requirements/best practices that an organization would need to demonstrate, to be graded at any specific maturity level. Please review Table 1 for detailed information regarding the maturity level framework of CMM.

Common Features of KPAs

KPAs are organized into a set of five common features "that help indicate whether the implementation and institutionalization of a key process area is effective, repeatable, and lasting." [5] The five common features of all KPAs are: Commitment to Perform; Ability to Perform; Activities Performed; Measurement and Analysis; and Verify Implementation. See Table 2 for detailed information about the five common features of KPAs.

CMM Assessment Process

An organization achieves a specific maturity level by means of an assessment, initiated by the organization wishing to be assessed. The assessment can be conducted by the organization being assessed or by an independent agency (SEI or SEI-licensed assessment vendor). The assessment provides feedback to the organization regarding its current software development capabilities and trains the organization on ways to improve its capabilities.[6]

An assessment conducted by a SEI-certified organization logically would be viewed to be more credible and objective that of a self-assessment. However, in a paper by Goldenson and Herbsleb with SEI, found that there is "evidence that people in fact try to answer survey questions honestly." The study, "After the Appraisal: A systematic Survey of Process Improvement, its Benefits, and factors that Influence Success, found 'little difference between the appraised and reported maturity levels, " of submitted information provided to SEI by organizations that had been previously assessed by SEI from 1992 to 1993.[7] However, an additional explanation could be that organizations that show significant statistical difference between an appraised review and a self reported review might be singled out for further study.

Benefits of CMM on Software Process Improvement

ISO 9000 Overview

ISO 9000 is a family of standards, published by the International Organization for Standardization, is a set of five individual, but related international standards on quality management and quality assurance. They are generic and not specific to any particular product or service. ISO provides a certification process to organizations whereby stating to other organization that the certified organization has a Quality Management System in place and that the organization adheres to this system in conducting business. Please refer to Table 5 to a brief review of the ISO 9000 family of standards.

*Of the ISO 9000 series, ISO 9001 is the standard most pertinent to software development and maintenance.[10]

ISO-9000 Standards generally are only used by organizations when: [10]

• The organization must ensure that the supplier conforms to specified requirements during several stages of development, including design, development, production, installation, and servicing.
• To regulate their internal quality system and assure the quality system of their suppliers, and
• when a contract between two parties (the organization + another firm) requires the demonstration of a supplier's capacity to design and supply a product.

An organization can choose to be certified against one of the three quality systems in ISO 9000: ISO 9001, ISO 9002 and ISO 9003. The organization undergoing certification chooses which standard they wish to pursue based on the organizations business processes. None of the standards are considered more important than any one of the others and the organization that would undergo certification would need to identify which standard before pursuing certification. Once an organization chooses to undergo certification, a certified register audits the company to determine compliance with the applicable standard.

Please refer to Table 5, for a typical timetable for an organization preparing for certification.

Only a certified register can award ISO certification. To be a certified register, an organization must be accredited and its auditors must be certified. In the United States, the sole accrediting organization is the Register Accreditation Board.

Similarities and Differences

The Similarities of the Capability Maturity Model to ISO-9000 Standards [12]

• both require that the organization be explicit about what their processes and quality systems are and then act of those processes and systems,
• the organization records and tracks data for objective analysis,
• require strong management support to succeed, and
• provide a structured and measured approach to quality improvement

The Differences Between the Capability Maturity Model to ISO-9000 Standards [12]

Conclusion

In many ways it is very difficult for the casual reader to get beyond the notion of thinking of CMM or ISO-900 Standards as nothing more than a set of prescription's you endure to get a participate with so to get a rating or certification. However, to accept this would be to completely misunderstand the CMM or ISO 9000 models. In a paper sponsored by the State of Washington regarding the Capability Maturity Model, the state said, "CMM is the foundation for systematically building a set of tools, including a maturity questionnaire, which is useful in software process improvement. The essential point to remember is that the model, not the questionnaire, is the basis for improving the software process." (http://www.wa.gov/) In Mark C. Paulk with SEI's review of the differences and similarities of ISO and CMM, he noted first off, both "have a common concern of quality and process management." So, in essence both models are concerned with that to produce quality in software, whether implicitly stated or not, the underlying organizations processes and systems are what dictates whether an organization can deliver a quality software product. That, is much must be considered and reviewed first before an organization can ever hope to produce repeatable, quality driven results.

Bibliography