Models

What is a model and why do I have to use one? A model is considered a guideline of best practices found by studying other, highly functioning and successful organizations. A model does not contain the steps needed or the sequence of steps needed to implement a process improvement program. The model used simply says, "this is a good thing to do." For example, the Project Planning process area suggests that you write a project plan. The Requirements Management process area recommends that you track changes to requirements.

There are many models to choose from, depending on the problems in your organization that you want to solve. Why use a model? Well, we have worked in many organizations that just decided to "improve." Without using a model as your basis of reference, you have nothing around which to plan your improvement, and nothing against which to measure your results. Some organizations have decided they did not like the guidelines in the models used for process improvement in the industry, so they created their own. Most of these organizations failed. It is not easy to write a model. It takes a long time and it costs a lot of money. And remember that the models are summaries of the best practices of effective, successful organizations. So, it would behoove someone to follow most of the practices documented in these models. Most models allow an organization to substitute alternative practices for those practices in the chosen model that do not fit the organization. But beware the more alternatives you select, the more you deviate from best practices in a model, the less likely you are of improving the problems in your organization.

A brief overview of some of the more frequently used models follows . Do not consider this overview exhaustive, as we simply summarize the basic thrust of each model. We do not purport to be experts in all of these models. Those of you who are experts in any of the models may take exception to some of our statements. These statements are offered , once again, only as high-level summarizations.

"In the beginning," there were ISO and the CMM. ISO stands for International Standards Organization. The ISO 9000/9001 series generates a fundamental quality management framework. The ISO 9000 series is a set of documents that discusses quality systems to use when instituting quality assurance in an organization or enterprise. ISO 9000 itself is a guideline that directs the user as to which set of documents to use and the interrelationship of quality concepts. ISO 9001, 9002, and 9003 deal with external quality assurance pursuits while ISO 9004 deals with internal quality assurance. ISO 9001 is used to ensure that quality systems are delivered by the supplier during several stages of creation (which may include design, development, production, installation, and servicing ). This document is the most pertinent to software development and maintenance. ISO 9000-3 is used when applying ISO 9001 to the development, supply, and maintenance of software. ISO 9001 requires that a documented quality system be implemented, with procedures and instructions. ISO 9000-3 further specifies that this quality system be integrated throughout the entire life cycle.

The CMM stands for the Capability Maturity Model. Most people call it the CMM for Software. The reason for this appellation is that after the CMM was developed, several more CMMs relating to different areas were generated (e.g., Systems Engineering, Acquisition). The CMM was created to help manage organizations that develop software. The CMM was created by analyzing the activities of highly functioning software organizations; that is, those organizations that consistently delivered software systems to their customers on time, within budget, and that actually worked. These activities became the 316 key practices in the CMM, and the practices themselves were grouped into categories called Key Process Areas. There are 18 Key Process Areas that focus on the best practices found among the organizations reviewed. The Key Process Areas concentrate on such things as managing requirements, managing changes, creating project plans, tracking estimates against actuals, implementing quality assurance activities, instituting peer reviews, and training personnel in processes related to their job duties .

What is the difference between the CMM and ISO? Well, both were developed to improve the quality of systems. ISO was developed in Brussels, Belgium, and related originally to the manufacturing arena. The CMM was developed in the United States for managing the development of software systems. Over the years , the CMM made its journey across the ocean and is now used almost as much internationally as within the United States alone. ISO also "crossed the pond," that is, made inroads into the United States in manufacturing businesses, concentrating most often in the Midwest.

ISO focuses primarily on broader issues of quality within an entire enterprise or company. Executives of these organizations are often interviewed. The main product of ISO is the creation of a quality manual that discusses quality initiatives to be implemented throughout the enterprise. The CMM takes a much more limited view; it focuses only on software- intensive projects. It does not look at an entire enterprise or company. It describes an organization (admittedly, ambiguously) as several projects managed under one director (an example). Interviews in assessments may include an executive manager or two, but mostly focus on project managers and their team members .

If your organization is ISO certified, does that mean you are automatically CMM Level 3? No it is like comparing apples and oranges. If you are CMM Level 3, does that mean you are ISO certified? No. Once again, while the two methods have similar goals, they are very different in implementation and scope. Chapter 4 in ISO 9001 is about five pages in length, while Sections 5, 6, and 7 of ISO 9000-3 are about 11 pages long. The CMM is over 400 pages long. So, clearly, the two models are different.

The models we are most familiar with are the Capability Maturity Model (CMM) for Software and the CMMI. CMM and CMMI implement processes that reflect best practices found in industry. The CMM focuses on the software domain of organizations. However, because the problems with software organizations were deemed to fall mostly in the management area, this book can be, and has been, used not only in software organizations, but broadened to include most management situations.

The model that inspired this book is the Capability Maturity Model Integration (CMMI). The CMMI officially expanded the scope of the CMM from software to the entire enterprise. That expansion includes systems engineering as well as software engineering, integrated product and process development (specialized teams that design and develop systems), and acquisition (procuring systems, and monitoring the procurement and management of contracts awarded).

Other models in use include the Federal Aviation Administration's (FAA's) Integrated CMM, which builds upon the original CMM and other models as they relate to FAA issues. However, parts of this model can also be extracted and used in other business endeavors (not just aviation).

Six Sigma is also being used more and more frequently. Six Sigma attempts to reduce the variation in processes to a very small number. It focuses on improvements and measures that will lower the cost of doing business. Six Sigma consists of defining project goals and objectives; measuring narrow ranges of potential causes and establishing a baseline; analyzing data to identify trends and causes of the deviations; improving the processes at the identified cause level; and controlling the problem.

Some organizations are now merging Six Sigma and CMM/CMMI activities into one process improvement effort. Six Sigma focuses heavily on selecting a limited number of issues, measuring the problem (e.g., number of defects in a product line, excessive time to build a product), and then measuring the results (e.g., the effectiveness) of the fix. CMM/CMMI focuses on implementing best practices found in the industry and changing the infrastructure and culture of an organization. The two can complement one another. However, we feel that Six Sigma is better performed on only those organizations that have already been rated at a strong CMM/CMMI Maturity Level 3 or higher. Six Sigma requires a high degree of sophistication in aligning business objectives with Six Sigma techniques, as well as a high degree of sophistication in other areas of management (e.g., business, quality, process, and change).