The Software CMM [Paulk et al 1993] is a five-level model that describes good engineering and management practices and prescribes improvement priorities for software organizations [Paulk 2001]. The intent of the CMM is to provide areas of focus (called Key Process Areas or KPAs) for software organizations that have proven in many software organizations to lead to excellence in software development. The Software Engineering Institute also provides standard guidelines for assessment, so that a third-party assessor can evaluate an organization and produce a report that outlines the maturity of the organization's processes. The combination of the CMM model and objective third-party assessments means that an organization can at any time have an understanding of its current capabilities plus the types of activities it must focus on to move to the next level. Hence, the CMM is intended to provide a general framework for planning and measuring the capability of a software organization. The CMM does not specify or mandate actual development processes, it merely specifies what to do in general terms.
The five maturity levels of the CMM and the KPAs associated with each level of maturity are shown in Table A3-1. CMM level 1 organizations are characterized by chaotic processes that require heroism to complete software projects. At the other extreme, CMM level 5 organizations have competence in all the KPAs, established processes, and are continually improving their processes.
Because the CMM does not specify the actual processes that should be used in software development, CMM 5 maturity does not necessarily equate with software quality or sustainability. It usually does, but that is more the result of the methods put in place by the people who designed the processes and their hard work. Also, in my experience at any large company, there is a great deal of variability in the quality of work between teams. Hence, CMM 5 is not a guarantee that the traditional code-then-fix method not used. I have worked with CMM 5 companies as subcontractors, and my experience is that while the majority of them produced excellent work, there were some groups that frankly shocked me with the poor quality of the work they produced.