CMMI V3.0

• admin
• November 20, 2023

Unraveling the complexity of the latest framework || CMMI V3.0

CMMI V3.0 has long kept everyone (consultants and LAs alike) on tenterhooks. In this article, we have attempted to interpret it to save you time. If we start by looking back at 2018, CMMI V2.0 marked a significant change, shifting from traditional process improvement to continuous outcome-based enhancement, leading to notable improvements in quality, productivity, profitability, and efficiency for organizations following CMMI guidelines.

After ruling the roost all these years, In 2023, CMMI V2.0 took a backseat when ISACA unveiled CMMI V3.0, devised by feedback from CMMI partners, end-users, and customers. It positions itself as adept at keeping pace with rapid technological advancements, information expansion, and dynamic global events.

CMMI V3.0 introduces three new domains—Data, People, and Virtual—alongside existing V2.0 domains like Development, Services, Suppliers, Safety, and Security. This updated model appears more promising and flexible, offering numerous potential advantages for tech and product development companies.

How new CMMI can help organizations in meeting various business and stakeholders’ requirements: 

• From a data perspective, it will assist organizations in efficiently building, improving, and measuring their enterprise data management and staff performance.
• With regards to people, it aids in identifying skill gaps, breaking down workforce bottlenecks, and empowering teams to develop skills that contribute to organizational success in human resource management.
• For virtual work, it may improve performance and capabilities by helping organizations understand best practices, tools, and technologies for effective virtual business environments.
• In terms of safety, it enhances organizational safety strategies, performance, and capabilities through assessment, enhancement, and improvement.
• From a security standpoint, it enhances performance and capabilities beyond compliance by assessing, enhancing, and improving security approaches.
• In development, it aids in improving performance and capabilities for organizations developing products, components, and services.
• For services, it improves performance and capabilities for organizations providing various services, including B2B, B2C, standalone, or part of a product offering.
• Regarding supplier management, it improves performance and capabilities for organizations acquiring components, goods, or services by following the latest version.

In summary, by incorporating the new virtual, safety, and security domains, companies can enhance compliance efforts and service delivery optimization. It ensures improvement in various management aspects, including threat handling, hazard analysis, security protocols, and cyber security measures.

It also facilitates inclusion of safety and security-related standards and frameworks referenced or covered in CMMI 3.0, such as NIST Special Publications, IEC Standards, GDPR, ITIL, and ISO Certifications. Additionally, companies can plan to add the People domain, enhancing HR practices for people-centric management.

CMMI provides a structured roadmap for organizations to progress from informal to consistent processes. CMMI Version 3.0 offers advantages for operational optimization, introducing process enhancements. Its updated architecture streamlines the update process, reducing time and resource requirements.

Highlighting the Notable changes and Understanding CMMI Version 3.0– 

Version 3 introduces significant improvements over the previous 2.0 version. Key changes include:

• Revised definition of Maturity Level 2 to cover all Practice Areas at Capability Level 2, indicating a major shift in CMMI’s concepts and principles.
• Supplier Agreement Management includes two additional practices for supplier selection, a significant modification from version 2.0.
• Introduction of new Practice Areas:
  • I. Data Management (DM)
  • II. Data Quality (DQ)
  • III. Enabling Safety (ESAF)
  • IV. Enabling Security (ESEC)
  • V. Enabling Virtual Work (EVW)
  • VI. Managing Security Threats & Vulnerabilities (MST)
  • VII. Workforce Empowerment (WE)

• Minor wording updates are made to existing Practice Areas in the Development and Services model.

Key Features: 

Compared to the previous version, CMMI V3.0 expands its focus beyond Development, Services, or Supplier Agreement Management. It now includes best practices in security, safety, data management, people management, and workforce management, creating a unified and highly adaptable model of best practices.

The new CMMI V3.0 Model comprises four (4) Category Areas, twelve (12) CMMI V2 Capability Areas, and thirty-one (31) Practice Areas.

CMMI V3.0 Category Areas

There are four (4) CMMI Category Areas, which are clusters of interconnected areas specifying practices aimed at enhancing performance within the defined activities of an organization or project.

CMMI V3.0 Capability Areas

In each Category Area, there are clearly defined Capability Areas. These represent coherent sets of related practices commonly encountered by organizations during product and service development and delivery.

CMMI Capability Areas

CMMI V3.0 Maturity Levels

CMMI Maturity Level 1 (ML1) Initial

In CMMI Maturity Level 1 (ML1), organizations align with the intentions of Practice Area(s), although the practices are not fully executed. Typically, the approach is reactive when dealing with issues.

CMMI Maturity Level 2 (ML2) Managed

At CMMI Level 2, organizations actively implement practices to fulfill the intentions of Practice Area(s), proactively addressing issues and achieving program objectives. It’s important to note that CMMI Level 2 does not require the use of organizational assets.

CMMI Maturity Level 3 (ML3) Defined

At CMMI Maturity Level 3, organizations integrate organizational standard practices, assets, and tailoring to systematically address issues, achieve organizational and program objectives, and emphasize overall quality. It’s worth noting that at Maturity Level 3, the following Practice Areas are assessed (Configuration Management does not have any additional practices at Maturity Level 3).

CMMI Core Practice Areas:

• Managing Performance and Management
• Process Quality Assurance
• Configuration Management
• Monitor and Control
• Planning
• Estimating
• Requirements Development and Management
• Governance
• Implementation Infrastructure
• Causal Analysis and Resolution
• Decision Analysis and Resolution
• Organizational Training
• Risk and Opportunity Management
• Process Asset Development
• Peer Reviews
• Process Management
• Verification and Validation

Domain-Specific:

• Development:
  • Technical Solution
  • Product Integration
• Data:
  • Data Management
  • Data Quality
• People:
  • Workforce Empowerment
• Safety:
  • Enabling Safety
• Security:
  • Enabling Security
  • Managing Security Threats & Vulnerabilities
• Services:
  • Continuity
  • Incident Resolution & Prevention
  • Service Delivery Management
  • Strategic Service Management
• Suppliers:
  • Supplier Agreement Management
• Virtual:
  • Enabling Virtual Work

CMMI Maturity Level 4 (ML4) Quantitatively Managed

For advancement to CMMI ML4, organizations must have controlled processes, measured using statistical and quantitative techniques and prediction tools to achieve quality, performance, and objectives. The following Practice Areas are assessed at Maturity Level 4, in addition to those listed above:

• Managing Performance and Management
• Planning
• Governance
• Implementation Infrastructure
• Causal Analysis and Resolution
• Process Management
• Supplier Agreement Management (Suppliers Domain)
• Managing Security Threats and Vulnerabilities (Security Domain)

CMMI Maturity Level 5 (ML5) Optimizing

Finally, to achieve CMMI ML5, organizations need to optimize process improvement through the use of statistical and quantitative techniques. The following Practice Areas are assessed at Maturity Level 5, in addition to those listed above:

• Managing Performance and Management
• Causal Analysis and Resolution

CMMI v3.0 Practice Areas

Primarily in CMMI Version 3.0 there are thirty-one (31) applicable Practice Areas. Key changes between V2.2 and V3.0 are the additions of new Practice Areas (Data Management (DM), Data Quality (DQ), Workforce Empowerment (WE)), the removal of the Supplier Source Selection (SSS) Practice Area, from which context was extracted and incorporated into the Supplier Agreement Management (SAM) Practice Area. Lastly another change to observe is the new name for the Enabling Virtual Solution Delivery (EVSD) to Enabling Virtual Work (EVW).

CMMI V3.0 Practice Areas

 

CMMI V3.0 Vs previous versions || What’s new?

What we gain – When comparing CMMI V3.0 with the predecessors, there’s a significant gain in terms of: 

• A revamped model structure aimed at expediting the process of making updates, thus saving time and resources.
• Introduction of fresh Practice Areas (PA) encompassing safety, security, data management, staff development, and virtual delivery.

The main changes brought-in –

• Maturity Level 2 is redefined to include all Practice Areas at Capability Level 2, marking a significant shift in philosophy.
• Supplier Agreement Management now includes two extra practices for supplier selection compared to the previous model version.
• The introduction of new Practice Areas.
• Apart from some minor wording updates, all other Practice Areas in the Development and Services model remain unchanged.

Changes in the Development and Services Model Practices

• Here are the revisions made to the practices within the DEV and SVC models, which are mostly minor:
  • Removed the word “root” from “root cause” in CAR.
  • Made slight wording adjustments to practices 2.2, 2.3, and 4.1 in GOV.
  • Added a new practice, 4.1, focusing on developing the organization’s capability to utilize statistical and quantitative techniques in II.
  • Minor adjustments were made to practices 3.5, 5.1, 5.2, and 5.3 in MPM.
  • Adjusted the wording of practice 3.5 in OT.
  • Revised the wording in practice 2.6 of PLAN to emphasize feasibility through resource reconciliation.
  • Removed practice 3.5 in PAD as it overlapped with practice 3.3, which now focuses on maintaining and providing access to organizational processes and assets.
  • Made minor wording adjustments to practice 3.6 in PCM.
  • Consolidated practices 2.1 and 2.3 into a single practice (2.1) in RDM, focusing on understanding stakeholder needs and confirming requirements.

Here are the updates made to the Supplier Agreement Management (SAM) practices:

• Practices 2.1 and 2.2 have been reinstated from previous versions.
• SAM now includes:
  • Identifying evaluation criteria, potential suppliers, and distributing supplier requests (2.1).
  • Evaluating supplier responses based on recorded evaluation criteria and selecting suppliers (2.2).
  • Managing supplier activities as specified in the supplier agreement and keeping the agreement updated (2.3).
  • Verifying that the supplier agreement is met before accepting the acquired supplier deliverable (2.4).
  • Managing invoices submitted by the supplier according to the supplier agreements (2.5).
  • Conducting technical reviews of supplier performance activities and selected deliverables (3.1).
  • Managing supplier performance and processes based on criteria in the supplier agreement (3.2).
  • Selecting measures and applying analytical techniques to quantitatively manage suppliers against their performance targets (4.1).

New Available Practice Areas

The main purpose of CMMI V3 is to promote various Process Areas (PAs), including Data Management (DM), Data Quality (DQ), Enabling Safety (ESAF), Enabling Security (ESEC), Enabling Virtual Work (EVW), Managing Security Threats & Vulnerabilities (MST), and Workforce Empowerment (WE). These PAs are optional and are structured around the Plan-Do-Check-Act cycle. However, there’s a concern that organizations might define the activities within these PAs too narrowly, potentially leading to trivial implementations. Over time, it will become clear which organizations adopt these PAs.

So, keeping in mind the entire discussion above, the conclusion can be summarized in the below 2 points:

• The new definition of Maturity Level 2 represents a departure from the original model’s intent.
• Since not many organizations focus on Maturity Level 2, it’s not likely to pose a significant challenge. Some groups that would have aimed for Maturity Level 2 might now target Maturity Level 3 because all the PAs must be addressed at that level.

Now that you have got the essence of the changes that CMMI V3.0 brings along, let’s throw a glance at some important considerations that emanate from this transition:

Practical tips for implementing CMMI V3.0

If your organization is considering CMMI V3.0 implementation, we are here to guide you: Simply put, although Maturity Level 2 now encompasses all Practice Areas (PAs), it doesn’t mandate adopting them all simultaneously. Instead, prioritize based on your specific challenges. Here are some suggestions:

1. Begin with the traditional Maturity Level 2 Practice Areas to ensure effective project management.
2. Utilize process improvement planning (PCM Practice Area) to strategize model adoption. Start with a basic task list outlining responsibilities and deadlines.
3. Incorporate risk and opportunity management (RSK) into project planning.
4. Implement peer reviews (PR) to catch errors in requirements and proposals.
5. Perform causal analysis (CAR) on both successful and unsuccessful projects to glean valuable insights.

You have two primary paths to consider:

1. A) For DEV or SVC appraisals:

• Existing appraisal team members (ATM) certified in CMMI V2 only need to pass the Associates exam upon certification expiration. Consult the Lead Appraiser (LA) for details on changes covered in the new exam.
• New appraisal team members must undergo relevant training and pass the Associates exam.

1. B) For appraising new PAs:

• The appraisal team should complete the Four-day Building Organizational Capability class and pass the Practitioner exam. A self-study option is available until 3/31/24 for cost savings.
• Verify appraisal team members’ domain experience. Each team member needs significant domain experience, with specific requirements tailored to the PA being appraised. Finding suitable team members may pose a challenge.
• The LA must have substantial experience in the chosen domain (five to eight years) to lead appraisals effectively, which may limit the number of certified LAs available for these new appraisals.

CMMI V3.0 and Remote Work || Putting-in a Sway Control

Considering the growing prevalence of remote work, it’s crucial to adapt CMMI 3.0 principles and practices to support and enhance remote collaboration and productivity. Establishing an effective strategy for virtual work is key to improving delivery efficiency, reducing travel costs, and seamlessly executing remote tasks. This involves continuously identifying, evaluating, and managing virtual requirements and constraints.

A comprehensive approach necessitates coordinating virtual work, teams, and projects, considering various factors like personnel, processes, technical aspects, and security. Organizations must identify stakeholders, tasks, and limitations while prioritizing security, privacy, confidentiality, and data protection.

Implementation includes enforcing communication controls, ensuring resource availability, and adopting measures to enhance organizational resilience. Equipping personnel with tools and techniques for effective virtual work is essential, requiring alignment with evolving customer and business needs. Regular assessments facilitate ongoing improvements and innovations.

This approach also considers virtual delivery criteria to ensure effectiveness, efficiency, and quality while addressing security and privacy concerns. Contingency plans are developed to manage potential disruptions, focusing on people, processes, infrastructure, and tools/systems. Standardized collaboration platforms and protocols support organization-wide communication and collaboration, fostering optimal productivity, adaptability, and resilience in a digital and remote work environment.

The CMMI Virtual Work domain and practices involve systematically identifying, assessing, and addressing virtual, remote, and hybrid work requirements, constraints, and flexible solutions. These three new domains complement the existing ones: Development, Services, Supplier Management, Security, and Safety.

Summarizing this, we would like to quote the ISACA resources – Shorten with AI

“CMMI has a proven track record in addressing problems all across the organization, focusing on outcome-based performance for faster, cheaper and better results. Shorten with AI

This new model (V3.0) addresses and helps optimize key areas that are top of mind for many organizations right now around data quality and management as well as how they can ensure their people are performing at their full potential,” says Ron Lear, ISACA vice president, frameworks and models. “This just enhances what has already been the gold standard in providing a prioritized pathway to launch products, provide services, and manage suppliers to achieve goals with measurable outcomes, with added bonus of making everyone’s job easier along the way.” Shorten with AI

(Ref: https://www.isaca.org/)Shorten with AI

CMMI V3.0 and Cybersecurity || How they both go hand-in-hand

Integration of CMMI 3.0 with Cybersecurity Practices is capable of leveraging CMMI for Enhanced Cybersecurity Processes and Resilience. Below is a slight elaboration for a better clarity:

Enabling Security: Establishing and sustaining comprehensive security measures are central to enabling security. This proactive approach anticipates and addresses security issues to minimize their impact on the organization or its solutions. It’s an ongoing effort aimed at mitigating the effects of security threats and vulnerabilities on business operations. Security requirements encompass various aspects including physical, mission-related, personnel-related, process-related, and cybersecurity aspects. The foundational “CIA triad” (Confidentiality, Integrity, Availability) underscores the importance of data protection, preventing unauthorized alterations, and ensuring authorized access. Organizational security employs a defense-in-depth strategy, incorporating multiple security layers to defend against various attack vectors.

Managing Security Threats and Vulnerabilities: Managing security threats and vulnerabilities involves identifying potential risks, assessing their impacts, and implementing measures to address and mitigate them. This practice enhances an organization’s ability to recognize, mitigate, and recover from threats, contributing to overall risk management efforts. A systematic approach prioritizes critical risks based on their potential business or solution impact. Establishing a continuous threat and vulnerability management strategy throughout the project or solution lifecycle includes developing security risk and opportunity management plans, identifying risk sources, analyzing risks, and executing security measures. Regular security risk assessments prevent incidents, bolster customer confidence, and reduce incident and vulnerability management efforts.

Both enabling security and managing security threats and vulnerabilities are essential for maintaining a secure and resilient organizational environment. They safeguard critical assets and uphold the organization’s reputation and trustworthiness.

 “Cybersecurity is the leading corporate governance challenge today, yet 87% of C-suite professionals and board members lack confidence in their company’s cybersecurity capabilities. Many CISOs and CSOs focus on implementing standards and frameworks, but what good is compliance if it does not improve your overall cybersecurity resilience?” – The CMMI Institute

 Agile and CMMI V3.0 Integration Strategies:

Let us now take a deep dive into how organizations are successfully integrating Agile methodologies with CMMI 3.0 and explore best practices, challenges, and the benefits of combining these approaches:

CMMI V3.0 has also updated Context Specific Information by adding specific details for Data, DevSecOps, and People across both core and domain Practice Areas. The Context Specific information previously referred to as Agile with Scrum Guidance has been renamed to Agile Development, with all content revised for better clarity.

The Agile Approach, outlined in the Agile Manifesto, lays out principles for software projects characterized by collaborative, cross-functional teams closely interacting with customers. The primary aim is to deliver regular increments of functional software capability, ensuring satisfaction among customers and end users. Agile follows an iterative and time-boxed software delivery approach, emphasizing incremental building from the project’s outset rather than attempting comprehensive delivery at the project’s end. This methodology involves breaking projects into small units of user functionality called user stories, prioritizing them, and consistently delivering them in short two- or three-week cycles known as iterations. Agile frameworks are iterative and adaptable to evolving requirements.

The Capability Maturity Model Integration – Development (CMMI-Dev) is a framework designed to assist organizations in achieving and institutionalizing process maturity. Encompassing maturity levels 1-5, this model offers a comprehensive approach, emphasizing a process-centric alignment of operations with organizational objectives. Its goal is to enhance organizational performance and product quality by establishing a structured and mature approach to processes.

Simply put, Agile methodologies dictate HOW tasks should be executed, while CMMI specifies WHAT tasks should be undertaken. The perceived conflict between CMMI and Agile arises from Agile’s focus on deliverables directly contributing to the product, with any non-contributing deliverables seen as potential waste.

Looking into the future of CMMI and Agile, the latest version of the CMMI model (version 2.0) was released in March 2018, which includes specific Agile practices. Key improvements in CMMI V2.0 focus on enhancing Agile resilience and incorporating the latest trend methodologies used in the market.

Thus, CMMI processes, particularly at maturity level 4, can provide systems engineering practices that support an Agile approach, especially in large projects. Blending CMMI level 4 and Agile methodologies can result in successful software project delivery. The alignment and coordination activities necessary for larger, complex projects are outlined in the systems engineering practices found in various CMMI process areas, providing a safety net to reduce the risk of project failure. Organizations aiming to adopt Agile processes should consider CMMI level 4 as a means to achieve excellence in software development.

Benefits offered by CMMI V3.0 || Summing it up in Layman’s Language:

Although CMMI (Capability Maturity Model Integration) primarily serves as a framework for organizational process improvement, its advantages may not be immediately apparent to the average person. However, the effects of CMMI V3.0 can indirectly influence individuals in several ways:

1. Product and Service Quality: CMMI aims to improve the quality and reliability of products and services. As a layperson, you may notice better products and services from organizations that have implemented CMMI 3.0, resulting in improved software, more dependable customer service, or higher-quality goods.
2. Efficiency and Consistency: Organizations adopting CMMI 3.0 focus on refining their processes, leading to increased efficiency and consistency in task execution. For individuals, this could mean smoother transactions, quicker service, and a more consistent experience when dealing with a CMMI-compliant organization.
3. Risk Reduction: CMMI emphasizes risk management and mitigation, indirectly benefiting laypeople by reducing disruptions, delays, or errors in the products or services they receive. Well-managed organizations tend to be more reliable.
4. Innovation and Adaptability: CMMI encourages organizations to be innovative and adaptable, potentially resulting in the development of new and improved products or services that better meet consumer needs.
5. Job Stability: Industries where CMMI is prevalent often have more stable organizations positioned for long-term success. This can provide job stability for employees, indirectly benefiting individuals by offering a secure work environment.
6. Data Security and Privacy: CMMI addresses security concerns, crucial in industries handling sensitive information. Laypeople benefit from robust security measures implemented by organizations to safeguard their data and privacy.
7. Customer Satisfaction: CMMI places a strong emphasis on understanding and meeting customer needs, leading to improved customer service and satisfaction for laypeople dealing with CMMI-compliant organizations.
8. Industry Reputation: CMMI certification is often viewed as a mark of excellence in certain industries. Laypeople may prefer organizations with a strong reputation for quality and process maturity, resulting in a positive overall experience.

Although individuals may not directly observe the impact of CMMI 3.0, its principles contribute to a more organized, efficient, and customer-focused business environment, indirectly benefiting consumers in various ways.

We, at ABS, have undertaken 50+ CMMI projects across various time zones. Do Contact Us here or drop-in your enquiry for us to get back to you with an extensive project proposal and time line.

You may also be interested in knowing more about CMMI in general. Please browse through the content here Capability Maturity Model (CMMi)

Kindly visit our Services page to explore more about our offerings.