The EIM Puzzle – May 2013

Would you eat in a restaurant that hadn’t been inspected by the local inspector? Of course you wouldn’t – because you couldn’t be sure that the restaurant followed the best sanitary practices. But passing the inspection doesn’t guarantee good food either. In any case, there are certain best practices that restaurants must follow to guarantee the food is safe, regardless of its taste quality. This is what the restaurant inspector intends to do – guarantee that the food is safe – he does not guarantee the tastiness of the food.To a certain extent, this is what the Capability Maturity Model (CMM)1 seeks to do – establish a set of practices by which to benchmark the quality of software development organizations. Those that achieve the highest level of certification are expected to produce quality (and possibly good) software. Those that don’t follow even the minimum recommended practices might offer good software, but we have no confidence that the application was developed using practices that can help ensure the delivery of software that functions as expected. Following is a short overview of the Capability Maturity Model, a method of assessment that can be used for many purposes, including the evaluation of data and information management practices.

The information systems community has developed a long-standing reputation for poor quality in their product development and delivery. As evidenced by the need for multiple “patches,” incremental “releases” and supplemental “upgrades” to both packaged software and custom-designed applications, many organizations need to improve the quality of the software they produce.

There have been several programs that attempt to address the identification of quality and its improvement for manufacturing processes (e.g., Total Quality Management, ISO 9000, and Six Sigma). These programs were designed primarily for measuring quality in generic manufacturing processes, and may not be very useful in the realm of software engineering, with its amorphous development phases and its need to rely on input from user communities and the reliance on increasingly advanced information technology.

In 1984, the Software Engineering Institute (SEI) was founded at Carnegie Mellon University as a federally funded, non-profit organization, responding to the need for a software-oriented process improvement technique. The purpose of the SEI was to establish protocols and methodologies in the field of software development that would assist the United States to maintain a competitive edge in technological endeavors, especially in the improvement of the practice of software engineering.

One of the early results of the SEI’s efforts was the development of a “Capability Maturity Model” (CMM), based on the work of Watts Humphrey at IBM. This model strives to assist organizations in improving the quality of their software development through implementation of processes that are “mature,” meaning that these processes have a high predictability of results and low risk of encountering unknown variables or situations. The model takes an organization through five scales, from Level 1 (Initial) through Level 5 (Optimizing), and measures the operation’s effectiveness at each level based on assessment of certain areas.

Benefits to using a software process improvement framework such as the CMM have been identified by numerous researchers, both academic and professional, and would include:

  • More accurate identification of flaws in process development operations
  • Reduction in cost of software development
  • Increase in productivity from software development professionals (staff and contractors
  • Reduction in post-release defects and essential enhancements
  • Reduction in time-to-market for software implementation

The Capability Maturity Model, whose first version was released in 1991, is based on actual industry practices, reflects the best practices of the industry and reflects the needs of individuals performing software process improvement and process appraisals (measurement and benchmarking). The CMM is intended to be a cohesive, coherent, ordered set of incremental improvements, all relating to experienced success in the field, and packaged into a framework that demonstrates how effective practices can be built on one another into a logical and repeatable progression. Far from a “quick fix”, successful use of the CMM requires attention to detail, support and participation from senior management and a rational approach to all aspects of software development and implementation.

Many organizations raced to embrace the CMM, recognizing the high costs of poor quality software development and implementation. However, their enthusiasm in adopting the CMM was not accompanied by an understanding of the foundations of quality improvement and the CMM’s role in assisting organizations to recognize and implement consistent quality improvement methods. Before implementing the CMM, software development operations must fully understand the history of quality and process improvement methodologies, and the place the CMM holds in ensuring the advancement of quality in any domain.

Levels of the CMM (from

  1. Initial Level (ad hoc, immature): At the initial level, the organization typically does not provide a stable, consistent environment for developing new products. When an organization lacks consistent project management practices, the benefits of good integrated product development practices are undermined by ineffective planning and reaction-driven commitment systems.
  2. Repeatable Level: At the repeatable level, policies for managing a development project and procedures to implement those policies are established. Effective management processes for development projects are institutionalized, which allow organizations to repeat successful practices developed on earlier projects, although the specific processes implemented by the projects may differ.
  3. Defined Level: At the defined level, the standard process for developing new products is documented, these processes are based on integrated product development practices, and these processes are integrated into a coherent whole. Processes are used to help the managers, team leaders, and development team members perform more effectively.
  4. Managed Level: At the managed level, the organization establishes metrics for products and processes and measures results. Projects achieve control over their products and processes by narrowing the variation in their process performance to fall within acceptable boundaries. Meaningful variations in process performance can be distinguished from random variation (noise).
  5. Optimized Level: At the optimized level, the entire organization is focused on continuous process improvement. The organization has the means to identify weaknesses and strengthen the process proactively, with the goal of preventing the occurrence of defects. Data on the effectiveness of the development process is used to perform cost benefit analyses of new development technologies and proposed changes to the organization’s development process. Innovations that exploit the best-integrated product development practices are identified and transferred throughout the organization.

If an organization of any size truly is interested in discovering an approach to process improvement in their software development and integration efforts, a study of the Capability Maturity Model and the practices it encompasses is a fine place to start. CMM-related efforts can be as simple or detailed as the organization needs or desires, but education in the model and its techniques is essential for a successful self-assessment and any improvement activities that arise from the results of the assessment.

Using the CMM as the basis for developing an Enterprise Information Management Maturity Model, and how to implement that model in any organization (any size, any industry) will be the focus of future columns.

End Note:

  1. For those purists, yes, I know it’s “CMMI” for Capability Maturity Model Integration, the successor to the original CMM. CMMI is the generalized version of the software CMM that encompasses the total system, including software. But we’ll use “CMM” throughout without loss of generality.

Share this post

Anne Marie Smith, Ph.D.

Anne Marie Smith, Ph.D.

Anne Marie Smith, Ph.D., is an acclaimed data management professional, consultant, author and speaker in the fields of enterprise information management, data stewardship and governance, data warehousing, data modeling, project management, business requirements management, IS strategic planning and metadata management. She holds a doctorate in Management Information Systems, and is a certified data management professional (CDMP), a certified business intelligence professional (CBIP), and holds several insurance certifications.

Anne Marie has served on the board of directors of DAMA International and on the board of the Insurance Data Management Association.  She is a member of the MIS faculty of Northcentral University and has taught at several universities. As a thought leader, Anne Marie writes frequently for data / information management publications on a variety of data-oriented topics.  She can be reached through her website at and through her LinkedIn profile at

scroll to top
We use technologies such as cookies to understand how you use our site and to provide a better user experience. This includes personalizing content, using analytics and improving site operations. We may share your information about your use of our site with third parties in accordance with our Privacy Policy. You can change your cookie settings as described here at any time, but parts of our site may not function correctly without them. By continuing to use our site, you agree that we can save cookies on your device, unless you have disabled cookies.
I Accept