What is CMMI? A model to optimize development processes

What is CMMI?

The Capability Maturity Model Integration (CMMI), a process and behavioral model, was developed by the Software Engineering Institute at Carnegie Mellon University as a process improvement tool for projects, divisions, or organizations. The DoD and US government helped develop the CMMI, which is a common requirement for DoD and US government software development contracts. The CMMI is currently administered by the CMMI Institute, purchased by the ISACA in 2016.

CMMI model

The CMMI is designed to help improve performance by providing businesses with all they need to consistently develop better products and services. But the CMMI is a behavioral model as well as a process model. Businesses can use the CMMI to tackle the logistics of improving performance by developing measurable benchmarks, but it can also help create a structure to encourage productive and efficient behavior throughout the organization.

CMMI AI Maturity (AIM) framework

At the forthcoming Capability Creates 2026 conference in Washington, DC, in June, the ISACA will unveil the CMMI AI Maturity (AIM) framework, where attendees will be the first to hear insights from pilot participants of it. The new framework is designed to govern AI at scale amid the rapid growth of AI, addressing risk, compliance, performance, consistency, and trust around AI usage, development, acquisition, and integration. It’ll also introduce updated CMMI appraisal methods for organizations to assess AI maturity across domains, analyze AI performance, and develop best practices around integrating AI into current systems.

The AIM initiative, developed by the CMMI AI Working Group, consists of 25 industry experts sponsored by IBM Global and KPMG, who’ve focused on researching and establishing best practices around AI, ML, automation, ethics, DevSecOps, testing, threat analysis, and advanced manufacturing. It also builds on the existing CMMI Performance Solutions ecosystem, helping businesses address the growing use of AI in enterprise systems, services, and products, especially in government settings. With the framework, IT leaders can ensure AI initiatives are implemented with consistency and transparency, with a focus on AI ethics.

All 31 practice areas in the CMMI now include AI-related content with a total of 157 AI context-specific additions, allowing for more consistency around AI considerations across organizations. The model now features AI usage scenarios to help organizations understand how it can apply internally, from using AI to assist with human activities, to fully autonomous AI systems that work independently. The new framework will apply to organizations either building internal AI solutions or planning to acquire and integrate AI into current systems and services.

Two new courses will be added to the established certification pathways to better integrate AI training, and existing CMMI certification holders won’t be impacted unless they choose to extend their certifications to include CMMI AIM.

The new courses include:

• Building AI Maturity (BAIM): A hybrid online and in-person course that focuses on AI concepts, data quality, responsible and ethical AI, regulations, and managing AI initiatives.
• Appraising AI Maturity (AAIM): An advanced course for certified CMMI lead appraisers designed to cover topics including scoping, appraisal planning, performance analysis, and sustaining AI-driven improvement.

CMMI maturity levels

The CMMI model breaks down organizational maturity into five levels. For businesses that embrace CMMI, the goal is to raise the organization up to Level 5, the optimizing maturity level. Once businesses reach this level, they aren’t done with the CMMI. Instead, they focus on maintenance and regular improvements.

CMMI’s maturity levels:

• Maturity level 0 – Incomplete: Work may or may not get completed. Goals haven’t been established and processes are only partly formed or don’t meet organizational needs.
• Maturity level 1 – Initial: Processes are viewed as unpredictable and reactive. Work gets completed but it’s often delayed and over budget. This is the worst stage a business can find itself in — an unpredictable environment that increases risk and inefficiency.
• Maturity level 2 – Managed: There’s a level of project management achieved. Projects are planned, performed, measured and controlled, but there are still many issues to address.
• Maturity level 3 – Defined: Organizations are more proactive than reactive. There’s a set of organization-wide standards to provide guidance across projects, programs, and portfolios. Businesses understand their shortcomings, how to address them, and what the goal is for improvement.
• Maturity level 4 – Quantitatively managed: This stage is more measured and controlled. The organization is working off quantitative data to determine predictable processes that align with stakeholder needs. The business is ahead of risks, with more data-driven insight into process deficiencies.
• Maturity level 5 – Optimizing: Here, an organization’s processes are stable and flexible, and it’ll be in a constant state of improving and responding to changes or other opportunities. The organization is stable, which allows for more agility and innovation in a predictable environment.

Once organizations hit levels 4 and 5, they’re considered high maturity, where they’re continuously evolving, adapting and growing to meet the needs of stakeholders and customers. That’s the goal of the CMMI, to create reliable environments, where products, services, and departments are proactive, efficient, and productive.

Go here for a deeper look.

CMMI capability levels

The CMMI also has capability levels used to appraise an organization’s performance and process improvement as it applies to an individual practice area outlined in the CMMI model. It can help bring structure to process and performance improvement, and each level builds on the last, similar to the maturity levels to appraise an organization.

The capability levels are:

• Capability level 0 – Incomplete: Inconsistent performance and an incomplete approach to meeting the intent of the practice area.
• Capability level 1 – Initial: Organizations start to address performance issues in a specific practice area, but there’s not a complete set of practices in place.
• Capability level 2 – Managed: Progress is starting to show and there’s a full set of practices in place that specifically addresses improvement in the practice area.
• Capability level 3 – Defined: A focus on achieving project and organizational performance objectives, and clear organizational standards in place to address projects in that practice area.

Updated CMMI V3.0

In 2023, ISACA released the most recent version of the CMMI, Version 3.0, which focuses more heavily on performance needs and how they impact the business. There’s information on how to establish performance goals, and then track those goals to make sure they’re achieved at all levels of business maturity.

Version 3.0 also integrates better with agile and Scrum processes, with a focus on safety and security. If you already have an agile practice in place, the CMMI V3.0 will help you work around or improve established processes that already work for your business. It also aims to lower the overall cost of appraisals, shorten the time it takes to appraise an organization, and cut back on technical knowledge, so it’s easier for those outside of the tech industry to understand it.

The ISACA and CMMI Institute also included more information on how to demonstrate ROI, so leaders can get other executives on board. Performance benchmarks and goals outlined in the CMMI can help businesses ensure all projects and processes are cost-effective or profitable. The latest version is also easier to deploy across an organization with updated, user-friendly, and customizable online platforms and tools that provide guidance to adopt CMMI or transition to V3.0 from earlier versions. It’s also available in several translated languages.

CMMI certifications

CMMI certifications are offered directly through the CMMI Institute, which certifies individuals, appraisers, instructors, and practitioners. The CMMI Institute offers the following certifications:

• The CMMI Associate Certification demonstrates your commitment and abilities when it comes to capability and performance improvement. It validates that you have the skills and knowledge to connect the CMMI model to business value, and to participate as an appraisal team member.
• The CMMI Certified Practitioner certification requires completion of the Building Organizational Capability training course, validating your commitment to performance improvement and ability to take on more responsibility with performance management.
• The next level of certification is the CMMI Professional certification, which demonstrates your ability to apply the CMMI model in an organization structure through road maps for performance, team coaching, organizational change management, and fostering a culture of improvement.
• Certified CMMI Lead Appraisers are qualified to appraise organizations to determine their capability or maturity level as outlined in the CMMI model. Applications are reviewed by the ISACA appraiser application review committee, which evaluates your qualifications for the certification.
• The Certified CMMI Instructor certification enables you to lead instructional courses on CMMI. You’ll need a sponsoring organization that’s also an ISACA partner and licensed for use of the CMMI product suite to qualify for the exam.

For more on CMMI certifications, click here.

CMMI tools

The CMMI Institute authorizes third-party organizations to sell CMMI tools and services. The list of approved vendors is extensive, and you can search by product, location, and language on the CMMI Institute website. 

The type of CMMI tools that work best for your organization depends on your business’s needs. Following the CMMI, you’ll identify the best ones during Maturity Level 2 or 3. At this point, your CMMI consultant will offer recommendations or help you design customized tools based on extensive research. The most common category you’ll need to consider include:

• Project and document management
• Bug tracker
• Estimation
• Requirement and design management
• Decision and analysis tools
• Metrics tools
• Integration application