cba ipi cmm intro session 1.1

1

INTRODUCTION TO CMM - Version 1.1

2

PREREQUISITES

KNOWLEDGE OF SOFTWARE ENGINEERING AND MANAGEMENT

AWARENESS OF PROCESS MANAGEMENT CONCEPTS

3

COURSE OBJECTIVES

UNDERSTAND TERMS SUCH AS PROCESS, CAPABILITY, AND MATURITY

DISCUSS THE 18 KEY PROCESS AREAS IN THE CMM

INTERPRET THE CMM AND THE KEY PRACTICES IN THE DIFFERENT CONTEXTS

DESCRIBE THE FUNDAMENTAL CONCEPTS OF THE CMM

EXPLAIN AND USE THE STRUCTURE OF THE CMM

USE THE CMM IN SOFTWARE PROCESS IMPROVEMENT ACTIVITIES AND APPRAISALS

4

CAPABILITY MATURITY MODELS

FOCUS AREAS INCLUDE

CMM FOR SOFTWARE

SYSTEMS ENGINEERING

PEOPLE ( developing human talent )

TRUSTED SOFTWARE ( tailored CMM )

SOFTWARE AQUISITION

INTEGRATED PRODUCT DEVELOPMENT

MATURITY MODEL INTEGRATION

5

PEOPLE ( developing human talent )

The People Capability Maturity Model® (P-CMM®) adapts the maturity framework of the Capability Maturity Model® for Software (CMM®) [Paulk 95], to managing and developing an organization's work force. The motivation for the P-CMM is to radically improve the ability of software organizations to attract, develop, motivate, organize, and retain the talent needed to continuously improve software development capability. The P-CMM is designed to allow software organizations to integrate work-force improvement with software process improvement programs guided by the SW-CMM. The P-CMM can also be used by any kind of organization as a guide for improving their people-related and work-force practices.

http://www.sei.cmu.edu/cmm-p/

6

SOFTWARE AQUISITION

The Software Acquisition Capability Maturity Model® (SA-CMM®) is a model for benchmarking and improving the software acquisition process. The model follows the same architecture as the Capability Maturity Model for Software (SW-CMM), but with a unique emphasis on acquisition issues and the needs of individuals and groups who are planning and managing software acquisition efforts.

Each maturity level indicates an acquisition process capability and has several Key Process Areas (KPAs). Each KPA has goals and common features and organizational practices intended to institutionalize common practice.

http://www.sei.cmu.edu/arm/SA-CMM.html

7

KPAs of SA-CMM

Optimizing(Continuous Process Improvement). Acquisition Innovation Management. Continuous Process Improvement4Quantitative Quantitative Management). Quantitative Acquisition Management . Quantitative Process Management Defined (Process Standardization). Training Program . Acquisition Risk Management . Contract Performance Management . Project Performance Management . Process Definition and Maintenance2Repeatable (BasicProject Management). Transition to Support . Evaluation . Contract Tracking and Oversight . Project Management . Requirements Development and Mgt . Solicitation . Software Acquisition PlanningInitialCompetent people and heroics

8

TRUSTED SOFTWARE

The SYSTEMS SECURITY ENGINEERING -CMM identifies both the unique characteristics of security engineering, and the integration of security activities into the overall system engineering process. The SSE-CMM uses the same maturity model architecture used in the System Engineering (SE)-CMM [2].

9

TRUSTED SOFTWARE

The SSE-CMM augments project and organizational process areas from the SE-CMM with security-specific process areas, including: •Administer Security Controls. •Assess Impact. •Assess Security Risk. •Assess Threat. •Assess Vulnerability. •Build Assurance Argument. •Coordinate Security. •Monitor Security Posture. •Provide Security Input. •Specify Security Needs. •Verify and Validate Security

10

INTEGRATED PRODUCT DEVELOPMENT

(IPD) IPD is a systematic approach to product development that achieves a timely collaboration of necessary disciplines throughout the product life cycle to better satisfy customer needs. It typically involves a teaming of the functional disciplines to integrate and concurrently apply all necessary processes to produce an effective and efficient product that satisfies the customer's needs.

11

CAPABILITY MATURITY MODEL INTEGRATION

Integration of different CMMs into a single entity, CMM for SW is a subset of CMMi and its expected that it will take the place of current CMM over the next 3 years, CMM for SW in CMMi is closest to Draft 2C of CMM

12

APPLYING THE CMM

APPRAISALS

ASSESSMENTS– SOFTWARE PROCESS ASSESSMENTS (SPA ) Phased out – This is

based on the administration of questionnaires by the lead assessor and some informal discussions/interviews, rating is done

– INTERNAL PROCESS IMPROVEMENT (IPI)– INTERIM PROFILE (IP) An Internal Assessment, which is a scaled

down version of the CBA-IPI which has the components of Interviews, Questionnaire administration and rating is also done,

EVALUATIONS (source selection and contract manufacturing)

PROCESS IMPROVEMENT EFFORTS

13

SOFTWARE PROCESS MANAGEMENT PREMISE

THE QUALITY OF A SOFTWARE SYSTEM IS HIGHLY INFLUENCED BY THE QUALITY OF THE PROCESS USED TO DEVELOP AND MAINTAIN IT.

THIS PREMISE IMPLIES FOCUS ON PROCESS AS WELL AS PRODUCT.

14

A MATURE PROCESS

CONSISTENT WITH THE WAY WORK ACTUALLY GETS DONEDEFINED, DOCUMENTED, AND CONTINUOUSLY IMPROVING – UNDERSTOOD – USED– LIVINGSUPPORTED VISIBLY BY MANAGEMENT AND OTHERS

15

A MATURE PROCESS

WELL CONTROLLED - PROCESS FIDELITY IS AUDITED AND ENFORCED.

CONSTRUCTIVE USE OF PRODUCT AND PROCESS MEASUREMENT

DISCIPLINED USE OF TECHNOLOGY

16

INSTITUTIONALIZED PROCESS

“THAT IS THE WAY WE DO THINGS AROUND HERE”

THE ORGANIZATION BUILDS AN INFRASTRUCTURE THAT CONTAINS EFFECTIVE, USABLE, AND CONSISTENTLY APPLIED PROCESSES.

THE ORGANIZATIONAL CULTURE MUST CONVEY THE PROCESS.

MANAGEMENT MUST NURTURE THE CULTURE - IF NO ONE CARES, EVERYONE FORGETS.

CULTURE IS CONVEYED WITH ROLE MODELS AND REWARDS.

INSTITUTIONALIZED PROCESSES ENDURE AFTER PEOPLE WHO ORIGINALLY DEFINED THEM HAVE GONE.

17

WHAT IS CAPABILITY MATURITY MODEL (CMM) ?

A COMMONSENSE APPLICATION OF PROCESS MANAGEMENT AND QUALITY IMPROVEMENT CONCEPTS TO SOFTWARE DEVELOPMENT AND MAINTENANCE.

A COMMUNITY-DEVELOPED GUIDE

A MODEL FOR ORGANIZATIONAL IMPROVEMENT

THE UNDERLYING STRUCTURE FOR RELIABLE AND CONSISTENT CMM-BASED APPRAISAL METHODS

18

WHAT THE CMM DOES NOT COVER?

THE CMM DOES NOT ADDRESS ALL SOFTWARE PROCESS AND QUALITY IMPROVEMENT ISSUES

ISSUES THAT ARE ADDRESSED ONLY INDIRECTLY, OR BY IMPLICATION, INCLUDE– SPECIFIC TOOLS, METHODS, AND TECHNOLOGIES– SYSTEM ENGINEERING, MARKETING, ETC.– HUMAN RESOURCES– ORGANIZATIONAL BEHAVIOUR

19

INTENT OF THE INITIAL MATURITY LEVEL

PERFORMANCE DRIVEN BY THE COMPETENCE AND HEROICS OF THE PEOPLE DOING THE WORK

HIGH QUALITY AND EXCEPTIONAL PERFORMANCE POSSIBLE SO LONG AS THE BEST PEOPLE CAN BE HIRED

UNPREDICTABLE - FOR GOOD OR ILL

THE MAJOR PROBLEMS FACING THE SOFTWARE ORGANIZATION ARE MANAGERIAL, NOT TECHNICAL

20

INTENT OF THE REPEATABLE MATURITY LEVEL

THE PREDOMINANT NEED IS TO ESTABLISH EFFECTIVE SOFTWARE PROJECT MANAGEMENT

SOFTWARE PROJECT MANAGEMENT PROCESSES ARE DOCUMENTED AND FOLLOWED

ORGANIZATIONAL POLICIES GUIDE THE PROJECTS IN ESTABLISHING MANAGEMENT PROCESSES

SUCCESSFUL PRACTICES DEVELOPED ON EARLIER PROJECTS CAN BE REPEATED

21

THE KEY PROCESS AREAS FOR THE REPEATABLE LEVEL

SOFTWARE CONFIGURATION MANAGEMENT

SOFTWARE QUALITY ASSURANCE

SOFTWARE SUBCONTRACT MANAGEMENT

SOFTWARE PROJECT TRACKING AND OVERSIGHT

SOFTWARE PROJECT PLANNING

REQUIREMENTS MANAGEMENT

22

INTENT OF THE DEFINED MATURITY LEVEL

THIS LEVEL BUILDS ON THE SOFTWARE PROJECT MANAGEMENT FOUNDATION

TO CONTROL A PROCESS, IT MUST BE DEFINED, DOCUMENTED, AND UNDERSTOOD

THE OUTPUTS OF ONE TASK FLOW SMOOTHLY IN TO THE INPUTS OF THE NEXT TASK

AT THIS LEVEL, THE ORGANIZATION BUILDS PROCESSES THAT EMPOWER THE INDIVIDUALS DOING THE WORK

23

THE KEY PROCESS AREAS FOR THE DEFINED LEVEL

PEER REVIEWS

INTERGROUP COORDINATION

SOFTWARE PRODUCT ENGINEERING

INTEGRATED SOFTWARE MANAGEMENT

TRAINING PROGRAM

ORGANIZATION PROCESS DEFINITION

ORGANIZATON PROCESS FOCUS

24

INTENT OF THE MANAGED MATURITY LEVEL

APPLY THE PRINCIPLES OF STATISTICAL PROCESS CONTROL

ADDRESS THE SPECIAL CAUSES OF PROCESS VARIATION

25

THE KEY PROCESS AREAS OF MANAGED LEVEL

SOFTWARE QUALITY MANAGEMENT

QUANTITATIVE PROCESS MANAGEMENT

26

INTENT OF THE OPTIMIZING MATURITY LEVEL

IDENTIFY AND ELIMINATE CHRONIC CAUSES OF POOR PERFORMANCE

CONTINUOUSLY IMPROVE THE SOFTWARE PROCESS

27

THE KEY PROCESS AREAS FOR THE OPTIMIZING LEVEL

PROCESS CHANGE MANAGEMENT

TECHNOLOGY CHANGE MANAGEMENT

DEFECT PREVENTION

28

MATURITY LEVELS CAN NOT BE SKIPPED

PROCESSES AT HIGHER MATURITY LEVELS MAY BE PERFORMED, ALTHOUGH PERHAPS INEFFECTIVELY, EVEN BY THE ORGANIZATIONS AT THE INITIAL LEVEL.

PROCESS CAPABILITY IS BUILT IN STAGES, SINCE SOME PROCESSES ARE INEFFECTIVE WHEN OTHERS ARE NOT STABLE

EACH LEVEL PROVIDES A NECESSARY FOUNDATION FOR IMPROVEMENTS UNDERTAKEN AT THE NEXT LEVEL

– ENGINEERING PROCESS IS EASILY SACRIFICED WITH OUT MANAGEMENT DISCIPLINE

– DETAILED MEASURES ARE INCONSISTENT WITHOUT A DEFINED PROCESS– EFFECT OF PROCESS INNOVATION IS OBSCURE IN A NOISY PROCESS

29

MATURITY LEVELS

WELL-DEFINED EVOLUTIONARY PLATEAUS ON THE PATH TO BECOMING A MATURE SOFTWARE ORGANIZATION

EACH LEVEL IS A LAYER IN THE FOUNDATION FOR CONTINUOUS PROCESS IMPROVEMENT

THERE ARE FIVE MATURITY LEVELS IN THE CMM

ACHIEVING EACH LEVEL ESTABLISHES A DIFFERENT COMPONENT OF THE SOFTWARE PROCESS

MATURITY LEVELS ARE DESCRIBED IN TERMS OF 18 KEY PROCESS AREAS

30

GOALS

GOALS SUMMARIZE THE KEY PRACTICES OF THE KEY PROCESS AREAS

THEY ARE CONSIDERED IMPORTANT FOR ENHANCING PROCESS CAPABILITY FOR THAT LEVEL OF MATURITY

THEY CAN BE USED TO GUIDE ORGANIZATIONS AND APPRAISAL TEAMS IN ASSESSING ALTERNATIVE WAYS TO IMPLEMENT KEY PROCESS AREAS

EACH KEY PROCESS MAPS TO ONE OR MORE GOALS

31

COMMON FEATURES

USED TO ORGANIZE THE KEY PRACTICES IN EACH KEY PROCESS AREA

COMMON FEATURES ARE

COMMITMENT TO PERFORM

ABILITY TO PERFORM

ACTIVITIES PERFORMED

MEASUREMENT AND ANALYSIS

VERIFYING IMPLEMENTATION

32

COMMITMENT TO PERFORM

DESCRIBES THE ACTIONS THE ORGANIZATION MUST TAKE TO ENSURE THAT THE PROCESS IS ESTABLISHED AND WILL ENDURE

TYPICALLY INCLUDE

– POLICIES– LEADERSHIP

33

ABILITY TO PERFORM

DESCRIBES THE PRECONDITIONS THAT MUST EXIST IN THE PROJECT OR ORGANIZATION TO IMPLEMENT THE SOFTWARE PROCESS COMPETENTLY

TYPICALLY INCLUDES– FUNCTION– RESOURCES– DELEGATION– TRAINING– ORIENTATION

34

ACTIVITIES PERFORMED

DESCRIBES THE ROLES AND PROCEDURES NECESSARY TO IMPLEMENT A KEY PROCESS AREA

TYPICALLY INCLUDES– ESTABLISHING PLANS AND PROCEDURES– PERFORMING THE WORK– TRACKING IT– TAKING CORRECTIVE ACTIONS AS NECESSARY

35

MEASUREMENT AND ANALYSIS

DESCRIBES THE NEED TO MEASURE THE PROCESS AND ANALYSE THE MEASUREMENTS

TYPICALLY INCLUDES EXAMPLES OF THE MEASUREMENTS THAT COULD BE TAKEN TO DETERMINE THE STATUS AND EFFECTIVENESS OF THE ACTIVITIES PERFORMED COMMON FEATURE

36

VERIFYING IMPLEMENTATION

DSECRIBES THE STEPS TO ENSURE THAT THE ACTIVITIES ARE PERFORMED IN COMPLIANCE WITH THE PROCESS THAT HAS BEEN ESTABLISHED

TYPICALLY INCLUDES REVIEWS AND AUDITS BY– SENIOR MANAGEMENT– PROJECT MANAGEMENT– SOFTWARE QUALITY ASSURANCE

37

KEY PRACTICES

STATE THE FUNDAMENTAL POLICIES, PROCEDURES, AND ACTIVITIES FOR A KEY PROCESS AREA

DESCRIBE “WHAT” IS TO BE DONE, BUT THEY SHOULD NOT BE INTERPRETED AS MANDATING “HOW”

ARE ORGANIZED BY COMMON FEATURE

316 KEY PRACTICES IN CMM