What is CMMI? Maturity levels, appraisals and how to check a claim
CMMI, short for Capability Maturity Model Integration, is a model of good practice for how an organisation plans, builds, delivers and improves its work. Organisations are appraised against it and rated at a maturity level, and buyers use that rating as evidence that a supplier works in a disciplined, repeatable way.
This guide explains what each level means, how an appraisal works, how long a rating lasts, and how to check a supplier's CMMI claim before you rely on it.
Where CMMI comes from
In 1987 the US Department of Defense asked Carnegie Mellon University to build a capability maturity model for judging its software contractors, and the university's Software Engineering Institute released the first version in 1991. In 2012 Carnegie Mellon founded the CMMI Institute to take the model beyond software, and in 2016 the institute was acquired by ISACA, a global non-profit association for technology professionals.
The current version, CMMI V3.0, came out in 2023. It covers eight domains: development, services, supplier management, security, safety, data management, people management and managing a virtual workforce. The CMMI Institute says more than 10,000 organisations in 106 countries have used its models.
The maturity levels, from 0 to 5
A maturity level describes how an organisation works as a whole. Paraphrasing the CMMI Institute's definitions:
- Level 0, Incomplete. Work is ad hoc and may or may not get done.
- Level 1, Initial. Work gets done, but unpredictably and reactively, and often late and over budget.
- Level 2, Managed. Each project is planned, performed, measured and controlled.
- Level 3, Defined. The organisation is proactive: shared standards guide every project, programme and portfolio.
- Level 4, Quantitatively Managed. Performance is measured and controlled against numeric objectives, so results are predictable.
- Level 5, Optimizing. The organisation improves continuously and adapts quickly to change and opportunity.
The step from Level 2 to Level 3 is the one to understand. At Level 2 good practice is organised project by project, so it depends on who runs each project. At Level 3 the organisation has one way of working that every project follows.
Maturity levels and capability levels
CMMI also has capability levels, numbered 0 to 3. A capability level rates a single practice area, such as planning or quality assurance. A maturity level rates a predefined set of practice areas together. A company fixing one weak area can aim for a capability level in it; a company that wants one headline rating aims for a maturity level.
How an appraisal works
A rating comes from an appraisal led by a lead appraiser certified by the CMMI Institute. The appraisal team checks how the organisation actually works against the practices in scope. There are four types of appraisal:
| Appraisal | What it is for | Gives a rating | Rating valid for |
|---|---|---|---|
| Benchmark | The full appraisal that sets a maturity or capability level | Yes | 3 years |
| Sustainment | A check-up after a Benchmark, to confirm the level is being kept | Yes | 2 years |
| Evaluation | An informal review to prepare for an appraisal and find improvements | No | Not applicable |
| Action Plan Reappraisal | A second chance for an organisation that narrowly missed its target level | Yes | As the earlier appraisal |
How to check a supplier's CMMI claim
"CMMI Level 3" in a proposal is worth five minutes of checking. These questions cover it:
- Which appraisal, and when? Only Benchmark and Sustainment appraisals, and a reappraisal after one, give a rating. An Evaluation does not.
- Is it still current? A Benchmark rating lasts three years and a Sustainment rating two. An older rating has expired.
- What was in scope? A rating covers the part of the company that was appraised and the domains in scope, such as development or services. Ask whether the team that would work on your project was part of it.
- Is it published? The CMMI Institute's Published Appraisal Results lists the levels from Benchmark and Sustainment appraisals that organisations have agreed to share. If a claimed level is not there, ask for the appraisal details.
- How will it show in your project? Ask to see the plans, reviews and measures the supplier will use with you. A rating describes how a company works; your project is where it should show.
CMMI, agile and ISO 9001
CMMI does not replace agile methods. The CMMI Institute publishes a guide to using CMMI with Scrum and presents its practices as a way to strengthen agile teams where agile methods say little, such as governance and consistency across teams.
ISO 9001 answers a different question. It is a standard for a company's quality management system, and companies are certified against it. CMMI rates how mature the way of working is. Some companies hold both.
Is CMMI worth it for a smaller company?
The practices are worth adopting at any size: clear requirements, planned work, regular reviews and a few honest measures make delivery more predictable. A formal appraisal is a separate decision. It takes preparation and a certified lead appraiser, so it pays off mainly when your clients or tenders ask for a rating.
If you are planning a project, our guides to the feasibility study and to SDLC methodologies cover the early decisions, and our custom software development page explains how we work with clients.
Questions people ask
What does CMMI stand for?
Capability Maturity Model Integration. It grew out of the capability maturity model for software that Carnegie Mellon's Software Engineering Institute released in 1991.
What is CMMI Level 3?
Level 3, Defined, means the organisation works to shared, organisation-wide standards rather than project by project, and acts proactively rather than reactively.
How long is a CMMI rating valid?
Three years from a Benchmark appraisal and two years from a Sustainment appraisal. An Evaluation gives no rating.
Who owns CMMI?
The CMMI Institute, which Carnegie Mellon University founded in 2012 and ISACA acquired in 2016.
Can I look up a company's CMMI level?
Yes, in the CMMI Institute's Published Appraisal Results, for Benchmark and Sustainment appraisals the company agreed to share.
