Technical Report
CMU/SEI-93-TR-025
ESC-TR-93-178
Key Practices of the Capability Maturity Model
SM
, Version 1.1
Mark C. Paulk
Charles V. Weber
Suzanne M. Garcia
Mary Beth Chrissis
Marilyn Bush
February 1993
Software Engineering Institute
Carnegie Mellon University
Pittsburgh, Pennsylvania 15213
Unlimited distribution subject to the copyright.
Technical Report
CMU/SEI-93-TR-025
ESC-TR-93-178
February 1993
Key Practices of the Capability Maturity Model
SM
, Version 1.1
Mark C. Paulk
Charles V. Weber
Suzanne M. Garcia
Mary Beth Chrissis
Marilyn Bush
This report was prepared for the
SEI Joint Program Office
HQ ESC/AXS
5 Eglin Street
Hanscom AFB, MA 01731-2116
The ideas and findings in this report should not be construed as an official DoD position. It is published in the
interest of scientific and technical information exchange.
FOR THE COMMANDER
(signature on file)
Thomas R. Miller, Lt Col, USAF
SEI Joint Program Office
This work is sponsored by the U.S. Department of Defense.
Copyright © 1993 by Carnegie Mellon University.
Permission to reproduce this document and to prepare derivative works from this document for internal use is
granted, provided the copyright and “No Warranty” statements are included with all reproductions and derivative
works.
Requests for permission to reproduce this document or to prepare derivative works of this document for external
and commercial use should be addressed to the SEI Licensing Agent.
NO WARRANTY
THIS CARNEGIE MELLON UNIVERSITY AND SOFTWARE ENGINEERING INSTITUTE MATERIAL
IS FURNISHED ON AN “AS-IS” BASIS. CARNEGIE MELLON UNIVERSITY MAKES NO WARRAN-
TIES OF ANY KIND, EITHER EXPRESSED OR IMPLIED, AS TO ANY MATTER INCLUDING, BUT NOT
LIMITED TO, WARRANTY OF FITNESS FOR PURPOSE OR MERCHANTIBILITY, EXCLUSIVITY, OR
RESULTS OBTAINED FROM USE OF THE MATERIAL. CARNEGIE MELLON UNIVERSITY DOES
NOT MAKE ANY WARRANTY OF ANY KIND WITH RESPECT TO FREEDOM FROM PATENT,
TRADEMARK, OR COPYRIGHT INFRINGEMENT.
This work was created in the performance of Federal Government Contract Number F19628-95-C-0003 with
Carnegie Mellon University for the operation of the Software Engineering Institute, a federally funded research
and development center. The Government of the United States has a royalty-free government-purpose license to
use, duplicate, or disclose the work, in whole or in part and in any manner, and to have or permit others to do so,
for government purposes pursuant to the copyright license under the clause at 52.227-7013.
This document is available through Research Access, Inc., 800 Vinial Street, Pittsburgh, PA 15212.
Phone: 1-800-685-6510. FAX: (412) 321-2994. RAI also maintains a World Wide Web home page. The URL is
http://www.rai.com
Copies of this document are available through the National Technical Information Service (NTIS). For informa-
tion on ordering, please contact NTIS directly: National Technical Information Service, U.S. Department of
Commerce, Springfield, VA 22161. Phone: (703) 487-4600.
This document is also available through the Defense Technical Information Center (DTIC). DTIC provides ac-
cess to and transfer of scientific and technical information for DoD personnel, DoD contractors and potential con-
tractors, and other U.S. Government agency personnel and their contractors. To obtain a copy, please contact
DTIC directly: Defense Technical Information Center, Attn: FDRA, Cameron Station, Alexandria, VA 22304-
6145. Phone: (703) 274-7633.
Use of any trademarks in this report is not intended in any way to infringe on the rights of the trademark holder.
CMM and Capability Maturity Model are service marks of Carnegie Mellon University.
Table of Contents
Acknowledgments................................................................................................O-vii
Overview
1 Introducing the Key Practices Document.....................................................O-1
1.1 To the Reader.............................................................................................O-1
1.2 Relationship of this Document to Other Documents.......................O-3
1.3 Organization of this Document.............................................................O-4
1.4 Expected Use of this Document.............................................................O-5
2 Overview of the Capability Maturity Model................................................O-7
2.1 Introducing the Capability Maturity Model........................................O-7
2.2 Sources of the CMM.................................................................................O-7
2.3 Structure of the CMM..............................................................................O-8
2.4.1 Level 1 - The Initial Level.........................................................O-13
2.4.2 Level 2 - The Repeatable Level................................................O-14
2.4.3 Level 3 - The Defined Level......................................................O-15
2.4.4 Level 4 - The Managed Level...................................................O-16
2.4.5 Level 5 - The Optimizing Level...............................................O-17
2.5 The Key Process Areas of the CMM....................................................O-18
2.6 The Key Practices.....................................................................................O-26
2.7 Goals..........................................................................................................O-27
2.8 Common Features..................................................................................O-27
3 Using the Key Practice Pages..........................................................................O-31
4 Interpreting the CMM.....................................................................................O-35
4.1 Interpreting the Key Practices...............................................................O-35
4.2 Interpreting the Common Features....................................................O-35
4.2.1 Commitment to Perform..........................................................O-36
4.2.2 Ability to Perform.......................................................................O-37
4.2.3 Activities Performed..................................................................O-39
4.2.4 Measurement and Analysis......................................................O-47
4.2.5 Verifying Implementation.......................................................O-47
4.3 Interpreting Software Process Definition..........................................O-50
4.3.1 Process Definition Concepts.....................................................O-51
4.3.2 Concepts Related to the Organization's Software
Process Assets...............................................................................O-53
4.3.3 Concepts Related to the Project's Defined Software
Process...........................................................................................O-58
CMU/SEI-93-TR-25 CMM Practices
■
O-i
Table of Contents
4.3.4 Relationship Between the Project's Defined Software
Process and the Software Development Plan.......................O-61
4.3.5 Life Cycles and the CMM...........................................................O-61
4.3.6 Technology and the CMM........................................................O-62
4.3.7 Documentation and the CMM.................................................O-62
4.3.8 Collection and Analysis of Process Data................................O-63
4.4 Organizational Structure and Roles...................................................O-64
4.4.1 Organizational Roles..................................................................O-64
4.4.2 Organizational Structure...........................................................O-69
4.4.3 Independence and Organizational Structure........................O-73
4.5 Applying Professional Judgment........................................................O-74
Level 2 Key Practices
Requirements Management.................................................................................L2-1
Software Project Planning...................................................................................L2-11
Software Project Tracking and Oversight........................................................L2-29
Software Subcontract Management..................................................................L2-43
Software Quality Assurance...............................................................................L2-59
Software Configuration Management.............................................................L2-71
Level 3 Key Practices
Organization Process Focus..................................................................................L3-1
Organization Process Definition........................................................................L3-11
Training Program.................................................................................................L3-25
Integrated Software Management.....................................................................L3-37
Software Product Engineering...........................................................................L3-59
Intergroup Coordination.....................................................................................L3-83
Peer Reviews L3-93
Level 4 Key Practices
Quantitative Process Management.....................................................................L4-1
Software Quality Management..........................................................................L4-19
Level 5 Key Practices
Defect Prevention...................................................................................................L5-1
Technology Change Management....................................................................L5-17
Process Change Management.............................................................................L5-31
O-ii
■
CMM Practices CMU/SEI-93-TR-25
