Using the CMM in Small Organizations ---Company XYZ

Abstract
The Capability Maturity Model (CMM) for Software developed by the Software Engineering Institute has had a major influence on software process and quality improvement around the world. This paper discusses how to use the CMM correctly and effectively in small organizations ,analyze the current stat of the company and how to make the company get into a higher level .By using questionnaires ,analyzing the collected information and giving my recommendation .

Introduction
The Software CMM defines a five-level framework for how an organization matures its software process. The most well-known aspect of the CMM is its description of five stages, or maturity levels, of an organization’s software process .These levels describe an evolutionary path from ad hoc, chaotic processes to mature, disciplined software processes. The five maturity levels prescribe priorities for successful process improvement, whose validity has been documented in many case studies and surveys.

Here is the table of 5 maturity levels , different focus and KPAs .
|Level |Focus |
|Small |16 – 50 employees and several products |
|Very small |3 – 15 employees and several products |
|Tiny |1 – 2 employees and one product |

Small organizations, just like large ones, will have problems with undocumented requirements, resource allocation, training, the mistakes of inexperienced managers, peer reviews, and documenting the product. Despite these challenges, small organizations can be very innovative and productive. Although there are a lot of problems that may require large numbers of people to solve, in general small teams are more productive than large teams – there are far fewer communication problems. So your really needs Capability Maturity Model to manage your company effectively .
The most important reason is the large number of roles proposed by CMM and responsibilities for the roles . To define and distribute the responsibilities is most important in the model and the roles are only carriers of the responsibilities. This implies that a responsibility associated to a role can be shared by one or several persons at the same time as the persons may also possess other roles.So even small amount of people can take all the responsibilities in the model .
The Maturity level of Company XYZ
To check which maturity level company XYZ is now on ,I would first use questionnaires and open-ended interviews .The engineers and managers in your company must fill in questionnaire that is designed to evaluate that organization’s software process maturity against the CMM requirements .

3.1 Questionnaires
Which best describes your current position ?
What activities do you currently work on ?
Have you received any CMM-related training ?
Are training activities planned ?
Is training provided for developing the skills and knowledge needed to perform technical roles ?
Is the project planned and managed in accordance with the project’s defined software process ?
On the project, do the software engineering group and other engineering groups collaborate with the customer to establish the system requirements ?
Does the project follow a documented plan for conducting quantitative process management?
Are the activities for managing software quality planned for the project?
Are defect prevention activities planned?
Is training in software process improvement required for both management and technical staff?
Does the organization follow a written policy for implementing software process improvements?
Are new technologies evaluated to determine their effect on quality and productivity?
Does the project follow a written organizational policy for defect prevention activities? .
Does the project use measurable and prioritized goals for managing the quality of its software products ? Are measurements of quality compared to goals for software product quality to determine if the quality goals are satisfied? .
Does someone review the actual project results regularly with your section and lab managers? Are peer reviews planned ? Do participants of peer reviews receive the training required to perform their roles? Does the project follow a written organizational policy for performing peer reviews?
These 20 questions can reflect the situation of this company .The key process areas in Repeatable Level (Level 2) are configuration management ,quality assurance ,subcontract management ,project tracking ,project planning ,requirements management .In defined level (level 3) ,the KPAs are peer reviews ,software product engineering ,intergroup coordination ,integrated software management ,training program ,organization process definition ,organization process focus .Through the questionnaire ,we can basically know those engineers and managers’ satisfaction degree in each key process .With these statistical data ,we know which maturity level the company is now on .

Moving to a higher level
By receiving information from the questionnaire and checking the current situation of your company ,Now we know that XYZ is on the Repeatable level and preparing to move to level 3 (Defined levels).
Level-3, ‘The Defined Level’ is defined as follows :
At the Defined Level, the standard process for developing, maintaining software across the organization is documented, including both software engineering and management processes, and these processes are integrated into a coherent whole. The standard process is referred to throughout the CMM as the organization’s standard software process. Processes established at Level-3 are used (and changed, as appropriate) to help the software managers and technical staff perform more effectively. The organization exploits effective software engineering practices when standardizing its software processes.

The software process capability of Level-3 organizations can be summarized as standard and consistent because both software engineering and management activities are stable and repeatable. Within established product lines, cost, schedule, and functionality are under control, and software quality is tracked. This process capability is based on a common, organization-wide understanding of the activities, roles, and responsibilities in a defined software process.

Here are the KPAs of defined level ,their goals and my recommendation .
4.1 Organization Process Focus
Goal-1: Software process development and improvement activities are coordinated across the organization.
Goal-2: The strengths and weaknesses of the software process are identified relative to a process standard.
Goal-3: Organizational-level process development and improvement activities are planned.
The purpose of Organization Process Focus is to establish the organizational responsibility for software process activities that improve the organization’s overall software process capability.
For XYZ ,they should first set a business plan ,which defines the company’s overall strategy and outlines how each function collaborates to deliver products and services to customer ,then make accounting model,which includes the basic assumption ,principles and procedures that govern the recording ,measuring and reporting of the entity’s financial transactions .Also ,deciding the organization structure ,setting a process standard are helpful to maintain a process-focused organization .
4.2 Organization Process Definition
Goal-1: A standard software process for the organization is developed and maintained.
Goal-2: Information related to the use of the organization’s standard software process by the software projects is collected, reviewed, and made available.
For XYZ ,The company should establish and maintain standard processes ,Tailoring criteria and guidelines ,measurement repository ,work environment standard and rules for integrated teams .
4.3 Training Program
Goal-1: Training activities are planned.
Goal-2: Training is provided for developing the skills and knowledge needed to perform software management and technical roles.
Goal-3: Individuals in the software engineering group and software-related groups receive the training necessary to perform their roles.
4.4 Integrated Software Management
Goal-1: The project’s defined software process is a tailored version of the organization’s standard software process.
Goal-2: The project is planned and managed according to the project’s defined software process .
The purpose of Integrated Software Management is to integrate the software engineering and management activities into a coherent, defined software process that is tailored from the organization’s standard software process and related process assets .
4.5 Software Product Engineering
Goal-1: The software engineering tasks are defined, integrated, and consistently performed to produce the software.
Goal-2: Software products are kept consistent with each other.
To achieve these goals ,the members of the software engineering technical staff should receive training to perform their technical assignments.The software design should be developed, maintained, documented, and verified, according to the project's defined software process, to form the framework for coding and to accommodate the software requirements .
4.6 Intergroup Coordination
Goal-1: The customer’s requirements are agreed to by all affected groups.
Goal-2: The commitments between the engineering groups are agreed to by the affected groups.
For XYZ ,Adequate resources and funding should be provided for coordinating the software engineering activities with other engineering groups.
All managers in the organization should receive required training in teamwork.
The software engineering group and the other engineering groups should participate with the customer and end users, as appropriate, to establish the system requirements.
4.7 Peer Reviews
Goal-1: Peer review activities are planned.
Goal-2: Defects in the software work products are identified and removed.

For XYZ ,Peer review leaders should receive required training in how to lead peer reviews.
Peer reviews should be planned, and the plans should be documented
Peer reviews should be performed according to a documented procedure.

These 7 KPAs and their goals is a great suggestion for you to manage your company and prepare to move to the defined level .

Conclusion
The bottom line is that software process improvement should be done to help the business – not for its own sake. This is true for both large organizations and small.The CMM represents a “common sense engineering” approach to software process improvement. Its maturity levels, key process areas, goals, and key practices have been extensively discussed and reviewed within the software community. While the CMM is neither perfect nor comprehensive, it does represent a broad consensus of the software community and is a useful tool for guiding improvement efforts, and it can be uses to help small software organizations improve their processes .Since your company is now on Repeatable level and preparing to move to the defined level ,I can highly recommend it to you .

References:
1. Organizational Process Definition (OPD) , Richard A. Caralli Julia H. Allen Pamela D. Curtis David W. White Lisa R. Young
2.CMM for Small Organisations ,Terttu Orci and Astrid Laryd
3.Using the Software CMM , Mark C. Paulk
4.Implementing the Capability Maturity Model for Software Development , Douglas E. Lowe and Guy M. Cox
5.Reaching CMM Levels 2 and 3 with the Rational Unified Process
6. "Key Practices of the Capability Maturity Model - Version 1.1", Software Engineering Institute - Carnegie Mellon University. Mark C. Paulk et al