Original perspective on the Capability Maturity Model


The Capability Maturity Model (CMM) was developed by Watts Humphrey at Carnegie Mellon in the late 1980s to improve the quality of software development.  This idea was replicated in many fields with Maturity Models sprouting in Project management, Risk management, Vendor management, Service management and People management to name a few.

CMM is used mainly as a benchmarking tool, with the original idea of process improvement left in the wake of enthusiasm. This article seeks to rediscover the philosophy of CMM and help organisations make real improvements across multiple disciplines.


Crosby proposed the structure underpinning CMM. He described the following five progressive stages in the quality management maturity grid:

  • Uncertainty: “We don’t know why we have problems with quality.”
  • Awakening: “Is it necessary to always have problems with quality?”
  • Enlightenment: “Through management commitment and quality improvement we are identifying and resolving our problems.”
  • Wisdom: “Defect prevention is a routine part of our operation.”
  • Certainty: “We know why we don’t have problems with quality.”

From this platform Humphrey developed the concept of the process maturity framework  after realizing that Deming’s quality improvement cycle should be installed in sequential steps to remove impediments to continuous improvement. Organisations should go ahead in a systematic way to create the environment supporting continuous improvement.

The original formulation of CMM adopted Crosby’s approach of developing each process through these five stages; however organisations were not succeeding sustaining the adoption of improved practices when they applied the framework to each processes. There were serious obstacles that had to be removed before improvements could become permanent and benefits sustained. Most of the problems had roots in the organisational culture requiring a different strategy to discuss the transformation as a whole, not just at the single process level.

Statistical process control

Statistical process control is a technique for quality control that uses statistical methods to check processes ensuring that they run at their full potential with least waste. An advantage of this technique is that it focuses on the prevention of problems, rather than correction after they have occurred. In addition to reducing waste, the technique also leads to a reduction in the time required to produce results by identifying delays and lack of coördination causing process inefficiency. Every process displays variations, some are natural to the process whilst others can be attributed to causes external to the process.

  • Common causes of variation: – sometimes called “normal” or “chance” sources of variation.
  • Special causes of variation: – sometimes called “systemic” sources of variation.

A process can show multiple sources of variation, and if these variations are within agreed limits it is said to be stable. A stable process can be improved by modifying one or more of its components in a controlled way. If a process variation falls outside the control limits then the sources of variation must be removed before improvements can be applied for sustained performance.

The discovery of CMM is the realisation that improved practices do not survive unless the organisation changes its culture and fully embraces the statistical process control method. The design of CMM enables an organisation to meet a state of continuous process improvement in five defined steps.

The process maturity framework is more than a process standard comprising a list of best practices used as a benchmark; it defines practices that take organisations through a cultural transformations, with each step supporting the deployment of more advanced and mature processes, serving as a solid platform to move to the next step.

At the completion of the journey through the five steps organisations becomes capable of continuous improvement and are able to make changes with permanent improvements locking in sustained benefits.

The five stages of the CMM model 

The five levels of process maturity are as follows:


Initial – no orderly progress in process improvement is possible before the process is under statistical control.

At the first level of maturity organisations have no defined processes. Work is performed by constantly reinvention with frequent and expensive errors. Results depend largely on the personal skills and commitments.  People are the most important asset because there are no processes that add value to the efforts of the people.

In this stage processes are not stable and produce large variations in the performance and quality of outputs.

Repeatable – a stable process with a repeatable level of statistical control is achieved by implementing change management control.

Organisations must learn to manage change to stabilise the performance and quality of the process results. The primary aim of this level of maturity is to enable repeatability. This requires basic change management practices to protect processes from erratic change. Establishing these management disciplines within the organisation is critical before common processes can be successfully deployed in a stable way.

Defined – definition of the process is necessary to assure consistent implementation across the organisation and for the introduction of supporting technology.

At this level of maturity organisations can find the best approaches and integrate them into a common set of process deployed across the entire enterprise. This is the foundation for a professional culture that acts as a catalyst for further unification of the entire organisation.

Managed – having locked best practice processes in place it is possible to start measurements.

Organisations are in a place to collect and analyse process data. The performance of the organisation can now be studied statistically and predictions made about performance and quality.

The main purpose during this stage is to name and isolate different causes of variation so they can be managed and optimised independently. A process with multiple causes of variation is not under statistical control and cannot be optimised.

Decisions about process changes can be based on cost benefit analysis and benefits can be realised in a predictable manner. This is where significant quality improvements begin to appear.

Optimised – The foundations are finally in place for continuous improvement and process optimisation.

It is now possible to use quantitative observations to make continuous improvements to core processes. Adjustments to operation and adaptation to external changes is accomplished in a predictable manner.

The key element of this stage is statistical process control. This means that the first-order systemic causes of variation have been removed, and the process outcome is stable. This allows operational changes to be implemented in a controlled way to cut variability due to common causes of variation.

Process assessment

The international standard ISO 15504 “Information technology – Process assessment” defines a model containing a process dimension and a capability dimension. The process dimension is provided by an external Process Reference Model, which defines a set of processes characterised by statements of process purpose and process outcomes. The capability dimension consists of a measurement framework with six levels of capability maturity, with each level having a number of process attributes.


  • N – not achieved – 0 to 15%
  • P – partially achieved >15% to 50%
  • L – largely achieved – >50 to 85%
  • F – fully achieved – >85 to 100%

This norm is intended for capability assessment and process improvement against the chosen Process Reference Model.

Several methodologies outside Carnegie Mellon have developed capability maturity models using the ISO standard, including Management of risk: Guidance for practitioners (M_o_R);  Portfolio, Programme and project Management Maturity Model (P3M3), Organizational Project Management Maturity Model (OPM3), and COBIT 5.

All these methodologies use the model primarily as a benchmark tool against their proprietary frameworks.


The maturity framework guides organisations to build an environment where

  • Best practices are shared by the entire organisation
  • There are minimal variations in performance and quality
  • Processes are continuously improved

CMM assumes that the real benefits of maturity can only be achieved at the organisation level, not at the process level. Maturity must be developed in progressive steps, each one requiring having mastered the previous level of maturity. Trying to implement CMM at a process level encounters significant cultural resistance and is not sustainable.

The real goal of the CMM is to be able to perform Process Statistical Control. This in turn enables the entire organisation to meet a state of continuous improvement.
The fundamental premise of the model is that advanced practices should not be attempted until the foundation of practices required to support them has been mastered. The practices at each level of maturity prepare the organization to adopt practices at the next level.

The real benefits of implementing CMM can only begin to be realised after the last stage of maturity is achieved, there are no significant benefits to be obtained in a sustainable way with an incomplete implementation.


Crosby, P. B.(1979) “Quality Is Free: The Art of Making Quality Certain”
Deming, W. E. (1986). “Out of the Crisis”
Humphrey, W. S. (1988) “Characterizing the Software Process”
ISO 15504 (2004) “Software engineering – Process assessment”