Changes in CMMI V3

Introduction

(Updated 10/2/23 with releasee dates and SAM applicability)

CMMI version 3 is coming in 1Q2024. This article explains the main changes.

See the related video on YouTube

The main communication points from ISACA (the custodian of the CMMI) are:

• A new model architecture to reduce the time and resources it takes to make updates
• New Practice Areas (PA) covering safety, security, data management, staff development, and virtual delivery

The main changes in Version 3 are:

• Maturity Level 2 is now defined as all Practice Areas at Capability Level 2; this a major change in philosophy
• Supplier Agreement Management has two additional practices for supplier selection (from a previous model version)
• The new PAs (described below)

All the other Practice Areas in the Development and Services model remain unchanged apart from some minor wording updates.

The New Definition of Maturity Level 2

Figures 1 and 2 (below) show Maturity Level 2 in the old and new versions.

The reason for the change is that ISACA thinks of the model now as a methodology for performing work defined at different levels of process maturity, rather than a maturity model that defines priorities for improvement. The model was originally intended as a maturity model that guided an organization on what practices to master before taking on more advance practices (e.g., mastering estimation and commitments before mastering design). The rationale was that unless you have good planning in place, there will be little time for tasks such as design, since the project will end up as a death march without a plan.)

Figure 1 — Green Block = Maturity Level 2 in CMMI Version 2

 

Figure 2 — Green Block = Maturity Level 2 in CMMI Version 3

 

An example version 3 argument would be as follows: Since all teams need to do design (substitute any CMMI topic for the word design), make sure design is performed at each maturity level, even if that is Maturity Level 1 or 2. In version 3, process maturity is the improvement of all processes in parallel instead of focusing on project management and project scope management as a foundation.

How You Could Use V3 of the Model

Just because Maturity Level 2 has been redefined to include all PAs, it does not mean that you must adopt all PAs at once. You can still adopt them in the order you need based on the challenges you have.

Here are some examples of the order they could be adopted in.

• Focus first on the old ML2 Practice Areas to make sure projects are well managed
• Use process improvement planning (PCM Practice Area) to plan for model adoption. Start with a simple task list that defines what, who, and when
• Add risk and opportunity management (RSK) to your project planning activities
• Adopt peer reviews (PR) to find errors in requirements and proposals
• Run a causal analysis (CAR) on a few project successes and failures to see what you can learn

Changes in the Development and Services Model Practices

The changes in the DEV and SVC model practices are listed below. They are mostly very minor.

• CAR: Deleted the word “root” from “root cause.
• GOV: Minor word changes to practices 2.2, 2.3, and 4.1.
• II:  Added new practice 4.1 – Develop the organizational capability to understand and apply statistical and other quantitative techniques to accomplish the work.
• MPM: Minor word changes to practices 3.5. 5.1, 5.2, and 5.3.
• OT: Minor word changes to practice 3.5.
• PLAN: Changed wording in 2.6 from “Ensure plans are feasible by reconciling available and estimated resources” to “Ensure plans are feasible by reconciling estimates against capacity and availability of resources.”
• PAD: Deleted practice 3.5 (“make assets available”) since it was redundant with practice 3.3. The new 3.3 practice is “Develop, keep updated, and make the organization’s processes and assets available for use in a process asset library.”
• PCM: Minor word changes to practice 3.6.
• RDM: Merged 2.1 and 2.3 into 2.1 which is now “Elicit stakeholder needs, expectations, constraints, and interfaces or connections, and confirm understanding of requirements.”
• SAM: Practices 2.1 and 2.2 have been brought back from earlier versions. SAM is now:
  • 2.1 Identify evaluation criteria, potential suppliers, and distribute supplier requests.
  • 2.2 Evaluate supplier responses according to recorded evaluation criteria and select suppliers.
  • 2.3 Manage supplier activities as specified in the supplier agreement and keep agreement updated.
  • 2.4 Verify that the supplier agreement is satisfied before accepting the acquired supplier deliverable.
  • 2.5 Manage invoices submitted by the supplier according to the supplier agreements.
  • 3.1 Conduct technical reviews of supplier performance activities and selected deliverables.
  • 3.2 Manage supplier performance and processes based on criteria in the supplier agreement.
  • 4.1 Select measures and apply analytical techniques to quantitatively manage suppliers against their performance targets.

The new PAs are listed below. All of the changes from V2 are listed in a document created by Pat O’Toole click here to download

New Available Practice Areas

The primary reason for CMMI V3 is to promote the PAs listed below. They are not required to be used.

• Data Management (DM)
• Data Quality (DQ)
• Enabling Safety (ESAF)
• Enabling Security (ESEC)
• Enabling Virtual Work (EVW)
• Managing Security Threats & Vulnerabilities (MST)
• Workforce Empowerment (WE)

Each one is based on the format, Plan X, Do X, Check X, and Act on the results of X. The downside of this is that you could define X to be trivial and then appraise Maturity Level 3 with a trivial implementation. Only time will tell to see who adopts them.

If you decide to include one or more of these in a CMMI appraisal, the appraisal team will need to take a new four-day Building Organizational Capability class that covers all Practice Areas. There will also be a new Practitioner exam to go along with the class. There is a self-study option available through 3/31/24 to save on class costs.

This new class is additional to the existing classes, Foundations of Capability (two days, covering the core PAs) and Building Excellence (e.g., 1-day DEV and 1-day SVC class). These existing classes will be updated to cover changes in the DEV and SVC models.

Paths Forward

You have two basic paths to choose from:

A) If you are planning on a DEV or SVC appraisal, then:

• Existing appraisal team members (ATM) who are trained in CMMI V2 only need to pass the Associates exam when their certification expires after three years. The new exam will cover some of the V3 changes, so work with your LA to learn about them.
• New appraisal team members (who have not taken a CMMI V2 Foundations and DEV/SVC class) need to take the appropriate classes and pass the Associates exam.

B) If you are planning on appraising one or more of the new PAs, then the appraisal team will have to:

• Take the new Four-day Building Organizational Capability class and pass the new Practitioner exam. The class will be offered through your Lead Appraiser (LA) if the appraiser has chosen to pursue the new PAs. There is a self-study option available through 3/31/24 to save on class costs.
• Verify appraisal team member domain experience. The ATMs will still be subject to the experience requirements for an appraisal. For example, if you are on a Data Management appraisal, the team will need 15 years of domain (Data Management) experience, and only one team member can have less than 2 years of experience. This might become a challenge to find the right people for the team. LA years of experience are not used in the calculation.

The LA will need between five and eight years of experience in the selected domain to qualify as an LA for that domain, and that might eliminate many LAs from getting certified to lead these new appraisals.

Appraisal Method Changes

• Updated 10/2/23: It is unclear whether SAM is optional or not. SAM is in the Supplier domain, and domains are optional, but CMMI Institute says that SAM is not optional. Assume for now SAM is a really good idea to protect your interests from bad suppliers. I have asked CMMI Institute for more clarification. I will update this section if anything becomes clearer.
• There are no other major changes to the appraisal method in V3 (that we know of).

CMMI Fees

Appraisal method

The CMMI Institute appraisal fee is still $1,500 per appraisal and $2,000 for High-maturity appraisals.

CMMI class

The virtual-delivery fee for classes has been removed. For classes starting on or after September 1, 2023, the CMMI Institute fees are:

• Foundations of Capability: $400/seat
• Building DEV/SVC Excellence: $125/seat
• Building Organizational Capability (new class for the new PAs): $650/seat
• High Maturity Concepts: $125/seat
• Virtual delivery fee: $0

These are in addition to the fee you pay the instructor to conduct the class or appraisal.

Transition Dates for V3 (updated 10/2/23)

The official CMMI Institute word (as of 9/29/23) is:

• “31 January 2024 – is the last day to request a random sample for v2.2 appraisals
• “13 February 2024 is the last day to get a random sample for v2.2 approved”
• “14 May– last day 2.2 appraisals must be phase 3 complete (final appraisal reporting date)”

I infer from this:

• Feb 1 is the earliest date to get a sample for a V3 appraisal since CAS supports v2 until Jan 31, and then it supports v2 from Feb 1.
• March 6th is the earliest date a v3 appraisal can be conducted since there has to be 35 days between the sample and the first day of Phase 2, the onsite period
• If you want appraise v2, start the onsite period before the end of March, get the sample by Jan 31st
• If you want to appraise v3, you can have an onsite start date of approximately March 6th or later

It is not clear if the CAS appraisal website will support both v2 and v3 appraisals at the same time, and how different model versions will be entered and managed by CAS.

Conclusion (Neil’s and Mary’s Opinion)

• The new definition of ML2 is a shift in what the original model was intended to be.
• Not many organizations target ML2 so it will not present a challenge very often. Groups that were going to target ML2 might now target ML3 since all the PAs have to be addressed.
• Neil and Mary don’t plan on pursuing the new PAs since we really have no expertise in them and don’t think the demand will be very high.

Please feel to contact us if you need help improving or navigating CMMI.

You can see all of the model changes in a document created by Pat O’Toole click here

[Forward this email to your boss! Subject: CMMI V3 changes] Quick Link

 

---

Version 3 New Practice Areas

Data Management (DM)

DM 1.1 Identify data management objectives.
DM 1.2 Use metadata to manage data.
DM 2.1 Develop, keep updated, and follow a data management approach that is aligned to objectives.
DM 2.2 Establish a data management architecture to support the data management approach.
DM 3.1 Establish and deploy an organizational data management capability.
DM 3.2 Perform reviews periodically on the effectiveness of the organization’s data management capability and take action on results.

Data Quality (DQ)

DQ 1.1 Identify data quality parameters.
DQ 1.2 Perform data cleansing activities.
DQ 2.1 Define criteria for data cleansing.
DQ 2.2 Develop, keep updated, and follow a data quality approach.
DQ 2.3 Perform data cleansing based on criteria and data quality approach.
DQ 3.1 Conduct data quality assessments.
DQ 3.2 Perform reviews periodically on the effectiveness of the organization’s data quality activities and take action on results.

Enabling Safety (ESAF)

ESAF 1.1 Identify and record safety needs and hazards.
ESAF 1.2 Address prioritized safety needs and hazards.
ESAF 2.1 Identify critical safety needs and constraints, keep them updated, and use to develop and keep safety objectives current.
ESAF 2.2 Develop, keep updated, and follow an approach to address workplace environment safety.
ESAF 2.3 Develop, keep updated, and follow an approach to address functional safety for the solution.
ESAF 3.1 Establish and deploy an organizational safety capability.
ESAF 3.2 Perform safety evaluations periodically and take action on results.
ESAF 3.3 Develop, keep updated, and follow organizational safety control strategies.

Enabling Security (ESEC)

ESEC 1.1 Identify and record security needs and issues.
ESEC 1.2 Address prioritized security needs and issues.
ESEC 2.1 Identify and record security needs, keep them updated, and use to develop a security approach and objectives.
ESEC 2.2 Develop, keep updated, and follow an approach to address physical security needs.
ESEC 2.3 Develop, keep updated, and follow an approach to address mission, personnel, and process-related security needs.
ESEC 2.4 Develop, keep updated, and follow an approach to address cybersecurity needs.
ESEC 3.1 Establish and deploy an organizational security operations capability.
ESEC 3.2 Develop, follow, and implement an organizational security strategy, approach, and architecture; and keep them updated.
ESEC 3.3 Periodically perform security reviews and evaluations throughout the organization and take action on results.

Enabling Virtual Work (EVW)

EVW 1.1 Identify and record virtual work needs and constraints.
EVW 1.2 Perform virtual work.
EVW 2.1 Develop, keep updated, and use an approach to perform virtual work.
EVW 2.2 Monitor the virtual work approach and take corrective action when needed.
EVW 3.1 Develop, keep updated, and use an organizational strategy, approach, and functional capability for performing virtual work.
EVW 3.2 Perform reviews periodically on the effectiveness of the organization’s virtual work approach and take action on results.

Managing Security Threats & Vulnerabilities (MST)

MST 1.1 Identify and record security threats and vulnerabilities.
MST 1.2 Take actions to address security threats and vulnerabilities.
MST 2.1 Develop, keep updated, and follow an approach for handling security threats and vulnerabilities.
MST 2.2 Develop and keep updated criteria to evaluate security threats and vulnerabilities.
MST 2.3 Use recorded criteria to prioritize, monitor, and address the most critical security threats and vulnerabilities that arise during operations.
MST 2.4 Evaluate and report the effectiveness of the approach and actions taken to address critical security threats and vulnerabilities to the solution.
MST 3.1 Develop, keep updated, and follow an organizational security strategy, approach, and architecture to evaluate, manage, and verify threats and vulnerabilities.
MST 3.2 Analyze security verification and validation results to ensure accuracy, comparability, consistency, ad validity across the organization.
MST 3.3 Evaluate effectiveness of the organizational security strategy, approach, and architecture for addressing security threats and vulnerabilities.

Workforce Empowerment (WE)

WE 1.1 Identify and allocate commitments to workgroups.
WE 2.1 Record and allocate work assignments and keep them updated based on an assessment of qualifications, skills, and related criteria.
WE 2.2 Manage the transition of individuals in and out of roles and workgroups.
WE 2.3 Develop, keep updated, and use communication and coordination mechanisms within and across workgroups.
WE 3.1 Develop, keep updated, and use workforce competencies to build organizational capabilities and achieve objectives.
WE 3.2 Develop, keep updated, and use an organizational structure and approach to empower workgroups.
WE 3.3 Develop, keep updated, and use organizational compensation strategies and mechanisms.