CMM AND ISO CERTIFICATION GRANT GRIFFEY JOHN ALEXANDER

CMM AND ISO CERTIFICATION GRANT GRIFFEY JOHN ALEXANDER DAVID SOLOVITZ KATIE MANAHAN

Presentation Objectives Explanation of CMM n CMM Case Study – Infosys n Explanation of ISO – 9000/14000 n ISO Examples – Baublitz Advertising and Industrial Security Services Inc. n Comparison n Questions? n 2

Capability Maturity Model What is it? n What is it’s purpose? n How does it help the company? n What are the major advantages? n What are the major disadvantages? n What is the future of CMM? n 3

What is CMM? n Capabilities Maturity Model n Quantifies ability for a company to produce high quality software (10) 4

History of CMM n In 1984, Congress founded a non-profit group that could impact the growing field of IT and obtain standardized, consistent processes n Created Software Engineering Institute or SEI, which was headquartered at Carnegie Melon University at Pittsburgh (7) 5

History of CMM In 1991, the first version of CMM was created by SEI n Was created to help improve the practice of software engineering and establish protocols and methodologies in software development n By 2003, over 2000 organizations have been appraised n (7) 6

What is CMM? Describes a framework of 5 stages of software maturity (9) 7

Predictability/Risk Relationship (7) 8

Country India USA China Australia Canada Russia France Ireland Israel Singapore Level 4 27 39 0 2 0 0 1 1 Level 5 50 20 2 0 1 1 0 0 (5) Total 77 59 2 2 1 1 1 9

Key Process Areas Each level of CMM specifies not only general goals, but defines how the company/organization should operate at each level n Key process areas are major functional areas that need to be incorporated into the organization when working with CMM n (7) 10

LEVELS OF CMM n Level 1 – Initial ¨ n Level 2 – Repeatable ¨ n 28 months to get to level 4 Level 4 – Managed ¨ n 23 months to get to level 3 Level 3 – Defined ¨ n 25 months to get to level 2 15 months to get to level 5 Level 5 - Optimizing (8) 11

LEVEL 1 - INITIAL n Characteristics ¨ Processes are chaotic and disorganized ¨ Few formal rules ¨ Most companies would achieve Level 1 if they were assessed ¨ Comprises approx. 12% of certifications between 1998 -2001 (8) 12

Level 1 Key Process Areas n According to Persee in Implementing the Capability Maturity Model, most groups qualify for level 1 certification without knowing it. ¨ Have no processes for software development ¨ Have processes in place without formal assessment n Therefore, there are no key processes (7) 13

CMM Case Study - Infosys n Infosys is a software house based in ¨ Bangalore, India n Revenues have grown at an annual rate of over 70% each of the last 5 years n Infosys has been assessed at level 4 of the CMM (11) 14

Level 1 – Initial (Infosys) n n n At level one a customer will get in contact with Infosys Customer will request information from Infosys about itself. This is called request for information (RFI) If only a single project is the goal, the customer will then send back a request for proposal (RFP) (11) 15

Level 1 – Initial (Infosys) n n n From RFP, Infosys will prepare and send a proposal. Many models for proposal ie. Fixed price – RFP is analyzed and a cost is determined from estimating manpower effort and scheduling Proposal is fixed because customer will give agreed price unless requirements change Requirements usually change, and projects are split into two parts ¨ Creating detailed requirements analysis ¨ Developing the software (11) 16

LEVEL 2 - REPEATABLE n Characteristics Defined and documented processes ¨ Success is repeated ¨ Basic project management techniques track costs, schedules, etc ¨ Largest percentage of companies assessed between 1998 -2001 ¨ (8) 17

Level 2 Key Process Areas n Establish basic set of management controls ¨ Requirements management ¨ Software project planning ¨ Software project tracking and oversight ¨ Software quality assurance ¨ Software configuration management ¨ Subcontractor management (7) 18

Level 2 – Repeatable (Infosys) n Two major activities ¨ Requirements analysis and specification ¨ Requirements change management Main objective of requirements analysis is to produce the software requirement specification document (SRS) Step by step process for requirements analysis Prepare – Gather/elicit requirements – Analyze – Prepare SRS – Review – Obtain sign off (11) 19

Level 2 – Repeatable (Infosys) n n Requirements change management Changes can come at any time during a project Process for dealing with changes ¨ ¨ ¨ ¨ Log the changes Perform impact analysis on the work products Estimate effort needed for the change request Re-estimate delivery schedule Perform cumulative cost impact analysis Review the impact with senior management if thresholds are exceeded Obtain customer sign-off Rework products A danger of requirements change is that even though changes are usually small, the cumulative effect can be great (11) 20

LEVEL 3 - DEFINED n Characteristics ¨ Standardized software process meets organizations needs ¨ Process follows defines process (8) 21

Level 3 Key Process Areas n Emphasizes project and organizational issues ¨ Organizational process focus ¨ Organizational process definition ¨ Process training program ¨ Integrated software management ¨ Software product engineering ¨ Inter-group coordination ¨ Peer reviews (7) 22

Level 3 – Defined (Infosys) n n n KPA – Peer Review Defects are inevitable, reviews are done to identify defects The best form of review is a formal group review (in authors opinion) 4 stages to a group review Planning Verify entry criteria Select the group review team Prepare the group review package (11) 23

Level 3 – Defined (Infosys) n Overview and Preparation Call a meeting to describe review objectives Provide an overview of the work product Review group review work individually n Group Review Meeting Conduct meeting Record defects Summarize issues and close meeting n Rework and Follow-up Perform rework to fix defects detected Perform investigation and provide results to author Prepare a summary report and send it to the SEPG (11) 24

LEVEL 4 - MANAGED n Characteristics Processes are predictable ¨ Management can adjust processes to specific projects without affecting overall quality ¨ Detailed measurements of process and product quality are collected ¨ 65% of Motorola’s Global Software Group is at Level 4 or greater ¨ (8) 25

Level 4 Key Process Areas n Establish quantitative understanding of software process and software products ¨ Quantitative process management ¨ Software quality management (7) 26

Level 4 – Managed (Infosys) The goal of quality management is to plan quality control activities and to properly execute and control these activities so that defects are detected before software is delivered n The later a defect is detected, the more it cost to remove n (11) 27

Level 4 – Managed (Infosys) n Quality Management ¨ Quality management focuses on the defect injection and removal cycle (11) 28

Level 4 – Managed (Infosys) n Quantitative Quality Management Human reviews are done during RA, Design, and coding phases. ¨ After these phases comes the testing ¨ UT, IT/ST and AT (quantitative) ¨ (11) 29

Level 4 – Managed (Infosys) n Defect Removal Efficiency ¨ Tool used to measure effectiveness of quality control activities ¨ DRE = (11) 30

LEVEL 5 - OPTIMIZING n Characteristics ¨ Processes are continuously improving through feedback and shared ideas ¨ 147 organizations from 10 different countries that have achieved Level 5 certification (8) 31

Level 5 Key Process Areas n Addresses issues for continuous, measurable software process improvement ¨ Technology change management ¨ Process change management (7) 32

How to reach level of CMM n 6 stage process involving senior management and coaches from SEI or other licensed assessment vendor ¨ 1. ¨ 2. ¨ 3. ¨ 4. ¨ 5. ¨ 6. Selection stage Commitment stage Preparation stage Assessment phase Report stage Assessment follow-up stage (8) 33

How to Reach level of CMM n No reassessment is completed once a company achieves any level of CMM ¨ Assumed that company will continue to maintain levels achieved (8) 34

CMM success factors and pitfalls n Creating strategic motivation to pursue certification ¨ ¨ Internal – help build capabilities crucial to success of company External – reassurance of customers ¨ ¨ n Increases visibility to customers Customer recognition of certification importance may not reflect changing in their own organization with regards to maturity Sustaining management commitment Necessary for substantial time and financial investment by management ¨ Improper motivation for obtaining CMM certification ¨ Expenditure versus investment ¨ (8) 35

CMM Success Factors and Pitfalls n Ensuring organizational socialization to encourage developer buy-in for process discipline Shift in attitude from independent to interdependent ¨ Everyone may not be “on board” ¨ n Broad participation in defining and refining processes Involve as many people as possible to foster acceptance of program ¨ Managers do not explain rationale behind some process requirements ¨ (8) 36

Benefits of CMM Certification n Productivity increases ¨ According to one study, software productivity increased 35% n Decrease in defects ¨ Post-release n defects lowered by 39% Cost savings ¨ 9. 2 million dollars were saved within a 3 year period on software re-works (9) and (10) 37

International Standards Organization n n The international standards organization specifies requirements for a quality management system Basic form of the Standard requires: ¨ Understand product and service requirements ¨ Establish processes to meet those requirements ¨ Provide resources to run the processes ¨ Operate, monitor, and measure the processes ¨ Improve continuously, based on analysis of the results (12) 38

Model of a process-based quality management system (3) 39

“Plan-Do-Check-Act” Methodology n Plan ¨ n Do ¨ n Monitor and measure processes Act ¨ (12) Implement the processes Check ¨ n Establish objectives and processes Take actions to continually improve process performance 40

ISO Certification n n ISO consists of members from 156 countries on the basis of one member per country. Full members: ¨ Member n bodies = one vote Members from countries with non developed national standards activity: ¨ Correspondent n members = no vote Members from countries with small economies: ¨ Subscriber members (1) 41

ISO Certification Central Secretariat in Geneva, Switzerland n Permanently appointed n Reports to the ISO Council n ISO Council develops proposals for standards to be presented to ISO members n (1) 42

ISO Certification ISO’s principal activity is the development of technical standards n These standards contribute to making the development, manufacturing and supply of products and services more efficient, safer and cleaner n (1) 43

ISO Certification ISO officially began operations on February 23, 1947 n Delegates from 25 countries met in London and decided to create an organization with the mission of “to facilitate the international coordination and unification of industrial standards. ” n (1) 44

Top Ten Countries for ISO Certifications in 2004 n n n n n 1. China 2. Italy 2. United Kingdom 3. United States 4. Germany 5. Japan 6. Spain 7. Australia 8. France 9. Korea (5) 45

(3) 46

Benefits to Society n Businesses ¨ Allows them to produce a product under worldwide standards n Customers ¨ Provides a wider range of products ¨ More competition between producers n Governments ¨ Provide standards on health, safety and environmental legislation (1) 47

Benefits to Society n Trade Officials ¨ Helps create a more level playing field for all competitors n Developing Countries ¨ Helps these countries invest their scarce resources more wisely in order to produce products that meet worldwide standards n Consumers ¨ Provides assurance of quality, safety, and reliability (1) 48

Benefits to Society n Everyone ¨ Assures the things we use in everyday life are of the highest quality n Planet ¨ Provides standards on air, water and soil quality (1) 49

Particulars of ISO n Equal treatment ¨ All full members have the right to take part in any activity ISO is involved in n Voluntary ¨ All of ISO’s standards are voluntary. ISO has no legal authority to impose it’s standards. (1) 50

Particulars of ISO n Market-driven ¨ Market requirements are what drive standards development n Consensus ¨ Helps ensure application of standards due to the market demand for these standards and the agreement of interested parties on the standards (1) 51

Particulars of ISO n Worldwide ¨ Worldwide standards are difficult to implement ¨ ISO has some 3, 000 technical groups with some 50, 000 experts to develop standards n A process that has been set to an ISO standard is only useful if it achieves the desired output. ISO will only accomplish the exact same undesired output every time. (1) 52

Facts about ISO n Number ¨Since of Standards 1947 the ISO has developed n 15, 036 (1) 53

ISO 9000 “Provides a framework for quality management throughout the processes of producing and delivering products and services for the cutomer. ”(1) n >500, 000 organizations in 149 countries have implemented ISO 9000 n (1) 54

ISO 14000 Primarily concerned with environmental management. n “Helps companies minimize harmful effects on the environment caused by it’s activities, and continually to improve its environmental performance. ”(1) n (1) 55

(4) 56

ISO Examples – Baublitz Advertising 21 year old business wholly owned by The Wolf Organization Inc. n Located in York, Pennsylvania n First advertising company to receive ISO 9001 certification in September 1997 n (2) 57

ISO Examples – Baublitz Advertising They were looking to gain competitive advantage n Baublitz President – James Groff has stated: n ¨ “We saw (standardization of quality) going on in the industry with our clients” ¨ “It adds accountability and concreteness to a business that has not been known for it” (2) 58

ISO Examples-Industrial Security Service Inc. n n A midsized guard-services company based in Ohio Began the process to become ISO certified in 1999 Received ISO 9001: 2000 certification in February 2004 With the ISO certification it allowed the company to go from a small, single-site company to a multi -site company with three corporate offices (6) 59

ISO Examples-Industrial Security Service Inc. n Recognized benefits ¨ An increase in operational efficiency ¨ Measurable rise in customer satisfaction ¨ Identified was to decrease indirect costs ¨ Gained insight in security officer retention trends ¨ Has the ability to better justify costs (6) 60

ISO and CMM Comparison (5) 61

Questions?

References n n n 1. http: //www. iso. org, viewed October 2005 2. Gaboda, Gail “Ad agency uses ISO certification to gain competitive edge” Marketing News Chicago: December 8, 1997 Volume 31, Issue 25 page 2 3. West, John E. “Guidance Documents for Using ISO 9001 Effectively” Quality Digest August 2005 4. Berchelor, Sylvie and Coulmont, Michel “ISO 14000 -a profitable investment? ” CMA Management Hamilton: November 2004 Volume 78, Issue 7 page 36 5. Griggs, Gary M. “Quality Management of the Software Industry” May 19, 2004 63

References (continued) n n 6. Ricci, Joseph “ISO Proof of Quality” Security Management Arlington: March 2005 Volume 49, Issue 3 page 31 7. Perse, James R. Implementing the Capability Maturity Model 2001 page 5 8. Adler, Paul, Binney, Derek, Irion-Talbot, Wendy, and Mc. Garry, Frank "Enabling Process Discipline: Lessons from the Journey to CMM Level 5" MIS Quarterly Executive Volume 4, Number 1, March 2005 page 215 -227 9. Freedman, Rick "More on Standards-Based IT Consulting" Consulting to Management June 2005 Volume 16, Issue 2 page 43 64

References (continued) n n n 10. Kesh, Someswar and Ramanujuan, Sam “Comparison of Knowledge Management and CMM/CMMI Implementation” The Journal of American Academy of Business, Cambridge March 2004 Volume 4 pages 271 -277 11. Jalote, Pankaj CMM in Practice-Processes for Executing Software Projects at Infosys Reading, Mass. ; Wokingham, England : Addison-Wesley, 2000 12. Beaumont, Leland R. ISO 9001, The Standard Interpretation: The International Standard for Quality Management Systems Third Edition; Middletown, NJ. ; ISO Easy 2002 pages 9 -16 65