Where CMM Comes From

The CMM was a direct response to the Air Force’s frustration with its software buying process in the 1980s. The Air Force and other DoD divisions had begun farming out increasing amounts of development work and had trouble figuring out which companies to pick. Carnegie Mellon University in Pittsburgh won a bid to create an organization, the SEI, to improve the vendor vetting process. It hired Humphrey, IBM’s former software development chief, to participate in this effort in 1986.

Humphrey decided immediately that the Air Force was chasing the wrong problem. "We were focused on identifying competent people, but we saw that all the projects [the Air Force] had were in trouble?it didn’t matter who they had doing the work," he recalls. "So we said let’s focus on improving the work rather than just the proposals."

The first version of CMM in 1987 was a questionnaire designed to identify good software practices within the companies doing the bidding. But the questionnaire format meant that companies didn’t have to be good at anything besides filling out forms. "It was easy to cram for the test," says Jesse Martak, former head of a development group for the defense contracting arm of Westinghouse, which is now owned by Northrop Grumman. "We knew how to work the system."

So the SEI refined it in 1991 to become a detailed model of software development best practices and added a group of lead appraisers, trained and authorized by the SEI, to go in and verify that companies were actually doing what they said they were doing. The lead appraisers head up a team of people from inside the company being assessed (usually three to seven, depending on the size of the company). Together, they look for proof that the company is implementing the policies and procedures of CMM across a "representative" subset (usually 10 percent to 30 percent) of the company’s software projects. The team also conducts a series of confidential interviews with project managers and developers?usually during the course of one to three weeks and, again, depending on the size of the organization?to verify what’s really happening. It’s a tough assignment for the internal people on the team because they are being asked to tattletale on their colleagues.

"It can be very stressful for the [internal] assessment team," says a lead appraiser who asked to remain anonymous. "They have conflicting objectives. They need to be objective, but the organization wants to be assessed at a certain level."