CMMI

Stefan Coetzeecreated 2026-05-12updated 2026-06-081 min readMOC
Vault note, not reviewed against the source. Written in the knowledge vault on 2026-05-12 by models working with Stefan Coetzee and published as it stands, with private addresses, e-mail addresses and an employer name redacted. Check claims against the primary source before relying on them.

Capability Maturity Model Integration. ISACA-owned (since 2017 acquisition from CMU SEI). Process maturity model with five maturity levels. CMMI 3.0 (2023) current. Origins in US DoD software acquisition; broad industry adoption.

Anchors

Provenance

  • CMM (1991) — Capability Maturity Model from Carnegie Mellon SEI. US DoD-funded.
  • CMMI (2000+) — integration of multiple CMM variants.
  • CMMI v1.3 (2010), CMMI v2.0 (2018).
  • ISACA acquired CMMI Institute (2017) from CMU.
  • CMMI v3.0 (2023) — current. Modernized scope, agile-friendly, sustainability dimension.

What CMMI is

Process maturity model with two views:

  • Maturity levels (1-5) applied across the org.
  • Capability levels applied per process area.

Process areas grouped:

  • Development
  • Services
  • Supplier management

CMMI 3.0 expanded to include:

  • Cybersecurity
  • Data management
  • Workforce
  • Safety
  • Sustainability

Five maturity levels

  1. Initial — ad hoc.
  2. Managed — basic management.
  3. Defined — standardized processes.
  4. Quantitatively Managed — metrics-driven.
  5. Optimizing — continuous improvement.

Detail in CMMI Maturity and Capability Levels.

CMMI vs ASPICE vs SPICE

All SPICE-derived process maturity models:

  • CMMI: ISACA, broad industry, US-DoD lineage.
  • ASPICE: VDA, automotive-specific.
  • SPICE (ISO/IEC 33000): ISO foundation.

Common SPICE roots; different specializations.

Appraisal

CMMI Institute (ISACA) certified Lead Appraisers conduct formal appraisals:

  • SCAMPI (Standard CMMI Appraisal Method for Process Improvement) — historical.
  • CMMI appraisals under v2.0+ — streamlined.

Org achieves maturity level rating; valid 3 years.

Why this matters

  • US DoD contractor requirement historically.
  • Aerospace and defense common.
  • Indian / offshore software services for procurement signal.
  • Some financial services.
  • CMMI 3.0 sustainability dimension new.
  • ASPICE — automotive-specific sibling.
  • ITIL — service-management overlap (CMMI Services).
  • ISO 27001 — limited overlap.

See also

CMMI Cluster (pillars MOC) · position · anchors · ASPICE Cluster