The Pros & Cons of CMM

Outsourcers tout their Capability Maturity Model ratings, but they may be overkill for some clients.

By Julia King

December 8, 2003 12:00 PM ET

Computerworld - What's in a CMM rating?
Does hiring a CMM Level 5 service provider guarantee that an outsourced software project will come in on time and on budget?
Will a higher CMM rating automatically mean higher costs?
What impact does earning a rating have on software quality?
These are just a few of the questions confronting IT managers charged with contracting out an increasing volume of application development and maintenance work to lower-cost offshore outsourcers.
Developed by the Software Engineering Institute (SEI) at Carnegie Mellon University in Pittsburgh, CMM—short for Capability Maturity Model—is a set of rigorous standards for software development that's based on five levels. Of some 70 companies worldwide that have publicly acknowledged reaching the highest rating of Level 5, about 50 are in India, according to the SEI and Gartner Inc.
Not surprisingly, these Indian outsourcers aggressively tout their CMM rating, marketing themselves as top-notch developers with standardized, repeatable processes in place for delivering the highest quality software. Executing standardized processes also works to keep down costs, enabling Level 5 providers to pass on additional savings to customers, according to Sangita Singh, head of strategic marketing at Wipro Ltd., an Indian outsourcing company with U.S. headquarters in Santa Clara, Calif.
Research confirms that higher CMM levels correlate with fewer software defects (see chart below). But the highest CMM rating doesn't necessarily guarantee the greatest savings for customers. "The data on quality and maturity levels shows there is a definite improvement in costs and [on-time project completion] schedules," says Bill Peterson, program director for software engineering process management at the SEI. "But whether the supplier passes the savings on to the buyer, we don't know. That's more business than anything to do with the logic of costs.
"What we are saying is that as a Level 5, [suppliers] are better and they're able to charge more, not less," Peterson adds.
At the same time, a Level 5 CMM rating comes with no guarantees, and in some cases, it may even be overkill, experts say.
"CMM is a great discipline, and it is a great designation to have," says Bart Perkins, a Computerworld columnist and managing partner at Louisville, Ky.-based Leverage Partners Inc., which helps CIOs manage IT suppliers. "But the reality is that if an outsourcer is at Level 5 and the client is at Level 1 or 2, the client doesn't have the internal discipline to take advantage of the Level 5 provider's standardized routines."
Defining system or project requirements is a prime example. "With CMM, the entire requirements process is very rigidly defined. A Level 5 requirements document is very detailed and explicit and has metrics associated with it," Perkins explains. "But a company at a CMM Level 0 or 1 could have their requirements on the back of an envelope and no metrics. The Level 1 companies are lucky if they write out two pages."
The upshot, says Perkins, is that touting a CMM Level 5 rating to a Level 1 buyer "comes down to touting a feature that's of little value. It's like a car salesman in Alaska touting a car's great air conditioning. It may be great, but you can't take advantage of it."
Yet some companies, such as Farmers Insurance Group in Los Angeles, contract with Level 5 outsourcers exclusively, even though they may be unable to reap all of the benefits of doing so.
"The CIO dictated that we only do business with CMM Level 5 partners. It was a way of distinguishing the best companies from the rest of the pack," explains Alan Stanley, a program manager at Farmers.
"Beyond that, we don't take advantage of CMM. We tend to dictate how we want work done. We allocate work and processes based on what we do here, so I don't think we've really benefited from the CMM Level 5 side," he adds.
Helen Cousins, former CIO at Parsippany, N.J.-based Cendant Corp., says she believes that hiring a Level 5 outsourcer is a way to raise the bar for your own IT organization. "One of the things we gained out of necessity is the ability to more clearly define what we want," says Cousins, who is now CIO at Dex Media Inc. in Denver. "I've also noticed that when people working side by side are with people who are disciplined, it starts rubbing off."
But in a January 2003 report on the subject, Gartner analyst Partha Iyengar cautioned that users should also remember that CMM standards are descriptive rather than prescriptive, meaning that "they describe what must be done, rather than how it must be done." Consequently, a vendor can specify a certain way of executing a process that isn't the best possible implementation of that particular process.
In other words, Iyengar says, "CMM standards certification in no way guarantees that a vendor's internal implementation of these standards is best-in-class in any way."

CMM Checklist

Recommend Digg Twitter ShareThis

Email Print Send Feedback Reprints

Additional Resources

Xerox

Win a color printer!

By using solid ink technology only from Xerox, you could save up to 65% by printing color for the cost of black and white. Enter for a chance to WIN a PhaserTM 8860 network color printer!

Microsoft

Upgrade to Internet Explorer 8 today.

Save time and mitigate security risk. Deploy it now.

Sybase

NEXT-GENERATION MOBILITY PLATFORMS

In this white paper, IDC analyzes the role of next-generation mobile enterprise platforms as organizations seek a more strategic deployment of mobile solutions.

Learn the important issues you must consider before starting your next mobility initiative. Get your mobility white paper from IDC now, compliments of Sybase.

White Papers & Webcasts

IT Vendor Management with Oblicore Guarantee
(Source: Oblicore) In the context of a global recession, companies are realizing that they need to take an active role in dealing with...

Usability Is Everything
Learn what sets Workday's HR and Payroll solutions apart from the competition....

The Rise of Service Level Management in ITIL V3
(Source: Oblicore) The third volume of the Information Technology Infrastructure Library (ITIL V3) expands the role of Service Level Management (SLM) in aligning...

The Value of Real SaaS at Workday
Cost savings, speed to value, and innovation brought to the enterprise by Workday's software-as-a-service solutions for HR and Payroll....

The Right Offshore Location May be Closer Than You Think
More and more companies today are looking for Outsourcing solutions that are flexible in where the services are delivered. For many companies with...

SaaS at Flextronics, Inc.
Dave Smoley, CIO of Flextronics, discusses the real value of software-as-a-service and why he chose Workday for his HR solution....

The Metrics Driven Organization: Your Business in Challenging Times
This white paper discusses how metrics increase visibility and sharpen decision making to ensure excellent customer service, rising revenue and growth....

Why Compliance Pays
This OnDemand webcast explores the relationship that firms with best compliance records have higher revenue, greater customer retention, lower financial losses from data...

Using Collaboration to Achieve Business Goals
This whitepaper reviews information management, CRM, HRM, project management, portals, document and workflow management and other assets that run business operations and should...

Agile Enterprise Content Management (ECM) for Rapid ROI
Find out how combining ECM and BPM will help adress issues about content rich business processes....

All White Papers | All Webcasts