1

CMM & ISO

Present by :

Booncharat TangtiphongkulParach WaiyawajamaiJittapat Yuwataepakorn

2

Outline

Introduction to CMM CMM with a case study ISO 9001 Case study of ISO 9001

3

Capability Maturity Model and ISO 9001 are the two most widely accepted methods of quality management with respect to software development

4

The Capability Maturity Model (CMM)

5

How can we effectively work with offshore suppliers?

Elevate your own organization’s CMM certification

Indian suppliers were all at level4 or 5

U.S. customers were all at level2 or below

6

The CMM for software is a framework that focuses on processes for software development.

7

CMM developed by The software engineering institute (SEI) of Carnegie Melon University

8

The Software Engineering Institute was contracted by the federal government

To establish a quality management tool To allow the government to differentiate between competing bids for

software development.

9

1985 SEI started work on a maturity framework

1991 it developed into the Capability Maturity Model that was established.

10

The purpose of CMM is to help organization that produce software, improve the maturity of their software processes.

11 Source: www.exzilla.net/docs/cmm/cmm.pdf

12

The CMM framework describes the key elements of software processes at different levels of maturity.

There are 5 maturity levels1. Initial2. Repeatable3. Defined4. Managed5. Optimizing

13

Five Levels of Capability Maturity Model

www.csd.uwo.ca/courses/cs179/lect3/sld006.htm

14

The improvement is conceptualized as an evolutionary path from an AD-HOC chaotic state, to mature, disciplined software process

Source: www.csd.uwo.ca/courses/cs179/lect3/sld006.htm

15

INITIAL

AD-HOC chaotic Outcomes are unpredictable and poorly

controlled. Few processes are defined Success depends on individual effort and

heroics. Over commitment is very common at this

level.

INITIAL REPEATABLE DEFINED MANAGED OPTIMIZING

16

REPEATABLE

Basic project management processes are established to track cost, schedule, and functionality.

Software project standards are defined. Planning and managing new projects is

based on similar project experience.

INITIAL REPEATABLE DEFINED MANAGED OPTIMIZING

17

DEFINED

The software process for both management and engineering activities is documented.

All project use an approved, tailored version of the organization’s standard software process for developing and maintaining software

Management has good insight into technical activities

INITIAL REPEATABLE DEFINED MANAGED OPTIMIZING

18

MANAGED

Detailed measures of the software process and product quality are collected.

Both the software process and products are quantitatively understood and controlled.

Software process capability is quantifiable and predictable

INITIAL REPEATABLE DEFINED MANAGED OPTIMIZING

19

OPTIMIZING

Continuous process improvement is enabled by quantitative feedback from the process and from piloting innovative ideas and technologies.

The organization is continuously striving to improve their process capability range.

The organization has the means to identify weakness and strengthen the process proactively

The goal is the prevention of defects.

INITIAL REPEATABLE DEFINED MANAGED OPTIMIZING

20

Software Engineering Institute published the median times to move from one maturity level to the next

Maturity Level 1 to 2 – 24 months

Maturity Level 2 to 3 – 22 months

Maturity Level 3 to 4 – 32 months

Maturity Level 4 to 5 – 16 months

21

The overall Percentage of Organization that achieved CMM Certification

Source: www.umsl.edu/~sauter/analysis/is6840start.html

22

How can we effectively work with offshore suppliers?

Elevate your own organization’s CMM certification

Indian suppliers were all at level4 or 5

U.S. customers were all at level2 or below

23Source: www.exzilla.net/docs/cmm/cmm.pdf

24

Each maturity level consists of several KEY PROCESSES AREAS (KPAs) that identify requirements/best practices that an organization would need to demonstrate, to be graded at any specific maturity level.

25Source: www.askprocess.com/products/cmm.html

26

The KPAs are:

Requirements Management Software Project Planning Software Project Tracking and Oversight Software Subcontract Management Software Quality Assurance

Repeatable

INITIAL REPEATABLE DEFINED MANAGED OPTIMIZING

27

The KPAs are:

Organization Process Focus Organization Process Definition Training Program Integrated Software Management Software Product Engineering Intragroup Coordination Peer Reviews

Defined

INITIAL REPEATABLE DEFINED MANAGED OPTIMIZING

28

Managed

The KPAs are:

Quantitative Process Management Software Quality Management

INITIAL REPEATABLE DEFINED MANAGED OPTIMIZING

29

Optimizing

The KPAs are:

Defect Prevention Technology Change Management Process Change Management.

INITIAL REPEATABLE DEFINED MANAGED OPTIMIZING

30

Infosys Company

Infosys is a highly successful software house

Infosys provides software service to customers

Infosys achieved CMM level 5 in December 1999

31

Source: www.askprocess.com/products/cmm.html

32

Requirements Specification and Management

Divided into 3 activities

The requirements Specification activities

Change management

Requirements traceability management

33

The activities performed during the requirements phase largely focus on two areas

• Problem analysis

• Product description

After sign-off, the initial baseline for requirement is established

PrepareGather/ElicitRequirement

Analyze

Obtain sign-off ReviewPrepare SRS and

Acceptance criteria

Jalote, Pankai, CMM in Practice: Process for Executing Software Projects at Infosys

34Source: www.exzilla.net/docs/cmm/cmm.pdf

35

Common Features of KEY PROCESS AREAS

KPAs are organized into a set of five common features "that help indicate whether the implementation and institutionalization of a key process area is effective, repeatable, and lasting."

36

Common Features of KEY PROCESS AREAS

ActivitiesPerformed

GOALS

Measurement AndAnalysis

VerifyingImplementation

Commitment To Perform

AbilityTo Perform

37

Commitment to Perform

To ensure that the process is established and will endure.

Establishing organization policies Obtaining senior-management sponsorship

38

Ability to Perform

Describes the preconditions that must exist in the project or organization to implement the software process competently.

Resources requirement Organization structure training

39

Activities Performed

Describes the roles and procedures necessary to implement a key process area.

establishing plans and procedures performing the work, tracking it take corrective actions as necessary

40

Measurement and Analysis

Describes the need to measure the process and analyze the measurements.

examples of measurements

41

Project Closure

Involves a systematic follow up of the project after customer acceptance

Metrics are analyzed Process assets are collected for future use Lessons are recorded

42

The objectives is to determine what went right, what went wrong, what worked, what did not, and how it could be made better the next time

43

Lessons Learned

To understand the performance of the process and causes for any deviations from organizational norms

Indicates the quality delivered in the project The productivity achieved in the project The distribution of effort The distribution of defects The cost of quality Effectiveness of risk mitigation Effectiveness of planning

44

Verifying Implementation

Describes the steps to ensure that the activities are performed in compliance with the process that has been established.

practices on management reviews and audits

45

How to get CMM Certificate

The process assessment By an assessment team (SEI-authorized lead

assessor) Collect information about the software process of

organization by maturity questionnaires, documentation and Interview

If all goals of KPA satisfied, then a organization is considered to have reached a level.

46

Benefits of Capability Maturity Model Improvements in each level

Optimizing Continuously targeting improvements required to meet business objectives

Managed Predictable results, knowledge of factors causing variance and reuse

Defined Meeting cost and functionality targets as well as improved quality

Repeatable: Meeting cost and reduced turnover resulting from less overtime

Initial: No benefits: Inconsistency, schedule and budget overruns and defective applications

Source: Dr. Bill Curtis, TeraQuest --- a Gartner alliance partner

47

Benefits of CMM on Software Process Improvement

Gains in productivity quality time to delivery accuracy of cost schedule estimates product quality.

48

LIMITATIONS OF CMM

Very complex

Time consuming

A costly venture

49

International Organization for Standardization ( ISO )

50

International Organization for Standardization ( ISO )

International Organization for Standardization

- a non-governmental organization established in 1947

- a network of 149 National standard bodies

Mission

-Develop the technical standards

-facilitate the international exchange of goods and services.

51

ISO

ISO has developed over 13,700 International Standards on various subjects.

The most widely used standards is “Management system standards”.

- ISO 9000 is a "quality management standard" - ISO 14000 is an "environmental management

standard"

52

ISO 9000

The International Standard for Quality Management Systems

53

ISO 9000

The first set of ISO 9000 series were develop in 1987

“ Generic management system standard” a process standard, not a product standard

54

ISO 9000

ISO does not issue ISO 9000 certificates.

The auditing and certification of management systems is carried out independently by more than 750 certification bodies active around the world.

– American National Standards Institute (ANSI) – British Standards Institution (BSI) – Japanese Industrial Standards Committee (JISC) – Standardization Administration of China (SAC) – Thai Industrial Standards Institute (TISI)

Worldwide total of ISO 9000 certificates

27816

510616

408631

343643

271847

223299

162701127349

70364

567985

561747

0

100000

200000

300000

400000

500000

600000

1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003

Source: The ISO survey of ISO 9001: 2000 and ISO 14001 certicicates-2003,December 2003.Http://www.ISO.org

96715

64120

4546538751

31836 3029423598

1997515073 12846

0

20000

40000

60000

80000

100000

Top ten countries for ISO 9001:2000 certificates

Source: The ISO survey of ISO 9001: 2000 and ISO 14001 certicicates-2003,December 2003.Http://www.ISO.org

Source: Gary M Griggs,Qulity Management of the Softwre Industry.May 2004

0%100%200%300%400%500%600%

Top Ten Countries that increased in ISO Certification from 1999-2002

( with over 3000 Certifications )

58

Motivations for seeking ISO 9000 certification?

Quality Improvement Corporate Image Marketing Advantage Customer or Competitor Pressure Capturing employees’ knowledge Export Barrier Relations with communities

Source: Global perspective on global standards, ISO management system, January - February 2003

Base: 5398 surveys of ISO 9000 and ISO 14000 certificated firms in 15 economies during 1999-2001

59

ISO 9001:2000

Quality management systems - Requirements

- customer's quality requirements

- applicable regulatory requirements

- customer satisfaction

- continual improvement

60

ISO 9001 :2000 Requirement

Quality Management System Management Responsibility Resource Management Product Realization Measurement, Analysis and

Improvement

ISO 9001:2000 Process Model

CUSTOMER

CUSTOMER

Management Responsibility

Resource Management

Product Realization

Measurement, Analysis and Improvement

Input Process OutputA PC D

•Source : Jim Mroz. ISO 9000 in 2000. http://www.qualitydigest.com/oct98/html/cover.html

62

Process approach (cont’d)

P D C A cycle Plan what to do Do what was

planed Check the results Act to Improve the

process

63

Quality management principles ( QMP )

Principle 1 : Customer focus Principle 2 : Leadership Principle 3 : Involvement of people Principle 4 : Process approach Principle 5 : System approach to management Principle 6 : Continual improvement Principle 7 : Factual approach to decision making Principle 8 : Mutually beneficial supplier

relationships

64

Benefits from ISO 9000 certification

Quality Improvements Customer Satisfaction Improved Procedures Corporate Image Employee morale On-time delivery Market share Cost reduction

*Source : a survey of 5398 ISO 9000certified firms in 15 economies, ISO Management Systems,2003

65

Benefits from ISO 9000 certification

The results of a recent survey of 227 US firms

67% Customer satisfaction 60% Improved productivity 57% Quality of products/services 56% Better use of data in management 37% Greater market share

Source : Implementing ISO 9001:2000 – US survey of user experiences. ISO Management Systems, November- December 2002 Base: us survey of ISO 9000:2000 user experiences from 227 organizations

66

Difference between ISO & CMM

ISO CMM

1.Covers software and hardware 1.Focus on software

2.Outwardly focused from the firm 2.Inwardly focused to the firm

3.Addresses minimum requirements with implied continuous improvement

3.Emphasizes on continuous quality improvement

4.Registration Document 4.No Documentation

5.Continual Audits 5.No follow up audits

Source : 1.Gary M. Griggs, Quality Management of Software Industry.( 2004 ) pp.10

2.The Capability Maturity Model and ISO 9000 Standards: Similarities and Differencess. http://www.umsl.edu/~sauter/analysis/488_f01_papers/albright.htm

67

Similarities of ISO & CMM

Records and tracks data for objective analysis Used documented information to improve the quality system and

processes

“Say what you do” “DO what you say”

Source: 1. The Capability Maturity Model and ISO 9000 Standards: Similarities and Differencesมhttp://www.umsl.edu/~sauter/analysis/488_f01_papers/albright.htm#c7 2.Dr. Dean R.Lee, Strategic process improvement planning.Bloodworth integrated technology

68

“If you can’t meet the world standard at the world’s best price, you are not even in the game.”

(Jack Welch, Productivit World, 1996)

69

website

http://www.iso.org http://www.asq.org http://www.worldpreferred.com http://www.rabnet.com

70

Case Studies of ISO9001;2000

ULTRATECH STEPPER (UTS)

Sources: http://proquet.umi.com http://ultratech.com

71

Background

Size of company in term of sales and profits– Sales of $73 million annually– Gross profits of $34 million annually– Net income of $4 million annually

72

Background

Major products the company sells– Semiconductor– Advanced packaging– Nanotechnology/MEMs– Laser Processing

Customers Japan, Taiwan,

China, North America, Korea

73

Success in ISO 9001 implementation

Being among the first 1 to 2% of ISO 9000;1994 registered companies to become certified to ISO 9001;2000.

Accomplished quickly and inexpensively Nine months and less than $200,000 in manpower

and related costs. Combined ISO 9001 and ISO 14000 environmental

management system (EMS) at the same time.

74

13 steps to certification

1. Get senior management commitment2. Redefine quality policy3. Define customer satisfaction4. Define business processes and systems5. Educate employees6. Draft a manual and procedures.7. Define key metrics and effectiveness dashboard8. Conduct an external readiness review9. Conduct metrics reviews.10. Schedule and conduct a gap assessment11. Respond to findings12. Prepare for a registration audit13. Schedule and conduct an audit

75

The eight-member UTS quality steering committee (QSC)

Educate senior management The QSC’s education was accomplished Create quality vision Develop an implementation plan.

Step 1: Get senior management commitment

Step1

Step4

Step6

Step7

Step5

Step3

Step2

Step8

Step9

Step10

Step11

Step12

Step13

76

Step 2: Redefine quality policy

3 reasons to redefine the quality policy: It hadn’t been updated, reviewed, or

discussed ISO 9001:2000 clause 5.3 Integrating the QMS and EMS

Step1

Step4

Step6

Step7

Step5

Step3

Step2

Step8

Step9

Step10

Step11

Step12

Step13

77

Step 3: Define customer satisfaction

Step 4: Define business processes systems Key business systems (KBS) Interaction between systems Detailed process requirements

Step1

Step4

Step6

Step7

Step5

Step3

Step2

Step8

Step9

Step10

Step11

Step12

Step13

Step 5: Educate Employees

General training and communication Champion training Internal auditor training.

Step1

Step4

Step6

Step7

Step5

Step3

Step2

Step8

Step9

Step10

Step11

Step12

Step13

Step 6: Draft Manual, Procedures

79

Step 7: Define Key Metrics, Effectiveness Dashboard

Figure 2

Step1

Step4

Step6

Step7

Step5

Step3

Step2

Step8

Step9

Step10

Step11

Step12

Step13

80

Step 8: Conduct External Readiness Review

Doing the right things? No one in the company had experience in

ISO 9001:2000 An external consultant hired to help

Step1

Step4

Step6

Step7

Step5

Step3

Step2

Step8

Step9

Step10

Step11

Step12

Step13

81

Step 9: Conduct metrics reviews Step 10: Schedule, conduct gap assessment Step 11: respond to findings Step 12: Prepare for registration audit Step 13: Schedule, conduct audit

Step1

Step4

Step6

Step7

Step5

Step3

Step2

Step8

Step9

Step10

Step11

Step12

Step13

82

References

www.csd.uwo.ca/courses/cs179/lect3/sld006.htm www.exzilla.net/docs/cmm/cmm.pdf www.umsl.edu/~sauter/analysis/is6840start.html www.askprocess.com/products/cmm.html www3.gartner.com/4_decision_tools/measurement/

measure_it_articles/2003_0424/ben_cmm.jsp www.inf.com Jalote, Pankai, CMM in Practice: Process for Executing Software

Projects at Infosys www.cis.njit.edu/~axp9532/cmm/cmm_intro.html Ramanujan, Sam; Kesh, Someswar, “Comparison of knowledge

management and CMM/CMMI implementation”, Journal of American Academy of Business, Cambridge; Mar 2004

www.sei.cmu.edu

83

References

Griggs, Gary M., Quality management of the software Industrt, IS425, May 19, 2004

ISO Web Sites, http://www.iso.org The ISO survey of ISO 9001: 2000 and ISO 14001 certicicates-

2003,December 2003. http://www.iso.org/iso/en/iso9000-14000/pdf/survey2003.pdf

Implementing ISO 9001:2000 – US survey of user experiences. ISO Management Systems, November- December 2002

Frequently Asked Questions about ISO 9000. http://www.isoeasy.org/faq03.htm

Garry M. Griggs, Quality Management of the Software Industry. May 2004

The Capability Maturity Model and ISO 9000 Standards: Similarities and Differencess. http://www.umsl.edu/~sauter/analysis/488_f01_papers/albright.htm

84

References

“13 steps to certification in less than a year”, http://gateway.proquest.com

Ultratech Stepper website, http://www.ultratech.com Jeanne Ketola and Kathy Roberts, ISO 9000: 2000 In a Nutshall, 2001 Doug and Carole Anton, ISO 9000: 2000 Survival Guide, 2000

85

Thank you