CMMI: Maturity Levels and Appraisals for Software Companies

CMMI, Capability Maturity Model Integration, is a model of good practices for building and delivering software, services and other products. It began at Carnegie Mellon University's Software Engineering Institute for the US Department of Defense and is now owned by the CMMI Institute, part of ISACA. For IT services companies, especially in India, a CMMI maturity level rating has long been a recognised signal of disciplined, predictable delivery.

The current version, CMMI V3.0, was released in April 2023, and in 2026 the CMMI Institute announced an AI maturity extension. This guide explains how CMMI is structured, what maturity levels mean, how appraisals and ratings work, typical costs and timelines, and how CMMI fits with ISO 9001, agile methods and security frameworks.

What is CMMI?

CMMI describes what organisations do when they perform well, organised into practice areas such as planning, estimating, managing requirements, peer reviews, verification, risk and opportunity management, configuration management and process improvement. It does not prescribe how to perform practices; organisations decide that, using agile, DevOps or other methods. The model helps organisations assess their current capability, decide what to improve and measure progress.

Its roots are in the Capability Maturity Model for software developed in the late 1980s. CMMI integrated several models in 2000, versions 1.x served for many years, V2.0 was released in 2018, and V3.0 in 2023. The CMMI Institute, acquired by ISACA in 2016, maintains the model, trains and certifies appraisers, and publishes appraisal results.

Who uses CMMI?

• IT services and outsourcing companies, particularly in India, which often hold maturity level 3 or 5 ratings.
• US government contractors, where some contracts score or require CMMI ratings.
• Product companies seeking predictable releases and quality.
• Organisations with safety or security critical work, using the safety and security domains.
• Service organisations using the services domain.

Is it mandatory or voluntary?

Voluntary. Some procurements require a minimum maturity level, often level 3, or give extra credit for higher ratings. Enterprise clients outsourcing software development also use ratings to shortlist vendors, alongside ISO certifications and security reports. A rating is evidence of process maturity, not a guarantee of results on every project.

Structure of CMMI V3.0

CMMI V3.0 contains practice areas grouped into categories and capability areas, with a set of core practice areas that apply broadly and domain-specific practice areas. Organisations choose a "view" of the model that fits their business. Domains include:

• Development: building software and products.
• Services: delivering services.
• Supplier management: acquiring products and services.
• People: managing and developing the workforce.
• Safety: preventing harm from products and services.
• Security: protecting against security threats.
• Data: managing data as an asset.
• Virtual: practices for remote and distributed work.

Each practice area contains practices arranged in levels of increasing capability, from basic practices to more sophisticated ones.

Key practice areas for software teams

For a typical software development organisation, the practice areas that matter most include:

• Estimating: size, effort and cost estimates based on recorded history.
• Planning and monitor and control: plans that are used, tracked and adjusted.
• Requirements development and management: understanding, agreeing and tracing requirements and managing changes.
• Technical solution and product integration: designing, building and assembling the product.
• Peer reviews: structured review of code, designs and documents.
• Verification and validation: testing that the product meets requirements and user needs.
• Configuration management: version control, baselines and release management.
• Risk and opportunity management: identifying and acting on risks early.
• Process quality assurance: objective checks that processes are followed.
• Causal analysis and resolution: finding and removing root causes of defects and problems.
• Managing performance and measurement: using data to understand and improve performance.
• Governance and implementation infrastructure: leadership support and organisational assets that keep practices in place.

Capability and maturity levels

Maturity level	Name	Description
0	Incomplete	Work may or may not get done; practices are not consistently performed.
1	Initial	Work gets done, but results are unpredictable and reactive.
2	Managed	Projects are planned, performed, measured and controlled.
3	Defined	The organisation has standard processes tailored for projects; proactive rather than reactive.
4	Quantitatively managed	Statistical and quantitative techniques are used to manage performance and quality.
5	Optimizing	Continuous improvement driven by quantitative understanding and innovation.

Organisations can also be appraised for capability levels in specific practice areas rather than a full maturity level.

Appraisals and ratings

Appraisals are led by CMMI Institute certified lead appraisers following the official appraisal method. Main types include:

• Benchmark appraisal: produces a maturity or capability level rating, typically valid for three years.
• Sustainment appraisal: allows an organisation to maintain its rating with a smaller scope, extending its validity.
• Evaluation appraisal: an informal assessment without a rating, used to find gaps and plan improvement.
• Action plan reappraisal: a limited reappraisal after addressing weaknesses found in a benchmark appraisal.

Appraisals examine evidence from a sample of projects or work units, including documents, artefacts and interviews, to judge whether practices are performed and institutionalised. Results of benchmark appraisals are published in the CMMI Institute's Published Appraisal Results System (PARS), where buyers can verify claims.

The 2026 AI maturity extension

In 2026, the CMMI Institute introduced CMMI AIM, an AI maturity extension. According to the Institute, AI-related content was added across all practice areas, with a large share of practices receiving AI-specific guidance, and an AI maturity benchmark approach was introduced without disrupting existing CMMI appraisals. Training for lead appraisers on appraising AI maturity is also offered. For software companies building or using AI, this provides a way to show disciplined practices for AI development and use alongside standards such as ISO/IEC 42001.

How to achieve a CMMI rating, step by step

1. Decide the goal: target maturity level, domains and organisational scope.
2. Engage a CMMI Institute partner and certified lead appraiser.
3. Run an evaluation appraisal or gap analysis.
4. Define and improve processes for planning, estimation, requirements, reviews, testing, configuration, risk and measurement.
5. Train staff and deploy processes on real projects.
6. Collect evidence as part of normal work: plans, estimates, review records, test results, retrospectives and metrics.
7. Conduct the benchmark appraisal on a representative sample.
8. Maintain and improve, using sustainment appraisals to keep the rating current.

Preparing teams for appraisal interviews

Appraisals include interviews with practitioners, not only managers. Appraisers want to hear how people actually plan, estimate, review, test and handle changes on their projects, and whether they know where to find organisational process assets. Preparing teams does not mean scripting answers; it means making sure everyone understands the organisation's processes, has used them, and can point to real examples in their tools. Short internal walkthroughs before the appraisal help people explain their work clearly and expose gaps that can still be addressed.

Organisational scope and sampling

A CMMI rating applies to a defined organisational unit, such as a business unit, delivery centre or the whole company, and the appraisal examines a sample of projects or work groups chosen to represent it. The appraisal method sets rules for how samples are selected so that results represent the unit. Organisations should define a scope that matches how they want to present themselves to clients, and make sure all projects in that scope actually follow the processes, because sampling can include any of them.

Documentation and evidence you will need

• Organisational process descriptions and tailoring guidelines.
• Project plans, estimates and schedules.
• Requirements and change records.
• Peer review and test records.
• Configuration and release records.
• Risk registers and issue logs.
• Measurement data and analysis.
• Process improvement records and training records.

Timeline and cost considerations

Reaching maturity level 3 from a reasonably organised starting point commonly takes 9 to 18 months. Costs include CMMI Institute fees, lead appraiser and appraisal team costs, consulting if used, tooling, and internal effort. Higher levels require quantitative management, which needs reliable metrics over time. Organisations that already use agile and DevOps tooling well can often produce much of the evidence from their existing systems.

Measurement and quantitative management

Maturity levels 4 and 5 require organisations to manage performance quantitatively. In practice, this means defining a small set of measures tied to business objectives, such as defect density, delivery predictability or lead time; collecting them consistently across projects; establishing performance baselines and models; and using statistical techniques to understand variation, predict outcomes and judge whether improvements work. Many organisations claim high maturity without real quantitative management, so appraisers look closely at whether data is reliable and actually used for decisions. For most software companies, solid level 3 practices with useful metrics deliver most of the benefit.

Security, data and safety domains

V3.0 includes domains that extend CMMI beyond delivery. The security domain covers practices for managing security threats and vulnerabilities across development and operations, and can be combined with secure development frameworks. The data domain covers managing data quality, data governance and data as an asset. The safety domain addresses identifying and managing hazards for products that could cause harm. Organisations choose which domains to include in their appraisal view according to their business and customer requirements.

How buyers should use CMMI ratings

For organisations choosing a development partner, a CMMI rating is useful but not sufficient on its own. Buyers should verify the rating in PARS, check that the appraised organisational unit and domains match the team that will do the work, note the appraisal date and expiry, and ask how practices are applied on projects like theirs. Asking to see anonymised examples of estimates, review records and test results gives a more direct picture than the rating alone. Ratings for a small showcase unit may say little about the rest of the company.

CMMI and agile

CMMI is compatible with agile and DevOps. Practices such as estimating, planning, peer review, verification and retrospectives map naturally onto sprint planning, backlog refinement, pull request reviews, automated testing and retrospectives. CMMI V2.0 and V3.0 explicitly include guidance for agile contexts. The key is that teams perform practices consistently and the organisation learns from results, not that it produces heavy documents.

CMMI compared with ISO 9001

Aspect	CMMI	ISO 9001
Focus	Capability and maturity of specific practices	Quality management system requirements
Result	Maturity or capability level rating	Certification
Detail	Detailed practices for development and services	General requirements for any organisation
Assessment	Appraisal by certified lead appraisers	Audit by accredited certification bodies
Validity	Typically three years	Three years with surveillance audits

Many IT companies hold both, using ISO 9001 for the management system and CMMI for engineering and delivery maturity.

Benefits and limitations

• Benefits: more predictable delivery, fewer defects, better estimates, a recognised signal in tenders, and a structured improvement path.
• Limitations: ratings can be pursued as a marketing badge without real change; appraisals sample only part of the organisation; and maintaining ratings costs time and money.

Common mistakes

• Creating documents only for the appraisal.
• Choosing showcase projects that do not represent normal work.
• Heavy processes that slow agile teams instead of supporting them.
• Collecting metrics nobody uses.
• Letting practices lapse after the rating is awarded.

Best practices, tools and technologies

• Use project tools such as issue trackers, code review and CI pipelines as the source of evidence.
• Define lightweight standard processes with clear tailoring rules.
• Measure a few meaningful indicators, such as estimate accuracy, defect escape rate and cycle time.
• Combine CMMI security practices with OWASP SAMM or NIST SSDF for secure development.
• Hold regular process retrospectives at organisation level.

We run software projects with clear requirements, estimates, peer reviews, automated testing and measured delivery through our custom software development and web application development services.

Real-world example

A 120-person Indian software services company wants maturity level 3 to qualify for a US government subcontract. It runs an evaluation appraisal, finds weak estimation and inconsistent peer reviews, defines a lightweight organisational process using its existing issue tracker and pull request workflow, trains teams, and collects evidence from six months of real projects. A certified lead appraiser conducts a benchmark appraisal on a sample of projects, the company achieves level 3, and the result appears in PARS for prospective clients to verify.

Next steps

1. Decide whether buyers value a CMMI rating.
2. Choose target level and domains.
3. Run a gap analysis.
4. Improve processes on real work.
5. Plan the benchmark appraisal.

Frequently asked questions

What is CMMI?

A model of good practices for delivering software, services and products, with maturity levels and appraisals managed by the CMMI Institute.

What is the current version?

CMMI V3.0, released in April 2023, with an AI maturity extension introduced in 2026.

What are the CMMI maturity levels?

Initial, Managed, Defined, Quantitatively Managed and Optimizing, levels 1 to 5, with level 0 Incomplete.

Is CMMI a certification?

Organisations receive appraisal ratings rather than certificates, though the terms are often used loosely.

How long is a CMMI rating valid?

Typically three years, and sustainment appraisals can extend it.

How can I verify a company's CMMI rating?

Check the CMMI Institute's Published Appraisal Results System (PARS).

What is CMMI level 3?

Defined: the organisation has standard processes that projects tailor and follow consistently.

Can agile teams use CMMI?

Yes. CMMI describes what to achieve, not how, and works with agile and DevOps practices.

Is CMMI better than ISO 9001?

They serve different purposes; many companies use both, with ISO 9001 for the quality management system and CMMI for delivery practices.

Who performs CMMI appraisals?

Lead appraisers certified by the CMMI Institute, working through Institute partners.

Does a CMMI rating cover the whole company?

Only the organisational unit defined in the appraisal scope; check PARS for the unit, domains and dates covered.

What did CMMI V3.0 add?

V3.0, released in 2023, added domains such as data and virtual work, updated practice areas, and integrated guidance for areas like security and safety into one model.