(Update: 10/01/2020)

Now we have the latest version of this study, with up-to-date information for 2020.

I’d rather have it wrong than have it late. We can always fix it later.

— Senior software manager, compiled by Mark C. Paulk. A history of CMM for software. 2001.

Update: 01/13/2016

For historical and comparative reasons we keep this information, but some time ago we published the updated account of CMMi organizations in Mexico and the world, during mid-September of 2015. As a summary, during the Fall of 2015, there were 5,014 appraisals distributed among 83 countries, of which the top 10 includes China, the United states, India, Mexico, Spain, South Korea, Brazil, Colombia, Japan and France. Without further preamble, we present the original document…

The software industry has expanded dramatically, due to among other things, lower hardware costs and the need for information systems and Internet presence just to stay competitive. There is however, a problem that has plagued the industry since its inception: the subject of quality. There are few approaches, standards or best practices, which have resulted on hundreds of software engineers, project managers and academics struggling to find a solution against ongoing projects that fail to meet expectations, get delayed or consume more budget than it was initially granted. However, one of the most recent quality models with greater acceptance is the so-called Capability Maturity Model Integration – CMMI.

The origins of CMMI

In the early 1980’s several projects commissioned by the U.S. Department of Defense (DoD) failed impressively: the suppliers responsible for carrying out these projects extended their allocated budget and time beyond what was initially envisioned, if they came to completion at all. Note at that time, all projects requested by the United States Government – including its armed forces – selected the bidding winner just based on price.

So, the DoD was forced to found the Software Engineering Institute (SEI), operated by the Carnegie Mellon University and its primary mission consisted on identifying a maturity framework or model with which the ability of a company to build software could be judged. By 1987 the institute had developed the Capability Maturity Model (CMM). In 1991, version 1.0 of the CMM for software development (SW-CMM) was released by the SEI, thus more than 30,000 people from approximately 2,400 organizations were able to certify their companies on CMM, being able to participate in U.S. Government biddings, now mostly basing its bidding decisions on the participants’ maturity level. On 1997 works were begun to update the CMM and incorporate international standards. On 2000 the first version of this new model was released, now referred to as CMMI:

CMMI is a process improvement approach that provides organizations with the essential elements of effective processes that ultimately improve their performance. CMMI can be used to guide process improvement across a project, a division, or an entire organization. It helps integrate traditionally separate organizational functions, set process improvement goals and priorities, provide guidance for quality processes, and provide a point of reference for appraising current processes.

— CMMI Overview, Software Engineering Institute.

In brief, CMMI is a process improvement methodology, NOT a software development methodology, project management methodology or software life cycle management methodology. Basically, CMMI is a checklist where the division, project or company to be certified has to deliver the expected artifacts for each level of maturity. Currently, there are five levels of maturity covered by the model, allowing to identify companies that are «too green» from those that can be trusted, with relative authority, to deliver projects of high complexity and risk. The following table shows the five levels and process areas that are evaluated within each level:

Level Focus Process Areas
5
Optimizing		 Continuous process improvement CAR – Causal Analysis and Resolution
OID – Organizational Innovation and Deployment
4
Quantitatively Managed		 Quantitative management of processes QPM – Quantitative Project Management
OPP – Organizational Process Performance
3
Defined		 Process standardization DAR – Decision Analysis and Resolution
IPM – Integrated Project Management +IPPD
OPD – Organizational Process Definition +IPPD
OPF – Organizational Process Focus
OT – Organizational Training
PI – Product Integration
RD – Requirements Development
RSKM – Risk Management
TS – Technical Solution
VAL – Validation
VER – Verification
2
Managed		 Basic project management CM – Configuration Management
MA – Measurement and Analysis
PMC – Project Monitoring and Control
PP – Project Planning
PPQA – Process and Product Quality Assurance
REQM – Requirements Management
SAM – Supplier Agreement Management
1
Inicial		 Dependency towards qualified staff («Heroes») and their tools. This level is not assessed by CMMI.

According to the certification level some documents or evidence will be required, to prove the assessed processes are underway. For example, the CMMI Level 2 assessment requires reviewing the process area known as Project Planning (PP). It requires to show proof of the relevant activities, related to the following Specific Objectives (SO) and Specific Practices (PE):

 • OE 1: Establish Estimates
   ° PE 1.1: Estimate the Scope of the Project
   ° PE 1.2: Establish Estimates of Work Product and Task Attributes
   ° PE 1.3: Define Project Lifecycle
   ° PE 1.4: Determine Estimates of Effort and Cost
 • OE 2: Develop a Project Plan
   ° PE 2.1: Establish the Budget and Schedule
   ° PE 2.2: Identify Project Risks
   ° PE 2.3: Plan for Data Management
   ° PE 2.4: Plan for Project Resources
   ° PE 2.5: Plan for Needed Knowledge and Skills
   ° PE 2.6: Plan Stakeholder Involvement
   ° PE 2.7: Establish the Project Plan
 • OE 3: Obtain Commitment to the Plan
   ° PE 3.1: Review Plans that Affect the Project
   ° PE 3.2: Reconcile Work and Resource Levels
   ° PE 3.3: Obtain Plan Commitment

Again, stressing that CMMI is neither a management nor development methodology; it assumes that the company or area to be certified already possesses the necessary standards to check the maturity level, so the certification will not request an artifact from a specific methodology. However, only for reference: if we were properly implementing RUP in conjunction with the PMBOK in our projects, we should have a nearly-effortless successful evaluation for CMMI-2 and would have a small share of the points covered by CMMI-3.

Why is CMMI so important?

In short: big bucks. Originally, CMM and CMMI were thought as process methodologies that would allow many software development companies to be suppliers of the U.S. government – and we all know it can be very generous, especially on defense contracts. However, CMMI is steadily becoming a standard that can be used to promote the ability to develop safety-critical software, or it can give a competitive advantage if we so wish to participate in projects of high complexity and risk, which for obvious reasons, have a high price and very good profits. For example, Boeing, General Dynamics, IBM, Lockheed Martin, Motorola, Raytheon and Toshiba are some of the companies that have achieved a Level 5 of CMMI, which opens the door to projects in the range of tens or hundreds of millions of dollars.

Who are certified in CMMI in the world?

As of July 22, 2010, there were 3,060 active certifications provided by the SEI (see the complete list here). Many of these are shared by several countries, as some portion of the project, area or certified company takes part on a decentralized manner. For example, the EADS corporation (European Aeronautic Defense and Space Company) is a European conglomerate which certified its Defense and Communications Systems division (DCS) on the second level of CMMI on June 10, 2009. This certification is shared by Germany, France, the UK and Finland, because certain areas of research and development are split among these four countries. So, there are 3,135 certifications granted to 72 countries worldwide. The top 10 countries with these certifications are, not surprisingly, taken by some of the world’s largest economies:

Country Appraisals
China 1,048
USA 680
India 294
Spain 131
Brazil 98
Japan 87
Korea, South 71
France 70
Maexico 70
Taiwan 67
Rest of the World 519

There are some comments worth mentioning:

 • It’s impressive to see how China is taking over the world: with little more than a third of the globally issued certificates (1,048), the future is theirs.

 • The United States and Canada group together 702 certifications, many of them shared; this consolidates this region of North America as a single power that even then, is small compared with the vast number of certifications that China possesses.

 • Europe has 371 certifications, from which just over one third (131) are from Spain, the most advanced country in this regard.

 • Latin America is becoming significant as a whole: with Brazil (98) and Mexico (70) leading the region, they have 280 issued certifications. Latin American countries that have some certification include Argentina (47), Chile (26), Colombia (18), Peru (10), Uruguay (4), Costa Rica (4), Guatemala (1), Panama (1), Paraguay (1), El Salvador (1) and Venezuela (1).

 • The sad reality for sub-Saharan Africa is that they still remain far behind the rest of the world; currently they have just 5 certifications, contributed by South Africa (2), Ghana (1), Mauritius (1) and Malawi (1).

 • Finally, the mystery case: Russia has only 4 certifications. However, it shows these awards were required to capture dollars: MERA Networks, the Moscow Boeing Design Center, Auriga Inc. and Reksoft Co.Ltd. are the Russian companies that have this kind of certification.

The Mexican case

At present we have 70 institutions certified before CMMI in Mexico, from which three are shared along with Argentina and the United States:

Organization Certified Area Date Level Mexican State
Tecnología de Gestión y Comunicación S.A. de C.V. Tecnología de Gestión y Comunicación S.A. de C.V. 07/05/2010 2 CHIH
SAITOSOFT, S.A. DE C.V. SAITOSOFT – PROJECT MANAGEMENT AND QUALITY ASSURANCE AREAS 28/03/2008 2 DF
ITE Soluciones S.A. de C.V. ITE Software Development Unit 12/06/2009 2 DF
Centro de Inteligencia Competitiva S.A. de C.V. Centro de Inteligencia Competitiva (CIC) 25/09/2009 2 DF
Mapdata S.A. de C.V. Technology Direction 16/10/2009 2 DF
Tecnología, Asesoría, Sistemas, S.A. de C.V. Development and Support & Consulting Units 13/11/2009 2 DF
e-Nfinito e-Nfinito 12/02/2009 2 GTO
Universidad Tecnologica de Leon (UTL) Serv. Informaticos & Tec. de Informacion y Comunicacion: Software Development 17/12/2009 2 GTO
SIMBIOSYS S.C. Software Development Area 30/04/2010 2 GTO
COMPUTACION EN ACCION, S.A. DE C.V. COMPUTACION EN ACCION, S.A. DE C.V. 07/02/2009 2 JAL
DAWCONS: DW IT SERVICES S.A. DE C.V. Software Development Services 08/01/2010 2 JAL
Ejecutivos en Computación y Servicios S.A. de C.V. Area de Desarrollo de Software Interna de Compusoluciones 19/03/2010 2 JAL
Tecnología en Informática y Administración S.A. de C.V. Development Area 15/04/2010 2 JAL
GEUSA, Grupo Embotelladoras Unidas S.A. de C.V. Systems Department 30/04/2010 2 JAL
ilinium S.A. Operations and Development 09/08/2007 2 NL
Kernel Technologies Group Software Development Team including the Quality Assurance Team 29/09/2007 2 NL
Tecnologico de Monterrey – VRHTI Tecnologico de Monterrey – VRHTI – DPSI 12/12/2008 2 NL
i-place i-place 30/01/2009 2 NL
Consiss S.A. de C.V. Custom Software Development 28/08/2009 2 NL
T-Systems México, S.A. de C.V. T-SYSTEMS MEXICO 01/02/2008 2 PUE
Universidad Popular Autónoma del Estado de Puebla, A.C.(UPAEP) Dirección de Sistemas de Información 22/05/2009 2 PUE
Vision Software Factory, S.A. de C.V. Vision Software Factory, S.A. de C.V. 21/12/2007 2 QRO
Business Intelligent Software, SA de CV Software Development Team 31/08/2007 2 SIN
ARASYS S.A. DE C.V. Software Development Projects 23/11/2007 2 SIN
DPSoft S.A. de C.V. DPSoft Software Development Team 30/11/2007 2 SIN
Sistemas Programación Coppel SA de CV Sistemas Programación Coppel SA de CV 29/08/2008 2 SIN
MACRO PRO S.A. de C.V. Macropro New Developments 12/09/2008 2 SIN
Applied Protocol Interfaces S.A. de C.V. Custom Software Development and Software Manteinance 13/11/2009 2 SIN
Factor Informático de Negocios S.A. de C.V. Operations Unit 23/04/2010 2 SIN
RQPortillo Firm S. de R.L. de C.V. Consultancy and Support Units 10/06/2010 2 SIN
PLENUMSOFT – SERVICIOS Y SUMINISTROS EN INFORMATICA, S.A. DE C.V INGENIERIA DE SOFTWARE 24/07/2008 2 YUC
Brainup Systems S.A. de C.V. (Compartida con Argentina) BUS Development and Services 17/07/2009 2 DF
Zentrum Ziztemaz S.A. De C.V. Zentrum Ziztemaz Tijuana 26/11/2009 3 BC
Logica Interactiva S.A. de C.V. Interlogic – Software Engineering Area 15/09/2009 3 CHIH
Intelligent Network Technologies S.A. de C.V. Intelligent Network Technologies S.A. de C.V. 18/09/2009 3 COAH
IDS Comercial S.A. de C.V. IDS Project Development 14/03/2008 3 DF
Informática Integral Empresarial S.A. de C.V. Sinersys Technologies 14/03/2008 3 DF
SERVICIOS TELEPRO, S.A. DE C.V. SERVICIOS TELEPRO, S.A. DE C.V. 29/05/2008 3 DF
Accenture Technology Solutions – Mexico Accenture – MXDC 22/08/2008 3 DF
EDS, an HP Company Mexico City SAT account – Servicio de Aduanas Area – AGA-Administración General de Aduanas 15/10/2008 3 DF
BLITZ SOFTWARE BLITZ SOFTWARE 20/12/2008 3 DF
QuarkSoft S.C. QuarkSoft S.C. 27/02/2009 3 DF
Azertia Tecnologias de la Información México S.A. de C.V. (Una Empresa de INDRA SISTEMAS S.A.) Azertia Tecnologias de la Información México S.A. de C.V. (Una Empresa de INDRA SISTEMAS S.A.) 13/03/2009 3 DF
T&D AUTOMATED TESTING AND DEVELOPMENT SOFTWARE, S.A. DE C.V. GRUPO TECNIS 03/04/2009 3 DF
Vision Consulting Software Development and Maintenance Projects 25/09/2009 3 DF
AsTecI S.A. de C.V. Software Development and Maintenance 28/01/2010 3 DF
IBM AMS Mexico Grupo Modelo Account 19/03/2010 3 DF
IBM AMS Mexico Grupo Nacional Provincial Account 04/06/2010 3 DF
D&T Tecnología S de RL de CV Deloitte GDC México 31/07/2009 3 GTO
VENTUS Technology S.A. de C.V. VENTUS Technology 22/03/2008 3 NL
World Software Services Group, SA de CV World Software Services Group, SA de CV 25/03/2009 3 NL
AD INFINITUM S.A. de C.V. Software development and implementation services 14/08/2009 3 NL
SYTECSO, S.A. de C.V Software Factory 28/08/2009 3 NL
Expert Sistemas Computacionales S.A. de C.V. Expert Tecnología 29/08/2009 3 NL
OPEN ROAD Solutions S de RL de CV – Queretaro Mexico OPEN ROAD Solutions S de RL de CV 19/12/2008 3 QRO
ALTEC Mexico S.A. de C.V. ALTEC Mexico S.A de C.V. 19/06/2009 3 QRO
ImagenSoft by Imagen y Sistemas Computacionales, S.C. ImagenSoft Projects Division 03/07/2008 3 SIN
Expresión Informativa y Técnicas Organizadas S.A. de C.V. (Éxito Software) New Developments Division 18/12/2008 3 SIN
DESARROLLADORA HOMEX S.A. DE C.V IT Deparment 04/06/2010 3 SIN
TSI ARYL S. de R.L. de C.V. QUALISYS – SYSTEMS AREA 12/09/2008 3 SON
INNEVO (Susoc & Vates S.A. de C.V.) (Compartida con Argentina) Innevo Software Development Services, Product Factory 07/09/2007 3 JAL
CRS IT Consulting S.A. de C.V. (Compartida con Argentina) Technical Solution Implementation Unit 03/07/2009 3 DF
Sieena Software S. de R. L. de C. V. (Compartida con Estados Unidos) Sieena Software S. de R. L. de C. V. 17/07/2009 3 COAH, NL
INNEVO Custom Software Development Unit 11/06/2010 4 JAL
Hildebrando Software Factory Hildebrando Software Factory 07/09/2007 5 AGS
ULTRASIST S.A. de C. V. ULTRASIST 28/03/2009 5 DF
PRAXIS DE MÉXICO, S.A. DE C.V. CEDS (Center of Excellence for Development of Software) 18/12/2009 5 DF
IBM Application Management Services Mexico 30/03/2010 5 JAL
Softtek GDC Monterrey High Growth Accounts 04/12/2009 5 NL
SigmaTao Factory, S.A. de C.V. SigmaTao Factory, S.A. de C.V. 24/08/2007 5 QRO

What we find remarkable is that in Mexico there are five Level-5 CMMI certifications, leaving the country ahead of most other nations in regard to this level of maturity, with the exception of India (63), the United States (40) and China (20). This means that although there are still few companies with CMMI, we have a high level there. This is also substantiated by the fact that unlike those countries, most Mexican companies are certified by the organization as a whole, not just a specific division or project.

On the other hand, it is quite noticeable how centralized is the software industry in Mexico, for almost all certifications are agglomerated around the Distrito Federal (22) and the states of Nuevo Leon (12), Sinaloa (11) and Jalisco (8). Guanajuato and Queretaro contribute with 4 certifications each; Chihuahua, Coahuila and Puebla contribute with 2 certifications by state. Finally, in Sonora, Aguascalientes, Baja California and Yucatan there is one company certified by each state. The surprise here is Sinaloa, as it has surpassed Jalisco (and its Mexican Silicon Valley) by number of certifications. More so when Sinaloa is traditionally viewed as a farming, cattle raising or tourism-driven state. Way to go for the Sinaloans!

My view

CMMI serves not only as a platform to promote ourselves before a global market; the fact that the most important companies and technology institutions in the world such as NASA, Siemens, T-Systems, Samsung and Accenture have a certification of this type means it DOES help as a model of process improvement to develop products and services with high quality standards. In fact, companies that are not on this list tend, for better or worse, to disappear or be bought by the competition. The harsh reality of competition in the business environment:

Never interrupt your enemy when he is making a mistake.

— Napoleon Bonaparte (1769-1821),
French general and politician.