Now we have the latest version of this study, with up-to-date information for 2015.
I’d rather have it wrong than have it late. We can always fix it later.
— Senior software manager, compiled by Mark C. Paulk. A history of CMM for software. 2001.
For historical and comparative reasons we keep this information, but some time ago we published the updated account of CMMi organizations in Mexico and the world, during mid-September of 2015. As a summary, during the Fall of 2015, there were 5,014 appraisals distributed among 83 countries, of which the top 10 includes China, the United states, India, Mexico, Spain, South Korea, Brazil, Colombia, Japan and France. Without further preamble, we present the original document…
The software industry has expanded dramatically, due to among other things, lower hardware costs and the need for information systems and Internet presence just to stay competitive. There is however, a problem that has plagued the industry since its inception: the subject of quality. There are few approaches, standards or best practices, which have resulted on hundreds of software engineers, project managers and academics struggling to find a solution against ongoing projects that fail to meet expectations, get delayed or consume more budget than it was initially granted. However, one of the most recent quality models with greater acceptance is the so-called Capability Maturity Model Integration – CMMI.
The origins of CMMI
In the early 1980’s several projects commissioned by the U.S. Department of Defense (DoD) failed impressively: the suppliers responsible for carrying out these projects extended their allocated budget and time beyond what was initially envisioned, if they came to completion at all. Note at that time, all projects requested by the United States Government – including its armed forces – selected the bidding winner just based on price.
So, the DoD was forced to found the Software Engineering Institute (SEI), operated by the Carnegie Mellon University and its primary mission consisted on identifying a maturity framework or model with which the ability of a company to build software could be judged. By 1987 the institute had developed the Capability Maturity Model (CMM). In 1991, version 1.0 of the CMM for software development (SW-CMM) was released by the SEI, thus more than 30,000 people from approximately 2,400 organizations were able to certify their companies on CMM, being able to participate in U.S. Government biddings, now mostly basing its bidding decisions on the participants’ maturity level. On 1997 works were begun to update the CMM and incorporate international standards. On 2000 the first version of this new model was released, now referred to as CMMI:
CMMI is a process improvement approach that provides organizations with the essential elements of effective processes that ultimately improve their performance. CMMI can be used to guide process improvement across a project, a division, or an entire organization. It helps integrate traditionally separate organizational functions, set process improvement goals and priorities, provide guidance for quality processes, and provide a point of reference for appraising current processes.
— CMMI Overview, Software Engineering Institute.
In brief, CMMI is a process improvement methodology, NOT a software development methodology, project management methodology or software life cycle management methodology. Basically, CMMI is a checklist where the division, project or company to be certified has to deliver the expected artifacts for each level of maturity. Currently, there are five levels of maturity covered by the model, allowing to identify companies that are “too green” from those that can be trusted, with relative authority, to deliver projects of high complexity and risk. The following table shows the five levels and process areas that are evaluated within each level:
|Continuous process improvement||CAR – Causal Analysis and Resolution
OID – Organizational Innovation and Deployment
|Quantitative management of processes||QPM – Quantitative Project Management
OPP – Organizational Process Performance
|Process standardization||DAR – Decision Analysis and Resolution
IPM – Integrated Project Management +IPPD
OPD – Organizational Process Definition +IPPD
OPF – Organizational Process Focus
OT – Organizational Training
PI – Product Integration
RD – Requirements Development
RSKM – Risk Management
TS – Technical Solution
VAL – Validation
VER – Verification
|Basic project management||CM – Configuration Management
MA – Measurement and Analysis
PMC – Project Monitoring and Control
PP – Project Planning
PPQA – Process and Product Quality Assurance
REQM – Requirements Management
SAM – Supplier Agreement Management
|Dependency towards qualified staff (“Heroes”) and their tools. This level is not assessed by CMMI.|
According to the certification level some documents or evidence will be required, to prove the assessed processes are underway. For example, the CMMI Level 2 assessment requires reviewing the process area known as Project Planning (PP). It requires to show proof of the relevant activities, related to the following Specific Objectives (SO) and Specific Practices (PE):
• OE 1: Establish Estimates
° PE 1.1: Estimate the Scope of the Project
° PE 1.2: Establish Estimates of Work Product and Task Attributes
° PE 1.3: Define Project Lifecycle
° PE 1.4: Determine Estimates of Effort and Cost
• OE 2: Develop a Project Plan
° PE 2.1: Establish the Budget and Schedule
° PE 2.2: Identify Project Risks
° PE 2.3: Plan for Data Management
° PE 2.4: Plan for Project Resources
° PE 2.5: Plan for Needed Knowledge and Skills
° PE 2.6: Plan Stakeholder Involvement
° PE 2.7: Establish the Project Plan
• OE 3: Obtain Commitment to the Plan
° PE 3.1: Review Plans that Affect the Project
° PE 3.2: Reconcile Work and Resource Levels
° PE 3.3: Obtain Plan Commitment
Again, stressing that CMMI is neither a management nor development methodology; it assumes that the company or area to be certified already possesses the necessary standards to check the maturity level, so the certification will not request an artifact from a specific methodology. However, only for reference: if we were properly implementing RUP in conjunction with the PMBOK in our projects, we should have a nearly-effortless successful evaluation for CMMI-2 and would have a small share of the points covered by CMMI-3.
Why is CMMI so important?
In short: big bucks. Originally, CMM and CMMI were thought as process methodologies that would allow many software development companies to be suppliers of the U.S. government – and we all know it can be very generous, especially on defense contracts. However, CMMI is steadily becoming a standard that can be used to promote the ability to develop safety-critical software, or it can give a competitive advantage if we so wish to participate in projects of high complexity and risk, which for obvious reasons, have a high price and very good profits. For example, Boeing, General Dynamics, IBM, Lockheed Martin, Motorola, Raytheon and Toshiba are some of the companies that have achieved a Level 5 of CMMI, which opens the door to projects in the range of tens or hundreds of millions of dollars.
Who are certified in CMMI in the world?
As of July 22, 2010, there were 3,060 active certifications provided by the SEI (see the complete list here). Many of these are shared by several countries, as some portion of the project, area or certified company takes part on a decentralized manner. For example, the EADS corporation (European Aeronautic Defense and Space Company) is a European conglomerate which certified its Defense and Communications Systems division (DCS) on the second level of CMMI on June 10, 2009. This certification is shared by Germany, France, the UK and Finland, because certain areas of research and development are split among these four countries. So, there are 3,135 certifications granted to 72 countries worldwide. The top 10 countries with these certifications are, not surprisingly, taken by some of the world’s largest economies:
|Rest of the World||519|
There are some comments worth mentioning:
• It’s impressive to see how China is taking over the world: with little more than a third of the globally issued certificates (1,048), the future is theirs.
• The United States and Canada group together 702 certifications, many of them shared; this consolidates this region of North America as a single power that even then, is small compared with the vast number of certifications that China possesses.
• Europe has 371 certifications, from which just over one third (131) are from Spain, the most advanced country in this regard.
• Latin America is becoming significant as a whole: with Brazil (98) and Mexico (70) leading the region, they have 280 issued certifications. Latin American countries that have some certification include Argentina (47), Chile (26), Colombia (18), Peru (10), Uruguay (4), Costa Rica (4), Guatemala (1), Panama (1), Paraguay (1), El Salvador (1) and Venezuela (1).
• The sad reality for sub-Saharan Africa is that they still remain far behind the rest of the world; currently they have just 5 certifications, contributed by South Africa (2), Ghana (1), Mauritius (1) and Malawi (1).
• Finally, the mystery case: Russia has only 4 certifications. However, it shows these awards were required to capture dollars: MERA Networks, the Moscow Boeing Design Center, Auriga Inc. and Reksoft Co.Ltd. are the Russian companies that have this kind of certification.
The Mexican case
At present we have 70 institutions certified before CMMI in Mexico, from which three are shared along with Argentina and the United States:
|Organization||Certified Area||Date||Level||Mexican State|
|Tecnología de Gestión y Comunicación S.A. de C.V.||Tecnología de Gestión y Comunicación S.A. de C.V.||07/05/2010||2||CHIH|
|SAITOSOFT, S.A. DE C.V.||SAITOSOFT – PROJECT MANAGEMENT AND QUALITY ASSURANCE AREAS||28/03/2008||2||DF|
|ITE Soluciones S.A. de C.V.||ITE Software Development Unit||12/06/2009||2||DF|
|Centro de Inteligencia Competitiva S.A. de C.V.||Centro de Inteligencia Competitiva (CIC)||25/09/2009||2||DF|
|Mapdata S.A. de C.V.||Technology Direction||16/10/2009||2||DF|
|Tecnología, Asesoría, Sistemas, S.A. de C.V.||Development and Support & Consulting Units||13/11/2009||2||DF|
|Universidad Tecnologica de Leon (UTL)||Serv. Informaticos & Tec. de Informacion y Comunicacion: Software Development||17/12/2009||2||GTO|
|SIMBIOSYS S.C.||Software Development Area||30/04/2010||2||GTO|
|COMPUTACION EN ACCION, S.A. DE C.V.||COMPUTACION EN ACCION, S.A. DE C.V.||07/02/2009||2||JAL|
|DAWCONS: DW IT SERVICES S.A. DE C.V.||Software Development Services||08/01/2010||2||JAL|
|Ejecutivos en Computación y Servicios S.A. de C.V.||Area de Desarrollo de Software Interna de Compusoluciones||19/03/2010||2||JAL|
|Tecnología en Informática y Administración S.A. de C.V.||Development Area||15/04/2010||2||JAL|
|GEUSA, Grupo Embotelladoras Unidas S.A. de C.V.||Systems Department||30/04/2010||2||JAL|
|ilinium S.A.||Operations and Development||09/08/2007||2||NL|
|Kernel Technologies Group||Software Development Team including the Quality Assurance Team||29/09/2007||2||NL|
|Tecnologico de Monterrey – VRHTI||Tecnologico de Monterrey – VRHTI – DPSI||12/12/2008||2||NL|
|Consiss S.A. de C.V.||Custom Software Development||28/08/2009||2||NL|
|T-Systems México, S.A. de C.V.||T-SYSTEMS MEXICO||01/02/2008||2||PUE|
|Universidad Popular Autónoma del Estado de Puebla, A.C.(UPAEP)||Dirección de Sistemas de Información||22/05/2009||2||PUE|
|Vision Software Factory, S.A. de C.V.||Vision Software Factory, S.A. de C.V.||21/12/2007||2||QRO|
|Business Intelligent Software, SA de CV||Software Development Team||31/08/2007||2||SIN|
|ARASYS S.A. DE C.V.||Software Development Projects||23/11/2007||2||SIN|
|DPSoft S.A. de C.V.||DPSoft Software Development Team||30/11/2007||2||SIN|
|Sistemas Programación Coppel SA de CV||Sistemas Programación Coppel SA de CV||29/08/2008||2||SIN|
|MACRO PRO S.A. de C.V.||Macropro New Developments||12/09/2008||2||SIN|
|Applied Protocol Interfaces S.A. de C.V.||Custom Software Development and Software Manteinance||13/11/2009||2||SIN|
|Factor Informático de Negocios S.A. de C.V.||Operations Unit||23/04/2010||2||SIN|
|RQPortillo Firm S. de R.L. de C.V.||Consultancy and Support Units||10/06/2010||2||SIN|
|PLENUMSOFT – SERVICIOS Y SUMINISTROS EN INFORMATICA, S.A. DE C.V||INGENIERIA DE SOFTWARE||24/07/2008||2||YUC|
|Brainup Systems S.A. de C.V. (Compartida con Argentina)||BUS Development and Services||17/07/2009||2||DF|
|Zentrum Ziztemaz S.A. De C.V.||Zentrum Ziztemaz Tijuana||26/11/2009||3||BC|
|Logica Interactiva S.A. de C.V.||Interlogic – Software Engineering Area||15/09/2009||3||CHIH|
|Intelligent Network Technologies S.A. de C.V.||Intelligent Network Technologies S.A. de C.V.||18/09/2009||3||COAH|
|IDS Comercial S.A. de C.V.||IDS Project Development||14/03/2008||3||DF|
|Informática Integral Empresarial S.A. de C.V.||Sinersys Technologies||14/03/2008||3||DF|
|SERVICIOS TELEPRO, S.A. DE C.V.||SERVICIOS TELEPRO, S.A. DE C.V.||29/05/2008||3||DF|
|Accenture Technology Solutions – Mexico||Accenture – MXDC||22/08/2008||3||DF|
|EDS, an HP Company||Mexico City SAT account – Servicio de Aduanas Area – AGA-Administración General de Aduanas||15/10/2008||3||DF|
|BLITZ SOFTWARE||BLITZ SOFTWARE||20/12/2008||3||DF|
|QuarkSoft S.C.||QuarkSoft S.C.||27/02/2009||3||DF|
|Azertia Tecnologias de la Información México S.A. de C.V. (Una Empresa de INDRA SISTEMAS S.A.)||Azertia Tecnologias de la Información México S.A. de C.V. (Una Empresa de INDRA SISTEMAS S.A.)||13/03/2009||3||DF|
|T&D AUTOMATED TESTING AND DEVELOPMENT SOFTWARE, S.A. DE C.V.||GRUPO TECNIS||03/04/2009||3||DF|
|Vision Consulting||Software Development and Maintenance Projects||25/09/2009||3||DF|
|AsTecI S.A. de C.V.||Software Development and Maintenance||28/01/2010||3||DF|
|IBM AMS Mexico||Grupo Modelo Account||19/03/2010||3||DF|
|IBM AMS Mexico||Grupo Nacional Provincial Account||04/06/2010||3||DF|
|D&T Tecnología S de RL de CV||Deloitte GDC México||31/07/2009||3||GTO|
|VENTUS Technology S.A. de C.V.||VENTUS Technology||22/03/2008||3||NL|
|World Software Services Group, SA de CV||World Software Services Group, SA de CV||25/03/2009||3||NL|
|AD INFINITUM S.A. de C.V.||Software development and implementation services||14/08/2009||3||NL|
|SYTECSO, S.A. de C.V||Software Factory||28/08/2009||3||NL|
|Expert Sistemas Computacionales S.A. de C.V.||Expert Tecnología||29/08/2009||3||NL|
|OPEN ROAD Solutions S de RL de CV – Queretaro Mexico||OPEN ROAD Solutions S de RL de CV||19/12/2008||3||QRO|
|ALTEC Mexico S.A. de C.V.||ALTEC Mexico S.A de C.V.||19/06/2009||3||QRO|
|ImagenSoft by Imagen y Sistemas Computacionales, S.C.||ImagenSoft Projects Division||03/07/2008||3||SIN|
|Expresión Informativa y Técnicas Organizadas S.A. de C.V. (Éxito Software)||New Developments Division||18/12/2008||3||SIN|
|DESARROLLADORA HOMEX S.A. DE C.V||IT Deparment||04/06/2010||3||SIN|
|TSI ARYL S. de R.L. de C.V.||QUALISYS – SYSTEMS AREA||12/09/2008||3||SON|
|INNEVO (Susoc & Vates S.A. de C.V.) (Compartida con Argentina)||Innevo Software Development Services, Product Factory||07/09/2007||3||JAL|
|CRS IT Consulting S.A. de C.V. (Compartida con Argentina)||Technical Solution Implementation Unit||03/07/2009||3||DF|
|Sieena Software S. de R. L. de C. V. (Compartida con Estados Unidos)||Sieena Software S. de R. L. de C. V.||17/07/2009||3||COAH, NL|
|INNEVO||Custom Software Development Unit||11/06/2010||4||JAL|
|Hildebrando Software Factory||Hildebrando Software Factory||07/09/2007||5||AGS|
|ULTRASIST S.A. de C. V.||ULTRASIST||28/03/2009||5||DF|
|PRAXIS DE MÉXICO, S.A. DE C.V.||CEDS (Center of Excellence for Development of Software)||18/12/2009||5||DF|
|IBM||Application Management Services Mexico||30/03/2010||5||JAL|
|Softtek||GDC Monterrey High Growth Accounts||04/12/2009||5||NL|
|SigmaTao Factory, S.A. de C.V.||SigmaTao Factory, S.A. de C.V.||24/08/2007||5||QRO|
What we find remarkable is that in Mexico there are five Level-5 CMMI certifications, leaving the country ahead of most other nations in regard to this level of maturity, with the exception of India (63), the United States (40) and China (20). This means that although there are still few companies with CMMI, we have a high level there. This is also substantiated by the fact that unlike those countries, most Mexican companies are certified by the organization as a whole, not just a specific division or project.
On the other hand, it is quite noticeable how centralized is the software industry in Mexico, for almost all certifications are agglomerated around the Distrito Federal (22) and the states of Nuevo Leon (12), Sinaloa (11) and Jalisco (8). Guanajuato and Queretaro contribute with 4 certifications each; Chihuahua, Coahuila and Puebla contribute with 2 certifications by state. Finally, in Sonora, Aguascalientes, Baja California and Yucatan there is one company certified by each state. The surprise here is Sinaloa, as it has surpassed Jalisco (and its Mexican Silicon Valley) by number of certifications. More so when Sinaloa is traditionally viewed as a farming, cattle raising or tourism-driven state. Way to go for the Sinaloans!
CMMI serves not only as a platform to promote ourselves before a global market; the fact that the most important companies and technology institutions in the world such as NASA, Siemens, T-Systems, Samsung and Accenture have a certification of this type means it DOES help as a model of process improvement to develop products and services with high quality standards. In fact, companies that are not on this list tend, for better or worse, to disappear or be bought by the competition. The harsh reality of competition in the business environment:
Never interrupt your enemy when he is making a mistake.
— Napoleon Bonaparte (1769-1821),
French general and politician.