TOP TOC 
Agile . since Jun 23 . Index . DOCs TOP TOC
Like many quality-based initiatives, CMM appeals to organizations and managers interested in control and certification since it gives them some objective qualification of their software development process. The process is normally that an outside CMM organization will come in to certify an organization for a specific CMM level. This is important in organizations where CIOs and others are looking for ways to add outside creditability.
CMM certification was first required, as you might expect, on DOD projects, and, over time, it has been extended to a variety of federal, state, and local agencies. Today, many large private organizations lean heavily on CMM certification as a means of screening software vendors. As previously mentioned, certain outsourcing vendors, especially the large "body shops" in India, see high-level CMM certification as both a marketing and management tool. By showing that they are independently certified, they increase their creditability and reduce client concerns about moving development out of house or out of the country.
Also, as we've mentioned, some organizations have gone a step further by exposing their management processes to their clients via the Web, allowing customers to track their CMM processes in, more or less, real time, and this trend is certain to continue.
Furthermore, there is certainly nothing wrong with being well managed. Software is not such a unique business where good management practices don't apply. In many respects, CMM represents applied common sense. On the other hand, it is important to understand where it comes from (i.e., large outsourced projects).
CMM is clearly the best-known, best-documented software management method in the world. There are tens of thousands of managers and programmers who have been trained in its use and who find CMM as easy shorthand for communicating with others. Being recognized as an industry best practice has many advantages to an organization trying to better itself.
Agile . since Jun 23 . Index . DOCs TOP TOC
On the negative side, many people have argued that CMM certification appears to be somewhat arbitrary. Organizations that certify in CMM make their money by showing that it has helped organizations move up the ladder to Level 5. Getting certification, at least at Levels 2 and 3, often seems to be more associated with good paperwork than with good management. It is, after all, very difficult for an outside organization to come in, and, in a very short time, determine whether an organization is doing what it says it's doing. Just look at the current accounting mess we're in with Enron, WorldCom, and others.
A second major concern is that CMM certification is largely about an organization's management processes (estimating, scheduling, control) and not nearly so much about the quality of the software products produced.9 There are even those who say that to become a Level 2 or 3 organization, a company doesn't necessarily need to have a good (or state-of-the-art) software process in place but only must blindly follow whatever process it has.
Other critics say that CMM certification is not so much of a quality certification, but a marketing one. As with ISO 9000, organizations seeking CMM certification bend over backward to produce reams upon reams of documentation that can then be reviewed by CMM inspectors. (In defense, we noted earlier that although many of the Indian software organizations came into CMM for marketing purposes, the process generally becomes ingrained and produces much better overall software management.)
No matter what your viewpoint, though, one thing is clear: CMM Level 3 or 4 ordinarily involves a very strong (heavy-handed) management style. By and large, more attention in these organizations is paid to project management than to actual production. This is a matter of concern for many software developers who would much rather design and program than fill out project management forms.