The CMM’s five software process maturity levels are identified as initial, repeatable, defined, managed, and optimizing. The 18 KPAs distributed in Levels 2 to 5 are: 6 KPAs for Level 2, 7 KPAs for Level 3, 2 for Level 4, and 3 for Level 5. To achieve a higher maturity rating, an organization must first satisfy all the KPAs of the preceding maturity level.
The philosophy of the CMM requires that at Level 2, an organization should focus on individual projects and their management. Each project should choose methods, standards, procedures, and training.
At Level 3, the focus shifts to the organization itself. The organization now articulates and supports those standards, methods, and procedures that have worked for projects in the past and then assembles a database of metrics that projects may consult when they need to understand past projects. Thus, projects can refer to the organization’s supported methods, procedures, definitions, and documents and tailor them for particular needs, rather than having to define things from scratch. At Level 3, the organization also provides more centralized support for training, which had previously been the primary responsibility of individual projects.
The focus of Level 4 shifts back to the project level and provides goals for quantitative management. Level 4 requires that projects establish (and then achieve) quality product goals and that they use past data to analyze present performance to see if it falls within established limits.
Level 5 focuses on improving the quantitative limits, both from a process and product point of view. Another name for this is continuous process improvement.