The Capability Maturity Model (CMM) is a framework initially developed to assess the maturity of the software development processes within an organization. It was created by the Software Engineering Institute (SEI) at Carnegie Mellon University in the late 1980s. The primary objective of CMM is to improve and optimize software development processes to enhance the quality of software products and the efficiency of development efforts [6] .

CMM originated from the need to address the challenges of inconsistency and unpredictability in software development. Organizations were struggling to consistently produce high-quality software within time and budget constraints. The CMM framework aimed to provide a structured approach for organizations to assess and improve their software development practices systematically [7] .

The history of CMM can be traced back to the late 1980s when the SEI was commissioned by the United States Department of Defense to address the quality and reliability issues in software development for defense projects. The initial version, CMM Level 1, focused on defining ad-hoc processes and aimed to bring stability to chaotic development environments.

In the realm of software development, the Capability Maturity Model (CMM) stands as a guiding framework, as described by Paulk et al. (1993) [6] . This model serves as a structured pathway for organizations to evaluate and enhance their software development processes. Comprising five distinct levels of maturity, the CMM offers progressive steps towards refined and well-defined processes [7] .

Level 1, known as the Initial level, organizations often find themselves amidst ad hoc and unpredictable processes. Standard procedures are lacking, and reliance on individual efforts is prevalent.

Level 2, the Managed level, organizations begin to lay the groundwork with basic project management practices. Here, processes become more structured, with a focus on planning, tracking, and ensuring requirements are met.

Level 3, the Defined level, signifies a significant leap forward. Organizations at this stage have established well-defined and standardized processes. These processes are documented, understood, and consistently applied throughout the organization.

Level 4, the Quantitatively Managed level, organizations delve into the realm of measurement and control. Quantitative techniques are utilized to gain insights into processes, aiming for predictability and continual improvement.

Level 5, the Optimizing level, represents the pinnacle of maturity. Organizations here are in a constant state of refinement, always seeking ways to optimize and enhance their processes. They actively seek feedback, innovate, and base decisions on data to achieve maximum efficiency and quality [7] .

In Figure 1, the more the framework is enforced on the process, the higher the maturity level of the organization as well as the outcomes resulting from the process. There are some fundamental concepts used in suing CMM described in Figure 2 [8] .

In Figure 2, the software process reflects many activities that are responsible for delivering the final product or software. There is an expected service or product that should result from those activities. The capability of the process refers to the expected product from the software process, while the process performance refers to the actual result or what really resulted from the software process.

Comparing the actual and expected results to determine the variance between them, or defining the extent to which they are equal, is the maturity of the process. So, the maturity level is usually high when the actual software delivered is close in nature and functionality to the expected result or product, while the maturity level is low when they are very different.

Maturity level is a number showing how well an organization is achieving the goals of the process, whether it is software or any other business process, as well as how well it is implementing the predefined practices set to achieve those goals.

In the context of process improvement, the Standard CMM Appraisal Method “SCAMPI” emerges as a comprehensive and methodical approach. This method is deployed to evaluate and enhance the maturity of an organization’s processes, specifically within the framework of the Capability Maturity Model Integration (CMMI) [9] .

Moreover, SCAMPI serves as a structured framework, aligning an organization’s processes with the defined goals and practices of the CMMI model.

The SCAMPI process unfolds through distinct stages, each integral to its efficacy. Beginning with meticulous planning, the appraisal team delineates the scope, objectives, and assessment criteria [10] .

Subsequently, the appraisal phase ensues, involving the meticulous collection and analysis of evidence such as interviews, documentation, and observations. These efforts culminate in determining the maturity level of the organization’s processes.

Following the assessment, the SCAMPI team generates a comprehensive report delineating the organization’s process landscape. This report meticulously outlines strengths, weaknesses, and areas ripe for improvement. Serving as a strategic roadmap, it guides the organization towards implementing changes and enhancements, facilitating a progression towards heightened process maturity [9] .

The Goal-Question-Metric (GQM) approach is a structured method used to define and measure goals in software engineering and other domains [1] . It establishes a hierarchy of goals, questions, and metrics, providing a systematic way to link an organization’s goals to the metrics that can measure their achievement [10] . GQM emphasizes the importance of understanding what an organization wants to achieve, what questions need to be answered to achieve those goals, and what metrics can provide the necessary data [10] .

The GQM method provides a framework for defining and measuring software quality.

The method is discussed as a practical guide for quality improvement in software development. It is designed to establish a set of goals and questions, which are then used to define metrics for measuring various aspects of the software development process. This includes measuring the quality of the product (software), the efficiency of the development process, and the utilization of resources [10] .

In Figure 3, GQM can measure product, process, and resources as follows:

Product:

Goal: Improve the reliability of the software product.

Question: How reliable is the software product?

Metric: Defect Density (number of defects per line of code).

Process:

Goal: Enhance the efficiency of the development process.

Question: How long does it take to complete each development phase?

Metric: Cycle Time (average time to complete a phase).

Resources:

Goal: Optimize resource allocation for project tasks.

Question: How are resources allocated across different project tasks?

Metric: Resource Utilization Rate (percentage of time resources are utilized) [10] .

The proposed approach in Figure 4 consists of four layers. The Refinement Layer is foundational, identifying, and refining goals with prioritization for effective strategies. The Iteration Layer then translates these goals into the GQM framework, creating metrics and computing maturity scores for tracking. Moving to the Development Layer, organization-wide maturity is calculated by weighting KPAs and combining their scores. The Knowledge Layer interprets data to craft a management report, offering insights for continuous improvement.

The “Refinement Layer” within the proposed approach serves as the initial step in the overall process, focusing on the meticulous enhancement of (KPAs). Through a systematic approach, this layer aims to clarify, prioritize, and refine the core processes that drive an organization’s success.

This layer involves refining the (KPAs) at CMM Level 2.

This layer focuses on translating the goals of each KPA into specific objectives, converting “Practices” into questions, and defining quantitative metrics to answer these questions as part of GQM approach. In a real-world scenario or when implementing this approach, we should follow the steps outlined from 3.3.1 to 3.3.6 for each KPA. However, for simplicity, we will conduct a measurement the first KPA “Project Planning” to illustrate the approach. The same steps can be followed in a similar manner but within a different context or in other words on the reset of KPAs.

The Knowledge Layer is where the raw data transforms into actionable knowledge. It involves interpreting the analysis matrix, deriving business insights, visualizing data for clarity, organizing through classification, and utilizing GQMs for strategic alignment. This layer bridges the gap between data and decision-making, empowering businesses with informed choices and strategic directions.

The Maturity Report is not just a numerical representation; it’s a roadmap to organizational excellence. It leverages the analysis matrix, GQM insights, and CMM framework to provide a comprehensive view of where the organization stands and where it can go.

Interpret the data in the analysis matrix to understand the strengths and weaknesses of the organization’s maturity in each KPA [14] . In Table 5 Project Planning the Weight is 0.15 refer to the applicability rate set by the organization for project planning KPA, Score is 4 this score is received from GQM of project planning, Weighted Score is the product of Weight (0.15) * score (4) = 0.6. Now let us sum up all weighted scores to compute the overall maturity score of the organization against the requirements of CMM framework level 2. So, the total CMM Level 2 Maturity Score is 2.17.

Ultimately, a comprehensive analysis of KPA maturity provides a roadmap for strategic growth and optimization, guiding organizations towards enhanced processes and better outcomes [14] . For instance understanding the maturity of KPA is paramount to illuminate the strengths and weaknesses of an organization’s maturity across various KPAs. The chart below is extracted from the data within the analysis matrix; it is presenting how each KPA contribution in the overall organization’s maturity towards achieving improved processes and matches the requirements of CMM framework.

Figure 5 provides a visual snapshot of the CMM Level 2 Maturity Scores for each KPA, allowing stakeholders to quickly identify areas of strength and potential improvement within the software delivery process. Supplier Agreement Management has the highest Weighted Score of 0.432, indicating it is a strong area within the CMM Level 2 assessment. Project Planning (PP) follows closely with a Weighted Score of 0.6, showing good maturity in this area. Configuration Management and Product and Process QA are also relatively strong with scores of 0.3625 and 0.296, respectively. Requirement Management and Project Control Management have moderate scores, indicating there may be some room for improvement in these areas. Measurement And Analysis has the lowest Weighted Score at 0.055, indicating it may be a weaker area that needs attention. Frequency table may be developed to discover the state of practices within the organization against the different CMM levels as show below:

In Figure 6 we graphically resent the data in Table 6. The ratios provided in the table, which indicate the distribution of practices within each Capability Maturity Model (CMM) level, hold significance for businesses. They offer insights into how resources and efforts are allocated at different stages of process maturity. For instance, the ratio of 24% for Initial indicates that out of the total practices identified, 24% are dedicated to ad hoc processes without much formalization or consistency. This suggests that at this stage, a significant portion of the organization’s efforts may be focused on reacting to immediate needs rather than following structured, standardized processes. Moving to the Defined level with an 11% ratio, businesses allocate fewer resources to documentation and standardization compared to the Initial stage. This suggests a shift towards more formalized processes with less emphasis on the sheer volume of practices and more on ensuring they are well-documented and standardized. The Managed level, with a ratio of 19.5%, indicates an increased focus on collecting process metrics to manage and control operations. Businesses at this stage are investing resources in data-driven decision-making and process control, which can lead to improved efficiency and quality. At the Repeated level, the ratio jumps to 26%,

showing a significant portion of practices dedicated to consistent execution with a focus on quality and efficiency. This suggests that businesses are prioritizing the refinement and optimization of their processes to achieve reliable results. Finally, the 19.5% ratio for the Optimized level indicates that despite the lower number of practices compared to Repeated, businesses are dedicating a substantial portion of their efforts to continuous process improvement ingrained in the organizational culture. This signifies a shift towards innovation, adaptability, and ongoing optimization, leading to sustained success and competitive advantage.

The prioritization of KPAs may involve subjective judgment, which can vary among evaluation team. To mitigate this, ensure that the prioritization process involves input from diverse stakeholders representing different perspectives within the organization. Additionally, consider incorporating objective criteria, such as impact on business objectives or alignment with strategic goals, to guide prioritization decisions [15] .

The method relies on self-assessment, which may introduce biases or inaccuracies in the evaluation process. To avoid this, consider supplementing self-assessment with external validation mechanisms, such as independent audits or third-party reviews, to provide a more objective perspective on the organization’s maturity level.

The method primarily focuses on KPAs defined within the CMM framework, [16] , which may not fully capture all relevant aspects of organizational maturity, particularly in rapidly evolving domains such as software development. To address this, consider complementing the CMM framework with additional maturity models or frameworks that address specific areas of concern or emerging trends in the industry [17] .

Sustaining long-term improvement efforts may be challenging. It is possible to establish mechanisms for continuous monitoring and review of maturity levels, set realistic improvement targets, and integrate maturity assessment into regular business processes to ensure ongoing focus and commitment to improvement [18] .

A notable limitation of the evaluation process lies in the challenge of accurately defining the weight or importance rate assigned to each Key Process Area (KPA) by the evaluation team and stakeholders. To address this issue, organizations can enhance the maturity assessment process through stakeholder engagement, data-driven decision-making, and transparency in documentation, in addition ensure that the weighting criteria accurately reflect organizational priorities and facilitate meaningful insights for continuous improvement [15] .