CMMI Model

Quick Reference
Guide
CMMI V3.0

An overview of the Capability Maturity

Model Integration (CMMI)® Model

CMMI Performance Solutions

 Table of Contents
CMMI MODEL: WHAT IS IT? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
CMMI MODEL ARCHITECTURE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4
PRACTICE AREA SUMMARIES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Causal Analysis and Resolution (CAR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6
Configuration Management (CM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Continuity (CONT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
Data Management (DM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Data Quality (DQ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8
Decision Analysis and Resolution (DAR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .9
Enabling Safety (ESAF) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
Enabling Security (ESEC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Enabling Virtual Work (EVW) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
Estimating (EST) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
Governance (GOV) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12
Implementation Infrastructure (II) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
Incident Resolution and Prevention (IRP) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14
Managing Performance and Measurement (MPM) . . . . . . . . . . . . . . . . . . . . . . . . . . 15
Managing Security Threats & Vulnerabilities (MST) . . . . . . . . . . . . . . . . . . . . . . . . . 16
Monitor and Control (MC) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17
Organizational Training (OT) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Peer Reviews (PR) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
Planning (PLAN) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Process Asset Development (PAD) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20
Process Management (PCM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21
Process Quality Assurance (PQA) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22
Product Integration (PI) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23
Requirements Development & Management (RDM) . . . . . . . . . . . . . . . . . . . . . . . . . 24
Risk and Opportunity Management (RSK) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
Service Delivery Management (SDM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26
Strategic Service Management (STSM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
Supplier Agreement Management (SAM) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
Technical Solution (TS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29
Verification and Validation (VV) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30
Workforce Empowerment (WE) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31
SAMPLE PRACTICE AREA: PQA . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32
GET STARTED WITH CMMI . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34

2 | CMMI Model Quick Reference Guide

 INTRODUCTION: BEST PR ACTICES

CMMI Model: What Is It?

The Capability Maturity Model Integration (CMMI) is a proven set Over 14,000 appraised
of global best practices that drives business performance through organizations report
building and benchmarking key capabilities.
performance results
CMMI best practices focus on improving performance and aligning operations
achieved by leveraging
to business goals. Designed to be understandable, accessible and flexible for
any business or industry, and integrates with and enables other standards
CMMI to set, meet, and
and methodologies such as ISO, NIST, agile, DevSecOps, and AI, CMMI helps exceed organizational
organizations understand their current level of capability and performance and business goals.
offers a guide to optimize business results.

Whether your organization wants to build a new capability or improve and

The CMMI Model is available for
mature an existing one, CMMI provides the best practices for doing so across subscription purchase at:
a broad spectrum of industries, disciplines, and domains to continue to help [Link]/model-viewer
organizations improve their performance effectively and efficiently. The eight
domains in the CMMI model include:

DOMAIN CAPABILITY DESCRIPTION

Data (DATA) Governing and managing data and data quality

Development (DEV) Creating products or solutions, including hardware, software, and related components

People (PPL) Developing, retaining, and enabling the workforce to accomplish objectives

Safety (SAF) Providing and maintaining safe products, services, and other solutions

Security (SEC) Identifying and strengthening critical defenses, increasing resilience against threats

Services (SVC) Building and delivering an intangible solution comprised of activities or work

Managing a company, organization, or person that supplies or provides products,

Suppliers (SPM)
services, or other solutions

Virtual (VRT) Delivering products, services, or other solutions from remote locations

NOTICE: This Quick Reference Guide is designed to be a summary quick reference. It is not intended
for use as a substitute for the CMMI Model. Per CMMI Policies, this document is NOT to be used as a
replacement of the full Model for appraisals or courses. Refer to the CMMI Model for additional required
information, explanatory information, example activities, example work products, and context-specific
information needed to accurately and consistently understand and adopt each Practice and Practice Group
levels for adoption, appraisal, and training purposes.

3 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 CMMI Model Architecture
The CMMI Model architecture consists of multiple components from categories of larger
logical groupings of Capability Areas that address common problems encountered by
businesses when producing or delivering solutions to Practice Areas, down to individual
practices. The table below is shown for each Practice Area to provide context information
on which Category, Capability Area, and Domain it belongs to, additional detailed
information on CMMI Model architecture can be found in the Appendix.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

Process
Ensuring
Doing ENQ Core Quality PQA 1 1
Quality
Assurance

Practice Areas
A Practice Area is a collection of similar practices that together achieve the defined intent,
value, and required information described in it. This Quick Reference Guide includes all
CMMI Practice Areas and practice group level summaries.

Practice Group and Maturity Levels

Within a Practice Area, practice group levels are evolutionary and sequential. Practice
Group Level 2 practices subsume entirely all Practice Group Level 1 practices, and then
Practice Groups 3-5 build upon each other, requiring that the lower levels are in place to
have the higher practice group levels fully addressed. Maturity level ratings describe the
degree to which processes in an Organizational Unit (OU) meet the intents and values of a
predefined set of Practice Areas of a specified set of practice group levels.

4 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 Practice Group Level Descriptions

LEVEL
5
• Builds on Level 4 practices
• Uses statistical and other quantitative
techniques to optimize performance
and improvement to achieve QPPOs
Optimizing

• Builds on Level 3 practices

LEVEL • Uses statistical and other quantitative techniques
to understand performance variation and detect,

4
Quantitatively
refine, or predict the area of focus to achieve
quality and process performance objectives
• Identifies and understands variation, and predicts
Managed and improves the ability to achieve Quality and
Process Performance Objectives (QPPOs)

LEVEL • Builds on Level 2 practices

• Uses organizational standards and tailoring to

3 address project and work characteristics

• Projects use and contribute to organization assets
• Focuses on achieving both project and organizational
Defined performance objectives

LEVEL • Subsumes Level 1 practices

• Simple, but complete set of practices that address the

2 full intent of the Practice Area

• Does not require the use of organizational assets
• Identifies and monitors progress towards project
Managed performance objectives

LEVEL • Initial approach to meeting the intent of the Practice Area

1
• Not a complete set of practices to meeting the full intent of
the Practice Area
• Begins to address performance issues
Initial

5 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 Practice Area Summaries
CAUSAL ANALYSIS AND RESOLUTION

Intent: Identifies causes of selected outcomes and takes action to either prevent
recurrence of undesirable outcomes or ensure recurrence of positive outcomes.

Value: Addresses causes of issues, eliminating rework and directly improving

quality and productivity.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 1

2 2
Causal
Supporting
Enabling SI Core Analysis and CAR 3 5
Implementation
Resolution
4 2

5 1

Practice Group (PG) Level Summary: This PA contains a total of 11 practices.

¬ Level 1: Select outcomes and addressing their causes.
¬ Level 2: Select outcomes for analysis and address their causes.
¬ Level 3: Requires an organizational approach to determine causes using organizational processes, proposing
and implementing actions, recording resolution data, and submitting improvement proposals.
¬ Level 4: Perform root cause analysis and evaluate the effects of actions using statistical techniques.
¬ Level 5: Uses statistical techniques to evaluate solutions and processes for optimizing performance across
the organization.

6 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 CONFIGURATION MANAGEMENT

Intent: Manages the integrity of work products using configuration

identification, version control, change control, and audits.

Value: Reduces loss of work and increases the ability to deliver the correct
version of the solution to the customer.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

Supporting Configuration 1 1
Enabling SI Core CM
Implementation Management 2 6

Practice Group (PG) Level Summary: This PA contains a total of 7 practices.

¬ Level 1: Perform basic version control.
¬ Level 2: Manage and control identified items and placing those items under configuration control. Use a
configuration and change management system to develop and release baselines, manage changes, and
describe versions. Perform configuration audits to maintain configuration integrity.

CONTINUITY

Intent: Anticipates and addresses disruptions to critical business operations

so work can continue or resume as soon as possible.

Value: Enables continued operation when serious disruptions or catastrophic

events occur.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 1
Managing
Managing Business MBR SVC Continuity CONT 2 3
Resilience
3 3

Practice Group (PG) Level Summary: This PA contains a total of 7 practices.

¬ Level 1: Develop contingency approaches for managing significant disruptions to operations
¬ Level 2: Identify and prioritize functions and resources essential for continuity and develop and follow continuity
plans to resume operations.
¬ Level 3: Requires an organizational approach for developing, providing, and evaluating continuity training
and analyzing results from verifying and validating the continuity plans.

7 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 DATA MANAGEMENT

Intent: Identifies, implements, and controls the approach and activities for
managing data.

Value: Maximizes operational efficiency by prioritizing critical data activities to

meet performance needs.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 2
Data
Enabling Managing Data MD DATA DM 2 2
Management
3 2

Practice Group (PG) Level Summary: This PA contains a total of 6 practices.

¬ Level 1: Identify objectives and use metadata to manage data.
¬ Level 2: Develop and follow a data management architecture and approach.
¬ Level 3: Requires an organizational approach to establish and deploy an organizational data management
capability, and performing reviews of the organization’s data management capability and acting on results.

DATA QUALITY

Intent: Develops, follows, and keeps updated an approach for implementing

data quality standards.

Value: Maximizes the value and accuracy of data for effective business
operations and consistent decision-making.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 2

Enabling Managing Data MD DATA Data Quality DQ 2 3

3 2

Practice Group (PG) Level Summary: This PA contains a total of 7 practices.

¬ Level 1: Identify data quality parameters and perform data cleansing activities.
¬ Level 2: Define criteria for data cleansing, and develop and follow a data quality approach.
¬ Level 3: Requires an organizational approach to conducting data quality assessments and reviewing the
effectiveness of the organization’s data quality activities and acting on results.

8 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 DECISION ANALYSIS AND RESOLUTION

Intent: Makes and records decisions using a recorded process that analyzes
alternatives.

Value: Increases the objectivity of decision-making and the probability of

selecting the optimal solution.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 2
Decision
Supporting
Enabling SI Core Analysis and DAR 2 5
Implementation
Resolution
3 1

Practice Group (PG) Level Summary: This PA contains a total of 8 practices.

¬ Level 1: Identify alternatives and make decisions.
¬ Level 2: Develop rules and criteria for making and evaluating decisions, identifying alternatives, evaluation
methods, and using them to select solutions.
¬ Level 3: Requires an organizational approach to role-based decision-making.

ENABLING SAFETY

Intent: Minimizes and mitigates safety risks within the tolerance parameters
and constraints of operational effectiveness, time, and cost.

Value: Reduces the residual safety hazard risk to an acceptable tolerance level.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 2
Managing
Enabling
Enabling Security and MSS SAF ESAF 2 3
Safety
Safety
3 3

Practice Group (PG) Level Summary: This PA contains a total of 8 practices.

¬ Level 1: Identify and address prioritized safety needs and hazards.
¬ Level 2: Identify critical safety needs, constraints and objectives and approaches to address workplace
environment safety and functional safety.
¬ Level 3: Establish an organizational safety capability, perform safety evaluations and act on results, and
follow organizational safety control strategies.

9 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 ENABLING SECURITY

Intent: Develops and keeps updated the security approach that includes
anticipating, identifying, and taking actions to avoid or minimize the impacts of
security issues on an organization or solution.

Value: Reduces the impact of security threats and vulnerabilities on business

performance.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

Managing 1 2
Enabling
Enabling Security and MSS SEC ESEC 2 4
Security
Safety 3 3

Practice Group (PG) Level Summary: This PA contains a total of 9 practices.

¬ Level 1: Identify, address, and prioritize security needs and issues.
¬ Level 2: Identify, address, and prioritize security needs and issues to develop a security approach and objectives
to address physical, mission, personnel, process-related and cybersecurity needs.
¬ Level 3: Requires an organizational security operations capability to implement an organizational security
strategy, approach, and architecture. Perform security reviews and evaluations and act on their results.

ENABLING VIRTUAL WORK

Intent: Defines and manages an approach for effective virtual work and
operations.

Value: Maximizes delivery effectiveness and efficiency while reducing the

impact and expense from travel and in-person activities.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT
1 2
Managing the Enabling
Managing MWF VRT EVW 2 2
Workforce Virtual Work
3 2

Practice Group (PG) Level Summary: This PA contains a total of 6 practices.

¬ Level 1: Identify virtual work needs and constraints and performing virtual work.
¬ Level 2: Develop an approach to consistently perform virtual work, manage a virtual work approach, and take
corrective action when needed.
¬ Level 3: Develop and use an organizational strategy, approach, and functional capability for performing
virtual work, periodically review the effectiveness of that approach, and act on results.

10 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 ESTIMATING

Intent: Estimates the size, effort, duration, and cost of the work and resources
needed to develop, acquire, or deliver the solution.

Value: It provides a basis for making commitments, planning, and reducing

uncertainty, which allows for early corrective actions and increases the
likelihood of meeting objectives.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 1
Planning and
Managing PMW Core Estimating EST 2 3
Managing Work
3 2

Practice Group (PG) Level Summary: This PA contains a total of 6 practices.

¬ Level 1: Develop estimates to perform work.
¬ Level 2: Develop the scope of what is being estimated, including size and then related effort, duration, and cost
and their rationale.
¬ Level 3: Use an organizational approach for estimation method(s) and use an organizational measurement
repository and process assets for estimating.

11 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 GOVERNANCE

Intent: Provides guidance to senior management on their role in the

sponsorship and governance of performance, processes, and related activities.

Value: Minimizes the cost of process implementation, increases the likelihood

of meeting objectives, and verifies that the implemented processes support
and contribute to the success of the business.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 1

Sustaining Habit 2 4
Improving SHP Core Governance GOV
and Persistence 3 3

4 1

Practice Group (PG) Level Summary: This PA contains a total of 8 practices.

¬ Level 1: Senior management identifies what is important and defines an approach to accomplish the objectives
of the organization.
¬ Level 2: Senior management define and communicate organization objectives for performance improvement
and requires they provide function, resources and training for following processes. Senior management
identifies their information needs and use the collected information to provide governance and oversight of
performance improvement. Senior Management holds people accountable for following processes and meeting
performance objectives.
¬ Level 3: Senior management directs that measures are collected analyzed and used to support business
objectives and confirms that competencies and processes are aligned with organization objectives.
¬ Level 4: Senior management makes selected decisions driven by statistical and quantitative analysis related
to performance and achievement of Quality and Process Performance Objectives (QPPOs).

12 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 IMPLEMENTATION INFRASTRUCTURE

Intent: Ensures that the processes and assets important to an organization’s

performance are habitually and persistently followed, used, and improved.

Value: Sustains the ability to consistently achieve goals and objectives

efficiently and effectively.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 1
Sustaining 2 2
Implementation
Improving Habit and SHP Core II
Infrastructure 3 3
Persistence
4 1

Practice Group (PG) Level Summary: This PA contains a total of 7 practices.

¬ Level 1: Performing processes to address the Level 1 practices in scope.
¬ Level 2: Allocating adequate resources, funding, and training to develop and implement processes. Additionally,
these processes should be regularly updated and verified to ensure they are being properly followed.
¬ Level 3: Utilizing organizational processes and assets to plan, manage, and execute work. Assessing the
adherence to these processes and their effectiveness, while also contributing relevant process-related
information or assets back to the organization.
¬ Level 4: Requires an organizational capability to understand and apply statistical and other quantitative
techniques to accomplish the work.

13 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 INCIDENT RESOLUTION AND PREVENTION

Intent: Resolves and prevents disruptions promptly to sustain service delivery

levels.

Value: Minimizes the impact of disruptions to meet objectives and customer

commitments more effectively.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 1
Managing Incident
Managing Business MBR SVC Resolution and IRP 2 3
Resilience Prevention
3 2

Practice Group (PG) Level Summary: This PA contains a total of 6 practices.

¬ Level 1: Record and resolve incidents.
¬ Level 2: Create and follow a plan for incident resolution and prevention. Ensure that each incident is monitored,
resolved to closure, and the status communicated effectively.
¬ Level 3: Use an organizational incident management system for processing and tracking incidents and their
resolution and analyzing selected incident and resolution data for prevention of future incidents.

14 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 MANAGING PERFORMANCE AND MEASUREMENT

Intent: Manages performance using measurement and analysis to achieve

business objectives.

Value: Maximizes business return on investment by focusing management

and improvement efforts on cost, schedule, and quality performance.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 2

Managing 2 6
Improving Performance
Improving IMP Core MPM 3 6
Performance and
Measurement 4 5

5 3

Practice Group (PG) Level Summary: This PA contains a total of 22 practices.

¬ Level 1: Collect measures and identify and address performance issues.
¬ Level 2: Set and update measurement and performance objectives based on business needs. Develop
and maintain operational definitions for these measures, then collect, analyze, and store the relevant data
accordingly and taking actions to address any issues.
¬ Level 3: Requires an organizational approach to develop, maintain, and utilize measurement and
performance objectives that align with business goals. Follow organizational processes to develop and
update operational definitions for these measures, and establish a data quality process. The organization
uses and updates the organization’s measurement repository, analyzes performance data to identify and
address improvement needs, and periodically communicates performance results to the organization.
¬ Level 4: Apply statistical and quantitative methods to develop, update, and communicate quality and
performance objectives that align with business goals and choosing appropriate measures and analytical
techniques to manage performance and achieve these objectives. These methods are then used to establish
and update performance baselines and models, and to predict or determine the achievement of quality and
performance goals.
¬ Level 5: Utilize statistical and quantitative techniques to align business objectives with strategy and optimize
performance, analyzes performance data to assess the organization’s ability to meet business objectives
and identify areas for improvement, and selecting and implement improvement proposals based on the
analysis of their potential impact on achieving and enhancing business, quality, and performance objectives.

15 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 MANAGING SECURITY THREATS & VULNERABILITIES

Intent: Identifies the security threats and vulnerabilities that could

compromise the organization or solution, analyzes the potential impacts, and
defines and takes actions to address and mitigate them.

Value: Increases an organization’s capability and resilience to identify,

mitigate, and recover from threats and vulnerabilities.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 2
Managing
Managing 2 4
Security
Enabling Security and MSS SEC MST
Threats and 3 3
Safety
Vulnerabilities
4 1

Practice Group (PG) Level Summary: This PA contains a total of 10 practices.

¬ Level 1: Identify and record security threats and vulnerabilities, and take appropriate actions to address them.
¬ Level 2: Create and maintain a method for managing security threats and vulnerabilities, including up-to-date
criteria for evaluation. Use these criteria to prioritize, monitor, and address critical threats and vulnerabilities.
Assess and report on the effectiveness of the approach and actions taken to manage these issues.
¬ Level 3: Create, update, and follow an organizational security strategy, approach, and architecture for
evaluating, managing, and verifying threats and vulnerabilities. Analyze security verification and validation
results to ensure accuracy and consistency across the organization. Assess the effectiveness of the
security strategy, approach, and architecture in addressing these threats and vulnerabilities.
¬ Level 4: Use threat intelligence analysis, along with statistical and quantitative techniques, to enhance the
security approach and architecture. Select security solutions to address threats and vulnerabilities based on
this analysis.

16 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 MONITOR AND CONTROL

Intent: Provides an understanding of the project progress so appropriate

corrective actions can be taken when performance deviates significantly
from plans.

Value: Increases the probability of meeting objectives by taking early actions

to adjust for significant performance deviations.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 2
Planning and Monitor and
Managing PMW Core MC 2 4
Managing Work Control
3 4

Practice Group (PG) Level Summary: This PA contains a total of 10 practices.

¬ Level 1: Record task completions and identify and resolve issues.
¬ Level 2: Monitor actual results compared to estimates for size, effort, schedule, resources, knowledge, skills, and
budget. Track stakeholder involvement and commitments, oversee the transition to operations and support, and
take corrective actions if actual results deviate significantly from plans, managing these issues to resolution.
¬ Level 3: Use an organizational approach to manage the project according to the project plan and process,
handle critical dependencies and activities, and monitor the work environment for issues. Address and
resolve any issues in collaboration with affected stakeholders.

17 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 ORGANIZATIONAL TRAINING

Intent: Develops the skills and knowledge of personnel so they perform their
roles efficiently and effectively.

Value: Enhances individuals’ skills and knowledge to improve organizational

work performance.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT
1 1
Managing the Organizational
Managing MWF Core OT 2 2
Workforce Training
3 6

Practice Group (PG) Level Summary: This PA contains a total of 9 practices.

¬ Level 1: Train people.
¬ Level 2: Identify training needs, provide training to personnel, and maintain records of the training.
¬ Level 3: Create and update both strategic and short-term training plans for the organization. Coordinate training
needs and delivery between projects and the organization and use a training capability to address these needs.
Evaluate and report on the effectiveness of the training program and maintain accurate training records.

PEER REVIEWS

Intent: Identifies and addresses process performance and work product issues
through reviews by the producer’s peers or Subject Matter Experts (SMEs).

Value: Reduces cost and rework by uncovering issues or defects early.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT
1 1
Doing Ensuring Quality ENQ Core Peer Reviews PR 2 4
3 1

Practice Group (PG) Level Summary: This PA contains a total of 6 practices.

¬ Level 1: Perform reviews of work products and record issues
¬ Level 2: Create and update procedures and materials for conducting peer reviews, select work products for
review, and perform reviews using established procedures. Address and resolve any issues identified during the
peer reviews.
¬ Level 3: Use an organizational approach to analyze results and data from peer reviews.

18 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 PLANNING

Intent: Develops plans to describe what is needed to accomplish the work

within the standards and constraints of the organization.

Value: Optimizes cost, functionality, and quality to increase the likelihood of

meeting objectives.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 2

Planning and 2 8
Managing PMW Core Planning PLAN
Managing Work 3 4

4 1

Practice Group (PG) Level Summary: This PA contains a total of 15 practices.

¬ Level 1: Develop a list of tasks and assign people to them.
¬ Level 2: Create and continuously update the approach for completing the work, including planning for necessary
knowledge and skills. Develop and maintain the budget and schedule based on estimates, plan stakeholder
involvement, and prepare for the transition to operations and support. Ensure plans are realistic by reconciling
estimates with resource capacity and availability, develop and update the project plan, ensure consistency
among its components, and review plans to secure commitments from stakeholders.
¬ Level 3: Utilize the organization’s standard processes and tailoring guidelines to develop, update, and follow
the project process. Develop and maintain a plan using these processes, organizational assets, and the
measurement repository. Identify and negotiate critical dependencies, and plan for the project environment in
accordance with organizational standards.
¬ Level 4: Apply statistical and quantitative techniques to develop and continuously update project processes,
ensuring they support the achievement of quality and performance objectives.

19 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 PROCESS ASSET DEVELOPMENT

Intent: Develops the process assets necessary to perform the work and keeps
them updated.

Value: Provides a capability to understand and repeat successful performance.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 1
Improving Process Asset
Improving IMP Core PAD 2 3
Performance Development
3 6

Practice Group (PG) Level Summary: This PA contains a total of 10 practices.

¬ Level 1: Develop process assets to perform the work.
¬ Level 2: Identify the process assets required for the work, and develop, purchase, or reuse these assets as
needed. Ensure that the processes and assets are accessible.
¬ Level 3: Create and maintain a strategy for building and updating organizational process assets. Develop and
update a process architecture that outlines the organization’s processes and assets. Make these processes
and assets available in a process asset library. Develop and update criteria and guidelines for tailoring standard
processes and assets, as well as work environment and organizational measurement and analysis standards,
and ensure they are accessible for use.

20 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 PROCESS MANAGEMENT

Intent: Manages and implements the continuous performance improvement

of processes and infrastructure to meet business objectives by identifying
and implementing the most beneficial process improvements and making
performance results visible, accessible, and sustainable.

Value: Ensures that processes, infrastructure, and their improvement

contribute to successfully meeting business objectives.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 3

Improving Process 2 2
Improving IMP Core PCM
Performance Management 3 6

4 1

Practice Group (PG) Level Summary: This PA contains a total of 12 practices.

¬ Level 1: Establish a support structure to offer process guidance, resolve process problems, and drive
continuous improvement. Evaluate the current process implementation to identify strengths and weaknesses,
and address opportunities for improvement or process issues.
¬ Level 2: Identify potential improvements for processes and process assets, then develop, update, and follow
plans to implement the selected improvements.
¬ Level 3: Create and maintain process improvement objectives aligned with business goals. Identify key processes
that significantly contribute to these objectives. Explore and assess new processes, techniques, methods,
and tools to find improvement opportunities. Support the implementation, deployment, and maintenance of
process improvements, and deploy organizational standard processes and assets. Evaluate and report on the
effectiveness of these improvements in meeting process improvement objectives.
¬ Level 4: Apply statistical and quantitative techniques to validate performance improvements, ensuring they
meet proposed expectations, business objectives, or quality and process performance goals.

21 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 PROCESS QUALITY ASSURANCE

Intent: Verifies and enables improvement of the quality of the processes

performed and resulting work products.

Value: Increases the consistent use and improvement of the processes to

maximize business benefit and customer satisfaction.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 1
Process Quality
Doing Ensuring Quality ENQ Core PQA 2 4
Assurance
3 1

Practice Group (PG) Level Summary: This PA contains a total of 6 practices.

¬ Level 1: Identify and address process and work product issues.
¬ Level 2: Create and maintain a quality assurance approach and plan based on historical quality data. Objectively
evaluate processes and work products against recorded standards. Communicate quality issues and non-
compliance, ensuring they are resolved. Record and utilize the results of quality assurance activities.
¬ Level 3: Identify and record opportunities for improvement discovered during quality assurance activities.

22 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 PRODUCT INTEGRATION

Intent: Integrates and delivers the solution that addresses functionality,

performance, and quality requirements.

Value: Increases customers’ satisfaction by giving them a solution that meets

or exceeds their functionality and quality requirements.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 1
Engineering
Product
Doing and Developing EDP DEV PI 2 6
Integration
Products
3 3

Practice Group (PG) Level Summary: This PA contains a total of 10 practices.

¬ Level 1: Assemble solutions and deliver to the customer.
¬ Level 2: Create and maintain an integration strategy, along with an integration environment. Develop and update
procedures and criteria for integrating solutions and components. Ensure that each component is properly
identified, and functions as required before integration. Evaluate integrated components to confirm they meet
the solution’s requirements and design. Integrate solutions and components following the established strategy.
¬ Level 3: Regularly review and update interface or connection descriptions to ensure they are comprehensive
and consistent throughout the solution’s lifecycle. Before integration, confirm that component interfaces or
connections adhere to these descriptions. Assess integrated components for compatibility with the interfaces
or connections.

23 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 REQUIREMENTS DEVELOPMENT & MANAGEMENT

Intent: Elicits requirements, confirms common understanding by

stakeholders, and aligns requirements, plans, and work products.

Value: Increases likelihood that the solution meets or exceeds customer

expectations and needs.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 1
Requirements
Doing Ensuring Quality ENQ Core Development and RDM 2 5
Management
3 7

Practice Group (PG) Level Summary: This PA contains a total of 13 practices.

¬ Level 1: Record requirements.
¬ Level 2: Gather and confirm stakeholder needs, expectations, constraints, and interfaces, and ensure understanding
of the requirements. Translate these into prioritized customer requirements and secure commitment from project
participants for their implementation. Develop and maintain bidirectional traceability between requirements and
related activities or work products, ensuring that plans and outputs stay consistent with the requirements.
¬ Level 3: Create and maintain updated requirements for the solution and its components. Develop operational
concepts and scenarios and allocate requirements for implementation. Identify and update interface or
connection requirements, ensuring they are necessary and sufficient. Balance stakeholder needs and
constraints and validate requirements to ensure the solution will perform as intended in its target environment.

24 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 RISK AND OPPORTUNITY MANAGEMENT

Intent: Identifies, records, analyzes, and manages potential risks or

opportunities.

Value: Mitigates adverse impacts or capitalizes on positive impacts to

increase the likelihood of meeting objectives.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 1
Managing Risk and
Managing Business MBR Core Opportunity RSK 2 2
Resilience Management
3 5

Practice Group (PG) Level Summary: This PA contains a total of 8 practices.

¬ Level 1: Identify, record, and continuously update risks and opportunities.
¬ Level 2: Analyze identified risks and opportunities, monitor their status, and communicate updates to
affected stakeholders.
¬ Level 3: Identify and utilize categories for risks and opportunities, define parameters for their analysis and
handling, and develop and maintain a management strategy and plans for both using an organizational
approach. Implement the planned management activities to address the identified risks or opportunities.

25 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 SERVICE DELIVERY MANAGEMENT

Intent: Delivers services and manages the service delivery system.

Value: Increases customer satisfaction by delivering services that meet or

exceed customer expectations.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 1
Delivering and Service
Doing Managing DMS SVC Delivery SDM 2 6
Services Management
3 1

Practice Group (PG) Level Summary: This PA contains a total of 8 practices.

¬ Level 1: Utilize the service system to provide and manage services.
¬ Level 2: Create, record, and maintain service agreements, and ensure they are followed. Process service
requests and deliver services according to these agreements. Analyze existing agreements and service data to
prepare for updates or new agreements. Develop and follow procedures for operating and modifying the service
system, and verify that the system is ready to support service delivery.
¬ Level 3: Create, record, and maintain organizational standard service systems and agreements, and ensure they
are actively used.

26 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 STRATEGIC SERVICE MANAGEMENT

Intent: Develops and deploys standard services that are compatible with
strategic business needs and plans.

Value: Increases likelihood of meeting business objectives by aligning

standard services with customer needs.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 1
Delivering and Strategic
Doing Managing DMS SVC Service STSM 2 3
Services Management
3 1

Practice Group (PG) Level Summary: This PA contains a total of 5 practices.

¬ Level 1: Create a list of the services currently offered.
¬ Level 2: Create and maintain descriptions of current services and use them effectively. Collect, record, and
analyze data on strategic needs and capabilities for service delivery. Develop and follow a method for providing
new or modified services based on these strategic needs and capabilities.
¬ Level 3: Develop, keep updated, and use the set of organizational standard service descriptions and service levels.

27 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 SUPPLIER AGREEMENT MANAGEMENT

Intent: Selects qualified suppliers, establishes agreements, and manages the

resulting supplier and acquirer activities over the term of the agreement.

Value: Maximizes the probability of mutual success for acquirers and suppliers.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 4
Selecting and Supplier 2 5
Doing Managing SMS SPM Agreement SAM
Suppliers Management 3 2

4 1

Practice Group (PG) Level Summary: This PA contains a total of 12 practices.

¬ Level 1: Identify, evaluate, and choose suppliers, then develop and record the supplier agreement. Accept or
reject the deliverables from suppliers and process their invoices.
¬ Level 2: Identify evaluation criteria and potential suppliers, and distribute requests to them. Evaluate supplier
responses based on the criteria and select suppliers. Manage supplier activities as outlined in the agreement,
keeping it updated, and verify that the agreement is met before accepting deliverables. Handle supplier invoices
according to the terms of the agreement.
¬ Level 3: Conduct technical reviews of supplier performance and deliverables, and manage supplier performance
and processes according to the criteria outlined in the supplier agreement.
¬ Level 4: Choose appropriate measures and use analytical techniques to quantitatively manage suppliers,
verifying that they meet their performance targets.

28 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 TECHNICAL SOLUTION

Intent: Designs and builds solutions that meet requirements.

Value: Provides a cost-effective design and solution that meets customer

requirements and reduces rework.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 1
Engineering
Technical
Doing and Developing EDP DEV TS 2 3
Solution
Products
3 6

Practice Group (PG) Level Summary: This PA contains a total of 10 practices.

¬ Level 1: Develop a solution that satisfies the specified requirements.
¬ Level 2: Design and construct a solution to meet the requirements, evaluate the design to address any issues,
and provide guidance on how to use the solution effectively.
¬ Level 3: Create criteria for making design decisions and develop alternative solutions for selected components.
Conduct a build, buy, or reuse analysis to determine the best approach. Choose solutions based on the design
criteria, and develop, update, and use the necessary information for implementation. Design solution interfaces
or connections using established criteria.

29 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 VERIFICATION AND VALIDATION

Intent: Confirms selected solutions and components meet their requirements,

and demonstrates selected solutions and components fulfill their intended use
in their target environment.

Value: Increases the likelihood that the solution will satisfy the customer.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 2
Verification
Doing Ensuring Quality ENQ Core VV 2 3
and Validation
3 2

Practice Group (PG) Level Summary: This PA contains a total of 7 practices.

¬ Level 1: Conduct verification to ensure requirements are implemented correctly, recording and communicating
the results. Perform validation to confirm that the solution functions as intended in its target environment, and
record and communicate these results as well.
¬ Level 2: Choose components and methods for verification and validation. Develop and maintain the necessary
environment for these processes, and develop, update, and follow procedures for verification and validation.
¬ Level 3: Create and maintain criteria for verification and validation, and use them consistently, then analyze and
communicate the results of these verification and validation activities.

30 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 WORKFORCE EMPOWERMENT

Intent: Aligns the workforce to the organization’s business objectives and

empowers individuals and workgroups to perform their roles efficiently and
effectively.

Value: Enhances the capability of the workforce to contribute to the success

of the business.

CAPABILITY CORE/ PRACTICE PG PRACTICE

CATEGORY CA PA
AREA (CA) DOMAIN AREA (PA) LEVEL COUNT

1 1
Managing the Workforce
Managing MWF PPL WE 2 3
Workforce Empowerment
3 3

Practice Group (PG) Level Summary: This PA contains a total of 7 practices.

¬ Level 1: Identify and assign commitments to the relevant workgroups.
¬ Level 2: Record and assign work assignments, updating them based on qualifications, skills, and other criteria.
Manage transitions of individuals in and out of roles and workgroups. Develop and maintain communication
and coordination mechanisms both within and between workgroups.
¬ Level 3: Create and maintain workforce competencies to enhance organizational capabilities and meet
objectives. Develop and update an organizational structure and approach to empower workgroups. Establish
and regularly update organizational compensation strategies and mechanisms.

31 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 Sample Practice Area: PQA
Below is an excerpt from a Practice Area in the CMMI Model to demonstrate the differences
between it and the Practice Area summaries in this Quick Reference Guide. This provides a small
glimpse into the type of depth and richness of content available across each of the Practice Areas.

32 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
33 | CMMI Model Quick Reference Guide © 2024 ISACA. All Rights Reserved.
 Get Started with CMMI
Explore the many ways organizations can get started with CMMI by
browsing the resources at: [Link] and
CMMI Performance Solutions on [Link].

Explore the entire CMMI model content, graphics and more with a CMMI
Model Viewer subscription: [Link]/model-viewer.

About ISACA
ISACA® ([Link]) is a global community advancing individuals and organizations
in their pursuit of digital trust. For more than 50 years, ISACA has equipped individuals and
enterprises with the knowledge, credentials, education, training and community to progress
their careers, transform their organizations, and build a more trusted and ethical digital
world. ISACA is a global professional association and learning organization that leverages
the expertise of its 180,000+ members who work in digital trust fields such as information
security, governance, assurance, risk, privacy, and quality. We have a presence in 188
countries, including 225 chapters worldwide. Through the ISACA Foundation, ISACA supports
IT education and career pathways for undersourced and underrepresented populations.

© 2024 ISACA. All rights reserved. ISACA owns all copyright, trademark, and all other
intellectual property rights in the CMMI Content. You may not reproduce, duplicate,
copy, sell, resell, assign, transfer, create derivative works of, incorporate in any
1700 E. Golf Road, Suite 400
software or tool, or commercially exploit any portion of the CMMI Content, without
Schaumburg, IL 60173, USA
express written permission by ISACA. You are solely responsible for your use of the
CMMI Content, and agree to defend, indemnify, and hold ISACA harmless from any
Phone: +1.847.660.5505 Support: [Link]
claims, liability, damages, costs, or expenses incurred by ISACA arising from your use
Fax: +1.847.253.1755 Website: [Link] of the CMMI Content.