A recently released set of guidelines from the Carnegie Mellon Software Engineering Institute (SEI) is aiming to improve operational efficiency for businesses acquiring IT software and services. But some experts say the framework may be too focused on major global enterprises and that small and medium-sized organizations might be better served to consider alternative guidelines.
The SEI’s Capability Maturity Model Integration for Acquisition (CMMI-ACQ), created to address a growing need for IT acquisition standards, attempts to avoid the problems in the acquisition process, by managing the process for acquiring IT products and services and developing a common language between those parties. The ultimate goal, according to SEI’s Director and CEO Paul Nielsen, is that IT projects are delivered on-time and on-budget.
“Software affects us all and today, more than ever, we need software that is built with quality, usable, maintainable, evolvable, and developed on-time and on-budget,” Nielsen said. “CMMI-ACQ is significant in that organizations worldwide will now have a comprehensive best practices model for the acquisition of software-intensive systems and technology products and services.”
The framework builds upon the best practices found in CMMI for Development, which is a set of standards used globally for software developers. CMMI-ACQ is part of the CMMI Product Suite, which collects best practices for IT departments to improve their processes. It also includes the Standard CMMI Appraisal Method for Process Improvement.
The CMMI-ACQ guidelines were built with help from one of the world’s biggest companies, General Motors. The framework is currently being supported and implemented by large organizations such as HP, Cape Gemini and the U.S. Department of Defense. This global enterprise focus brings into question as to whether or not the guidelines will have any relevance to companies that isn’t a multinational corporation.
A related set of guidelines, Control Objectives for Information and related Technology (CobIT), is published by the Information Systems Audit and Control Association (ISACA) and offers guidance and best practices to manage a variety of different processes, including planning, delivery, monitoring and acquisition.
And according to Debra Mallette, a director at ISACA’s San Francisco chapter, alternative models such as this may be better suited to most companies looking to change their processes. She said, as with all SEI CMMI models, there is a question as to whether a small organization would benefit from adopting the practices.
“For these companies, it would be a whole lot more cost effective and efficient to go through a CobIT process, rather than direct to a CMMI,” Mallette said. “There’s an enormous amount of start-up costs when you’re going into a CMMI-based model, the fact that CobIT is a tenth of the size of CMMI will demonstrate that. Also, you have to invest in a week’s worth of training and you can’t take direct advantage of your current internal controls.”
Mallette suggested that CobiT QuickStart, an abbreviated version of Cobit designed for small-to-medium-sized enterprises, could be an easier and more cost effective alternative. However, Mallette, who has co-authored whitepapers on the effective use of CMMI and CobIT together, said both process models can be beneficial for most enterprise-level organizations.
“This new acquisition model from the CMMI gives additional support to some weaknesses that were not supported by the original CMMI,” Mallette said. “My findings in general for CobIT versus these various best practices models is that CobIT is effective when working with these models to give more detailed guidance to the organizations in implementing particular control objectives.”
Even the page count of the CMMI-ACQ document itself has caused analysts to question it’s viability for smaller enterprises.
“It’s 441 pages of process methodology talk, and very few outside of the largest organizations and IT shops are going to have the time and energy to invest in that,” said Jeff Muscarella, a partner at management consulting firm NPI Inc. in Atlanta. “You have to be kind of a process zealot to want to wade through it.”
But Nielsen said over 2,000 organizations are already familiar with and have invested into CMMI development and that the framework was designed to make it easy for companies to translate their CMMI knowledge into the new acquisition guidelines.
“Although, we haven’t really piloted this with many smaller companies yet, but we really do believe that it is applicable to every company, big or small,” Nielsen said.
He also said that the guidelines can actually help smaller companies compete in the market, because it gives them the same understanding and lingo as the bigger market players.
With files from Patrick Thibodeau
