Wednesday, January 21, 2009

What is the difference between ISO certification and CMMI?

We are wondering what the difference is between CMMI Certification and ISO Certification is. We are ISO certified. Are there different levels of CMMI certificates? Any information you can send us would be very helpful.

If I had a nickel for every . . . . . well, I'd still be poor!

That's a great question though. A lot of organization's have been certified for ISO (9001/9001, 15504, etc) and wish to leverage that success towards the achievement of a level of CMMI.

Remember that ISO is an "audit standard" and that the CMMI is a "process model," so conceptually they're quite a bit different. Think of the CMMI as a large set of related "best practices" gathered from many product engineering and software development organizations. ISO can be very helpful, especially for marketing, HR, and quality, but it is not specifically focused on engineering and project management as is the CMMI. So the depth of CMMI in these areas is far greater.
You've obviously done some homework because you've identified one of the differences already. There are five levels of CMMI "maturity" with the vast majority of companies striving to achieve maturity Level Two or Three. ISO does not have this concept. Also, ISO is a "certification" and CMMI, although it looks and feels like one, is something you "achieve." The difference ends up being minor though (at least from your perspective) but it is a distinction.

ISO also doesn't focus with such depth and breadth on the various process areas (there are 22 process areas in the CMMI) and the appraisal process for CMMI (called SCAMPI) is quite a bit more rigorous. I'm not an ISO auditor, but my colleagues have told me that, while there is some overlap, the process of adopting CMMI is quite a bit more rigorous, as is the appraisal method (SCAMPI).

Your best bet is to get some education on CMMI through an authorized "Introduction to CMMI" training class, and to engage a Certified SCAMPI Lead Appraiser to discuss your particular goals and objectives as they relate to CMMI. If you email you'll be able to start the process of learning more about it.

Best of luck to you!


jgarzas said...

But... do you know ISO 15504? Really...

- "ISO is an "audit standard" and that the CMMI is a "process model,""... then ISO 12207 is not a process model? (ISO 12207 is the process model of 15504)

- "There are five levels of CMMI "maturity" with the vast majority of companies striving to achieve maturity Level Two or Three. ISO does not have this concept... do you now ISO 15504 part 7? (it has 5 leves of maturity)

Jeff Dalton said...

woops! Yes, of course, you're referring to SPICE, which has five levels (suspiciously similar to the CMMI I might add!). My mistake. SPICE has a few adopters here in the US, but not many. By the way, the original question, which I summarized, referred to ISO9001 - which is not a process model nor does it have levels.

Anonymous said...


I like this post very much. It help me to solve some my work under my director’s requirements.

Apart from that, below article also is the same meaning

ISO 9001 principles

Tks again and nice keep posting

Anonymous said...


I read a same topic 2 month ago. The topic helps me to improve my competency.

Apart from that, below article also is the same meaning

ISO 9001 standard

Tks again and nice keep posting

ISO Certification Training said...

Hey there Jeff! Nice article on the difference of the two. I was actually intrigued with SPICE. Can you explain what is SPICE?

Jeff Dalton said...

ISO Cert,

SPICE is a derivative of ISO 15504, which (suspiciously) looks a lot like the CMMI (its letters stand for "Software Process Improvement and Capability Determination"). Some here in the US have said it's a German attempt at codifying CMMI behaviors. I'm no expert at this, but as you can see from jgarzas comment above, some people are quite passionate about it!

Ansaria said...

i was trying to find some companies that have ISO 15504/SPICE certification, but i didnt see any. Do you have any idea why companies are avoiding SPICE?

Jeff Dalton said...


Its not too common in the US as compared to CMMI. There are some German firms that would disagree, I think the data tells the story. The CMMI dominates the market. SPICE lives primarily in the automotive industry (so called "A-SPICE"). It appears to be something that is limited to the German manufacturers here in the US.

Anonymous said...

So can anyone please tell i have started my new IT firm..then for which should I opt..CMMI or SPICE??

Jeff Dalton said...

There are many similarities between CMMI and SPICE. If you're business is located in Germany I would say there is more expertise in SPICE there - but most other places CMMI seems to dominate, especially here in the US.

And when it comes to contract requirements, SPICE has some presence in the German and Italian auto companies, but not much else here in the US.