CMMI Level 3 Appraisal: What to Prepare and How Long It Takes

Bottom line first: CMMI Level 3 is not "write a set of documents and hand them in" — it is proving with evidence that the organisation really runs its projects on standard processes: for the same type of project, different project teams should follow processes drawn from the same source, comparable to one another, tailorable, and traceable in the project records. So the weight of preparation is not on "how polished the documents look", but on two things: a set of organisation-level process assets, plus a complete evidence chain for 2-3 real projects.

The appraisal is led by an authorised Lead Appraiser using a SCAMPI-class method. What happens on site is document examination + personnel interviews + sampling of project evidence. In other words, documents can be fabricated; interviews and project records are hard to fake. That single fact sets the pace of the whole preparation: the processes have to actually run, the records have to actually grow, and that lead time cannot be compressed away.

This article follows the order "what it is → what Level 3 requires → who fits → preparation checklist → how the appraisal runs → timeline and investment → how it relates to ISO/ITSS → common pitfalls". Fees, timelines and headcount are all given as ranges, never as fixed figures — the specific arrangements are subject to the appraisal body and the Lead Appraiser.

1. What CMMI is: it appraises the "process", not the "product"

CMMI is the Capability Maturity Model Integration, aimed at the capability maturity of software and systems engineering and now maintained within the ISACA / CMMI Institute system. It does not look at whether your product is good, and it does not look at your code quality metrics; it looks at how mature, how stable and how replicable your organisation's way of running projects is.

Maturity runs from Level 1 to Level 5. The industry usually summarises it like this: Level 1 is the initial state, dependent on individuals and heroes; Level 2 is managed at project level, where a single project can run to plan; Level 3 is the Defined level, where the process rises from "the project" to "the organisation"; Level 4 moves into quantitative management; Level 5 is continuous optimisation. The names of the levels and their specific requirements are subject to the model documents issued by CMMI Institute for the current period; this article covers the skeleton only.

2. What Level 3 "Defined" actually requires

In one sentence: the organisation first has a set of standard processes, and projects then tailor them as needed and execute. There are two actions in that half-sentence, and it does not hold with either one missing:

So the difference between Level 3 and Level 2 is not "a few more processes", but moving from "this project team does a good job" up to "this company can do it with a different project team". A common follow-up question in review is: "Was this template written by your own department, or does it come from the company standard? The part you tailored out — on what basis, and who approved it?" — if that cannot be answered, the link between organisation level and project level is broken.

3. Which companies fit Level 3, and which can defer it

The test is still the same one: are you delivering software and systems by project, and do you have 2-3 projects of your own whose full lifecycle you can explain clearly? Among companies that meet it, demand usually comes from three types of drivers:

Two cases that can be deferred: first, companies whose work is mainly bespoke outsourcing, where every project is a one-off delivery and there is no reusable project type; second, very small teams, where a project group is only a handful of people, so the maintenance cost of organisation-level process assets outweighs the benefit — for those companies it is often better value to start at Level 2, or to put the ISO 9001 skeleton in place first.

One more reminder: a higher level is not automatically better. Level 3 is the tier that appears more often in tender documents; Levels 4 and 5 require quantitative management and process optimisation data, and the demands they place on the measurement system are of a different order. Pushing straight into them without several years of accumulated data is a poor return on investment.

4. Preparation checklist: process assets + project evidence chain

Push the work in the order "assets first, then projects, then top up the records" — do not reverse it. Doing it the other way round (write the documents first, then look for projects and fill in records to match) is the number one cause of rework.

How to select projects deserves a paragraph of its own: choose 2-3 real projects that you would be willing to have turned inside out, ideally covering different types (for example one new build, one iterative upgrade, one maintenance engagement), so that "the organisation-level standard processes can adapt to different projects" becomes a demonstrable statement. Projects that have only just started and have not yet produced process records, or pure staffing-outsourcing projects whose process is largely defined by the client, are not suitable appraisal samples.

5. How the appraisal runs: the Lead Appraiser and SCAMPI-class methods

The appraisal is led by an authorised Lead Appraiser and organised on SCAMPI-class methods. The process runs roughly like this:

The on-site evidence stage is where many companies' preparation direction turns. The appraisal is not "auditing documents"; it is verifying, through interviews and sampling, whether what the documents describe actually happened. So the people interviewed are not "the one who speaks well" but "the one who really does this work on the project". A project manager who cannot explain where the estimate came from, a QA person who cannot explain what was checked, a configuration manager who cannot produce baseline records — these come up frequently in companies that prepared insufficiently.

On the relationship between consulting and appraisal: consulting and appraisal are two independent roles — consulting helps you build the process, fill in the evidence and rehearse the interviews; the appraising party gathers evidence independently and reaches the conclusion. Industry rules require the two to be independent: the same party cannot be both coach and referee. So with any claim of the form "we do the appraisal ourselves and get you the level", it is worth asking one question first: who issues the appraisal conclusion, and where can their authorisation be verified.

6. Timeline and investment: where the ranges sit, where the money goes

Time is not spent on "writing documents"; it is spent on getting the process to genuinely run and leave records behind. Four stages add up:

• Gap analysis and plan (several weeks) — inventory the existing project types, existing processes and existing records; set the organisational unit scope and the target level
• Process asset build-out (several weeks to two or three months) — fill in processes, templates, tailoring guidelines and measurement definitions, with training running alongside
• Pilot and record accumulation (this stage is the elastic one) — select 2-3 projects and run them to the new process until a continuous run of records exists; companies with mature processes and tools can shorten this, those starting from zero need longer
• Appraisal scheduling and on-site work (per the appraising party's calendar) — readiness check, document review, on-site evidence, results submission

Timeline range: for many companies, the period from starting preparation to receiving a result falls in the range of several months to around half a year, and the span may stretch from roughly three months up to nine months or more. The main factors lengthening it are: the existing process baseline (whether project management and configuration management tools are in use), how many months of records need to be built up, the number of organisational units and projects in scope, and the appraising party's scheduling. Schedules precise to the week are subject to the arrangements of the appraisal body and the Lead Appraiser.

Cost range: total investment usually consists of two parts — appraisal-related fees (charged by the appraisal body under its own rules, and related to organisation size and the number of projects in scope) + consulting fees (process asset build-out, pilot coaching, interview rehearsal, on-site support). Overall it generally falls in a range of tens of thousands of RMB; larger organisations, more projects in scope and bigger gaps push it upwards. Tool purchases (project management, configuration management, measurement platforms) are counted separately. Specific amounts are subject to the quotations of the appraisal body and the service provider.

What is easily underestimated is internal effort. This is not a "hand it to the consultant" project: it usually needs 1-2 key people (project manager + QA / process improvement role) committed for several months, from part-time to full-time, plus cooperation from each project team in producing records and attending interviews. How much internal effort is committed often affects progress more than which body is chosen.

Result and validity: the appraisal result has a validity period, usually 3 years, and re-appraisal is needed at expiry. If the process stalls, records break off, or key people leave during that period, the next appraisal is essentially starting over. The length of validity and the specific re-appraisal requirements are subject to the current rules of ISACA / CMMI Institute and the appraisal body.

7. How it relates to ISO 27001, ISO 20000 and ITSS

These four certificates often appear in the same tender document, but they examine four different things, and they do not substitute for one another.

In practice there are three points worth remembering:

• The usual combination for software companies is ISO 27001 + CMMI. One shows "your information security is under control", the other shows "your R&D process is stable"; in tender scoring schemes the two often appear side by side. Part of the ISO 27001 system skeleton (policy, document control, internal audit, management review, corrective action) can be reused when building CMMI process assets, but project process records cannot be shared — CMMI looks at how a project runs, ISO 27001 looks at how controls are applied.
• On the O&M side the combination is ISO 20000 + ITSS. Both sit on the "service" dimension and do not overlap with CMMI's "R&D" dimension. ITSS levels and materials are covered in full in a separate article; for how to save effort by running ISO 20000 and ISO 27001 together, see integrated implementation of the two systems.
• One system, several outputs. The same set of project records can support the project evidence for CMMI and also the service delivery evidence for ISO 20000, but the statistical criteria and the aggregation method have to be done separately. What you save is duplicated labour, not the duplication of evidence.

As for which certificates and which level a particular tender actually requires, the wording of the tender document itself governs — do not guess from industry habit. To compare the positioning of the different systems first, you can read the management systems overview, ISO 27001, ISO 20000 and CCRC pages side by side, or use Quick Lookup to locate your case quickly by business type.

8. Common pitfalls: seven real rework points

• Turning Level 3 into a "documentation project". The documents read like a textbook, and not one project record matches them. It falls apart at the first interview on site — among the rework cases, this is one of the costlier ones.
• A broken link between organisation level and project level. The project used its department's own template, which has nothing to do with the organisation-level standard processes, and no tailoring statement can be produced. What Level 3 examines is precisely that link.
• Tailoring written as "no tailoring at all" or "tailor as you like". No tailoring at all means the tailoring guidelines are decorative; tailoring at will means the process has no binding force. The right approach is that every tailoring decision has a reason, an approval and a record.
• Dates that run backwards. A process document takes effect later than the project records it governs, or a template version number in the records is a "future version". This kind of hard defect is spotted immediately and is very hard to explain.
• Evidence at the two ends only. Project plan and closure report are both in place, while reviews, changes, tests and baselines in the middle are all empty. Sampling lands in the middle section and the trail ends.
• Interviews carried by the consultant. The consultant knows the answer better than the employee, who cannot say "how we collect this measurement data". The interviewees must be the people who actually do the work.
• Stopping once the certificate is in hand. The result has a validity period; if the process is not followed and records break off during it, re-appraisal at expiry means starting from scratch and the earlier investment is wasted.

Action checklist

Go through this in order before you start, and move on only when you can give a concrete answer to each line:

• ⬜ I can state clearly which type of project the company mainly delivers (own product, bespoke development, system integration, industry solution), and the typical lifecycle of that type
• ⬜ I have 2-3 real projects that ran end to end, and the material from initiation to closure is still available
• ⬜ We have organisation-level process documents, or are willing to build them within a few weeks (including templates, tailoring guidelines and measurement definitions)
• ⬜ We can free up 1-2 key people for steady involvement over several months, rather than outsourcing the whole thing to a consultant
• ⬜ We have usable project management / configuration management / defect tracking tools, and they are already producing real data
• ⬜ I have confirmed that the target level is explicitly required by the customer or the tender document, not "I heard others in the industry are doing it"
• ⬜ I know the sequence of CMMI relative to ISO 27001 and ISO 20000 in our case, and which material can be shared
• ⬜ I understand that the result has a validity period, and we are willing to maintain the process and the records throughout it

If fewer than five of these eight can be ticked, now is not the time to book an appraisal — closing the gaps in process assets and project evidence first is far faster than booking the on-site days and filling evidence in afterwards. Where things are unclear, you can also contact us directly and go through them line by line.

Conclusion: get the projects running first, then talk about the level

The difficulty of CMMI Level 3 has never been in "the clauses of the model", but in turning projects you are already running into a chain of checkable evidence: the organisation-level standard processes say "how it should be done", the project defined process says "how this project does it", the records say "it really was done that way", and the interviews show "the people doing it know why". String the four together and the case for the level holds together; miss one and you have to go back to the project floor to fill it in.

So the order is always: map the project types and existing processes first → then build out the organisation-level process assets → then let 2-3 projects really run to the new process for a while → only then discuss appraisal scheduling. Do it in the reverse order, and however complete the documents are, they will not survive the on-site interview.

▍Not sure whether Level 3 is right for you, or want to know how to sequence CMMI and ISO 27001? Leave a comment or message me with "CMMI self-check" and I will send you a line-by-line comparison checklist.