cmmi for cs it key success factors and …itq.ch/folien/04_creditsuisse.pdfit private banking –it...

CMMI for CS ITKey Success Factorsand Implementation Approach

January 19, 2006

Philippe Landucci, Quality & Process Management

IT Private Banking –IT Switzerland / "CMMI for CS IT" ProgramPh. Landucci

V1.0 - January 19, 2006 / Slide 2

Content

"CMMI for CS IT" –Program Information

Key Success Factors and the related Implementation Approach

Some Lessons Learned


V1.0 - January 19, 2006 / Slide 3

"CMMI for CS IT" –Facts and Figures

Program Scope is delimited by the following boundaries–Region "Switzerland"

–Application Development and Systems Engineering

–New development and extension projects (maintenance activities not in scope)

–Swiss Banking IT Platform

–Achievement of CMMI Maturity Level 3

Roughly, this scope maps to–600 IT projects

–300 Business (internal client side) project leaders

–450 IT project leaders

–1'000 software developers, testers, and quality managers

–and 100 middle management members acting part time as assessors


V1.0 - January 19, 2006 / Slide 4

"CMMI for CS IT" –High-Level Schedule

InitialAssessment

30-SEP-04

Initial, medium-strength (“Class B”)CMMI assessmentagainst ML2 andpartly ML3 todetermine startingpoint

15-MAY-04

Obtaineddecision byandcommitmentfromsponsors

InitializeProgram

Execute change programto achieve Maturity Level 3

30-JUN-09 *)

Formal (“Class A”)assessment againstMaturity Level 3

Detailplan

31-MAR-07 *)

Formal (“Class A”)assessment againstMaturity Level 2

and

medium-strength(“Class B”) initialassessment againstMaturity Level 3

31-DEC-04

Execute change programto achieve Maturity Level 2


V1.0 - January 19, 2006 / Slide 5

"CMMI for CS IT" –Program Organization

ExpertTeam A

OtherExperts

Projects,Initiatives

ProjectOffice

Trai

ning

,C

omm

unic

atio

n.

Quality Management OrganizationQM

Dept. E -> QMDept. A

QADept. A <- QA

Dept. E

Process ProductQuality Assurance

ProcessManager

SUPP

ProcessManager

ENG

ProcessManager

PROJ

ProcessManager

PROC

SEPG

Quality &Process Mgmt

Process-Owner,Team

ProcessOwner,Team

ProcessOwner,Team

ProcessOwner,Team

- Controlling- Quality/Risk- Config. Mgmt- Infra

Process Teams arerecruited out of ExpertTeams, Projects, andInitiatives. They have apermanent mandate.

TEMPORARYProgram Organization

PERMANENTProcess ManagementOrganization

"SPI" ProjectManagement

Cross-departmental PPQA(Line Managers [2d/m])

Dept.A ... Dept.

E

BusinessAdvisoryBoard

for selectedProcess Areas

Governing Bodies

Steering Committee

ManagementCommittee

Central PPQA

Quality Management, QA, PPQASoftware Process Improvement (SPI)

Core Teams

Extended Teams

Senior Management


V1.0 - January 19, 2006 / Slide 6

"CMMI for CS IT" –A few more figures

Model Training- 150 participants received the standard "Introduction to CMMI", 4 are at "Intermediate" level- 240 participants received specific, on Generic Practices focused "CMMI for Management"

training- 150 internal client-side participants received a specific "CMMI for Business" training

Process Deployment–Process Architecture has been defined, Process Portal is in place–Policies have been deployed and intensively trained (23 workshops with all management layers)–Process and Product Quality Assurance is in place, policy adherence is being measured

continuously–Requirements Engineering processes (REQM+RD) for Application Development is in deployment–Requirements Engineering processes for Systems Engineering and extensive tool support are

being developed–Project Management processes (PP, PMC and RSKM) are being piloted–Measurement and Analysis (MA), Configuration Management (CM), Verification (Peer Reviews,

VER SG2), and Supplier Agreement Management (SAM) are in development


V1.0 - January 19, 2006 / Slide 7

KSF 1 –Compelling Need

For the Firm–Compliance with government regulations such as Sarbanes-Oxley

and Basel II is challenging

–Meeting these new regulations requires traceability and auditingcapabilities, among others, built on institutionalized projectmanagement and systems development processes

An adequate implementation of the CMMI requirements contributesto the fulfillment of many regulatory requirements in the areas ofSoftware Development Life Cycle, Change Management, and RiskManagement


V1.0 - January 19, 2006 / Slide 8

KSF 1 –Compelling need

For the Firm IT as a Competitive Asset–The development of complex software systems increasingly turns

into a key success factor for attaining business objectives–More than ever, companies have to put their products on the market

in a better, faster, and more cost-effective manner–The products and their development become increasingly complex.

More and more components are developed in different locationsand have to be combined into the final product

–Organizations have to be capable of planning, controlling, andmonitoring these complex development processes

This requires a high level of maturity within the organization as wellas continuous improvement of processes


V1.0 - January 19, 2006 / Slide 9

KSF 1 –Compelling need

For the IT Professionals–As economic globalization lets working models evolve, the market

value of IT professionals depends increasingly on their requirementsengineering, project management, testing, and process- andmethodology related skills

–In many cases, this evolution goes along with a decline in thedemand and market value of purely technical or implementationrelated skills

Implementing new skills and behaviors, working with higher maturityprocesses and having industry-best-practices ingrained into dailywork and habits is a highly-valuable professional asset


V1.0 - January 19, 2006 / Slide 10

KSF 2 - Senior Management Support and Involvement

"Quality First"–Most companies are in the "software business", explicitly or implicitly. They depend

on software to run their business, and are dependent on software quality–Software quality must be - or be made to be - the top priority of senior managementEnsure regular visibility of senior management sponsorship to the organization"CMMI for CS IT" is one of the six strategic priorities of Credit Suisse IT

Policies as Senior Management Mandate to the Organization–Implementing CMMI within the organization cannot be mandated by a "CMMI

project", but by the highest level of senior managementSenior Management states its expectations of how the projects shall be executed

and how the organization shall support projects through PoliciesThe software process improvement project and the quality organization helps the

organization to fulfill the Policies


V1.0 - January 19, 2006 / Slide 11

KSF 3 - Clear Direction

Policies give a clear direction–Policies are requirements that shall be met by the projects and the

organization

Depending upon the Maturity Level, Policies leave solutions open to theorganization and the projects. This allows the organization and projects tofind solutions that fit their needs: small solutions in small projects, morecomprehensive solutions in bigger, more complex projects

Alignment of other process improvement initiatives–Other process improvement initiatives may be run in parallel to "CMMI" in

your organization

Governance and scope must be clearly defined to leverage mutual effortsand avoid overlaps with potentially conflicting goals


V1.0 - January 19, 2006 / Slide 12

KSF 4 - Measurable Goals

Institutionalize organizational Process Improvement Goals–Process improvement goals must be defined and tracked at all levels of the

organizationEach management layer is and must behave as the process ownerEmbed process improvement goals into the organizational goal setting process and

instruments, such as Balanced Score Card and Management by Objectives

Reduce the number of Goals in favor of Data Quality–Depending on the actual Maturity Level, base data quality and baselining may be

challenging. Reduce measurement effort to the areas where accountability ofmanagement and projects can be reinforced

Projects must be evaluated on a regular basis with internal assessments to see howwell the policies are being followed

Other indicators like cost and/or time variance, and number of errors found duringproject phases –including operation in the production environment –are goodmeasures to start with


V1.0 - January 19, 2006 / Slide 13

KSF 5 - Focused, Stepwise Implementation

Focus on the organization's ability to learn and change–An implementation approach with small process deployments has multiple advantagesThe organization will get used to the new processes. The rate of non-compliance adjustments will

be detected with minimal delayThe project team has the possibility to react to problems during deployment with minimal delayThe potential of continuous improvements in the processes will be reported with minimal delayThe steps are small and projects will be able to implement themA rhythm of change will be established and expected in the organization

Start with a Foundation Layer–Following the project setup phase, the first deployments should include a number of elements

which lay down a foundation for successful implementation of the processes:Organizational PoliciesManagement Training with focus on the Generic PracticesProcess Architecture Internal Assessment organization


V1.0 - January 19, 2006 / Slide 14

KSF 5 - Focused, Stepwise Implementation

"CMMI for CS IT" stepwise implementation principles–The process enhancements will be grouped into releases

–The content of the releases is driven by benefits and logical dependencies among theprocess areas

–The organization will experience a regular deployment cadence whereby every 2 monthsa set of process artifacts (process descriptions, templates, guidelines etc.) will bereleased and institutionalized

–A set of policies will convey the initial directions for the process areas

–Process artifacts will be tested by defined pilot projects, where meaningful

–Appropriate training will be available (from self-study to classroom)

–There will be as little retrofitting of already established deliverables as possible, eachproject will start to use the new processes as they are issued

–All projects will be assessed for policy adherence every couple of months

–Non-compliance lists will be established and resolved by line management before thenext assessment


V1.0 - January 19, 2006 / Slide 15

KSF 5 - Focused, Stepwise Implementation - Internal Stages

Release 4(SAM)

Release 3(CM, VER)

Release 2(PP, PMC, RSKM)

Release 1(Policies, OPD, GPs

REQM/RD)

Process Definition

Process Review

Process Training

Process Deployment

Institutionalization

Additional Training

Coaching

Tuning of Processes

Mini Assessments

Maturity Level 2Assessments

SCAMPI ALevel 2 Assessment

PPQA

MA

Planning Phase

GAP Analysis

Detailed Plan

Setup

Project Management & Communications

Mock CMMILevel 2 Assessment


V1.0 - January 19, 2006 / Slide 16

KSF 6 - Communication with StakeholdersIntensive, multi-targeted, and requiring multiple channels

IT COMMUNITY QUESTIONS Why are we doing this? What is in scope? What are the key concepts? What process changes will we see? What role and job changes will we

see? What will be the impacts? How is the organization involved? When will we get what? What will the transition be like? What kind of support will we get? How can we get prepared? What is being communicated when ? What interfaces are being

coordinated? How does this fit with SOX, etc. ? What will come after CMMI?

CONTINUOUS COMMUNICATIONS "CMMI for CS IT" Website FAQ's, CMMI Mailbox Stakeholder Management Articles in the "internal press" CMMI Workshops at the

CS IT ManagementConferences

Information on Impacts:How will this impact myproject / my job / my linefunction and when?

CMMI Trainings for differenttarget groups

Events & Presentations withtwo-way communications

Flyers, Newsletters,reference material and othercampaign material, etc.

Individual Consulting andCoaching


V1.0 - January 19, 2006 / Slide 17

KSF 7 - Process Architecture

Architecture–A specification that identifies components and their associated functionality,

describes connectivity of components, and the mapping of functionality ontocomponents. (Source: SEI)

Process Architecture–Applied to processes, it can be seen as a formal model with construction templates

for all process elements–All process assets defined and/or revised by the process improvement project must

be derived from one and the same process architecture –obviously for consistency,and also for tailoring purposes (project-defined process' assets must fit)

Practical implementation of the process architecture is typically a Process AssetLibrary (with Policies, Life-Cycle Models, Processes, Activities, Procedures, Roles,Templates for Work Products, Checklists, Guidelines, Training Material, LessonsLearned, PPQA Handbook, etc.)

A Process Portal is required for publication of process assets, if possible in acontext adequately restricted to role and/or project type


V1.0 - January 19, 2006 / Slide 18

KSF 8 - SPI managed as Project with Rights and Duties

Organizational Change ProjectSoftware process improvement (SPI) is organizational change and a must be conductedas a project

DutiesAs a project, it must be managed according to the targeted Maturity Level. This projecthas a very high visibility within the organization and must act as a role-model

RightsFor this effort to be successful, senior management must commit explicit rights to theSPI project:Right to communicate often through company channels and to show the managementcommitment openly (“acting on behalf of senior management”)Direct report line and access to senior management / sponsorRight to initiate organizational changes (process change); final decision rests withsenior managementRight to introduce and enforce the usage of the processes in its scope


V1.0 - January 19, 2006 / Slide 19

KSF 9 - Broad SupportBenefits for Practitioners

Although CMMI is not "rocket science" but "best practice", practitioners may have doubts and fearadministrative overloadBenefits of mature projects (e.g., much less "fire-fighting" and overtime) must be intensively andrepetitively explained to the organizationProjects with highest compliancy to Policies must get rewarded and get visibility within theorganization

Improvement Seeking CultureObviously, software process improvement cannot start and gain momentum without an improvementseeking cultureThere is always an "avant-garde" element, both within management and practitioners. Use thesechampions as change agents, they will be proud and enthusiastic to make their commitment andleadership visible

Staffing of the process improvement projectInvolvement of large and representative parts of the organization is of paramount importance inestablishing the base required to deploy and institutionalize processesThe project team shall be staffed with sought-after specialists in their area of expertiseA mix of full-time Core Team members and part-time Extended Team members eases definition,review, "buy-in", deployment and training of processes


V1.0 - January 19, 2006 / Slide 20

Lessons Learned –1/2

SPI and PPQA Sizing –"Establish and Maintain..."–Successful CMMI implementations involve 4 to 6% of the organization's capacity–2% to 3% of the organization's capacity should be allocated to the Core Team–The above mentioned figures are for large organizations, smaller organizations will

need to invest a higher percentage–In "project mode", i.e. when working towards a higher maturity level, plan with two

full time resources per process area–Central SPI and PPQA teams must be able to deliver support for both "project" and

"maintenance" –once deployed, processes need a considerable amount of coachingand on-going training

SPI and PPQA Separation –"Objectively Evaluate..."–Separating the SPI and PPQA organization enables an objective evaluation of the

usability of process assets, a valuable and unbiased feedback to the SPI team–This separation of concerns also allows a "clean" escalation path through the

different management layers (not represented on slide 5 for simplicity)–We received this advice at the very beginning of our initiative and pass it on further...


V1.0 - January 19, 2006 / Slide 21

Lessons Learned –2/2

Train People–The organization must have been systematically trained in fundamental bodies of

knowledge like Project Management and Software/Systems Engineering, beforeimplementing CMMI-compliant processes

–Otherwise, deployment and institutionalization of processes will be excessively effortintensive and painful, for both the trainers and the organization

–This preparation work and the related time-line must be taken into considerationwhen planning the process improvement efforts

Provide Resources–Although the support of processes and methodologies with tools should not be at

the top of the priority list, it should be neglected neither–Many CMMI requirements, like the bidirectional requirements traceability, or

recommendations, like effort estimation and reporting at work product level, cannotbe implemented practically in real-life without adequate tool support

–This is especially valid for mid-size and large projects, the ones you would typicallyexpect to be within the scope of a CMMI implementation


V1.0 - January 19, 2006 / Slide 22

Questions ?

cmmi for cs it key success factors and …itq.ch/folien/04_creditsuisse.pdfit private banking –it...

Documents