US Requirement For Software Dev Certification Raises Questions
dcblogs writes "U.S. government contracts often require bidders to have achieved some level of Capability Maturity Model Integration (CMMI). CMMI arose some 25 years ago via the backing of the Department of Defense and the Software Engineering Institute at Carnegie Mellon University. It operated as a federally funded research and development center until a year ago, when CMMI's product responsibility was shifted to a private, profit-making LLC, the CMMI Institute. The Institute is now owned by Carnegie Mellon. Given that the CMMI Institute is now a self-supporting firm, any requirement that companies be certified by it — and spend the money needed to do so — raises a natural question. 'Why is the government mandating that you support a for-profit company?' said Henry Friedman, the CEO of IR Technologies, a company that develops logistics defense related software and uses CMMI. The value of a certification is subject to debate. To what extent does a CMMI certification determine a successful project outcome? CGI Federal, the lead contractor at Healthcare.gov, is a veritable black belt in software development. In 2012, it achieved the highest possible Capability Maturity Model Integration (CMMI) level for development certification, only the 10th company in the U.S. to do so."
'Why is the government mandating that you support a for-profit company?"
Works for Obamacare.
"There is more worth loving than we have strength to love." - Brian Jay Stanley
In 2005, my employer at the time decided to go for CMMI level 3 because it was required by a govt customer for their project. Certification achieved. Then in 2007 my employer opted to shoot for the moon and go for CMMI level 5. Again, certification achieved.
Two years later I left the company, because it was clear that CMMI level 5 was going to kill the company. CMMI level 5 introduced a high level of bloat, inefficiency, process overhead, documentation requirements, and (worst of all) process rigidity and attempts yo manage the development process by statistical analysis. Our delivery times more than doubled. The cost of delivering projects more than tripled. And the Holy Grail of reduced defect density? Nary a sign of such improvement. As far as I could tell, there was -zero- impact on code quality.
Our customers started abandoning us, our reputation circled the bowl, and everyone who had any business sense left the place in droves. What was a $100M/yr contract software development house is now down to 1/4 of the staff and revenue it had in 2009, and I fully expect their parent company will close their doors this year.
I firmly believe that CMMI Level 5 killed that company.
If you're not using code reviews, chances are your code sucks. I don't see any need to pay somebody big bucks to tell you that. Similarly, coding standard violations increase the chance for bugs, and it's worth making code conform.
In my experience, with very good people, we find a lot of bugs in code review. If you're not finding bugs, either you're superhuman or you do need instruction in code review.
"When you have eliminated the unacceptable, whatever is left, however improbable, must be the truthiness" - Holmes