CMMI v3.0 — Capability Maturity Model Integration

Why does it matter?

CMMI measures how reliably an organization performs its work, not whether it meets a legal rule. The publisher describes it as a way to understand current capability and performance against business objectives and to guide improvement toward them.

Key benefits include:

• A benchmark with a defined lifespan

A Benchmark appraisal needs a CMMI Certified Lead Appraiser leading a team of four or more, and its ratings are valid for three years (CMMI Institute, Types of CMMI Appraisals).

• A staged improvement path

Capability levels 0 to 3 apply to one practice area, and maturity levels 0 to 5 apply to a predefined set of practice areas, so teams can focus on a manageable number at a time.

• One model, eight domains

Organizations build a view of the model from Development, Services, Supplier Management, Security, Safety, Data Management, People Management and Virtual Work to match their business.

• Check-ups between benchmarks

A Sustainment appraisal has reduced scope and two-year rating validity, and no more than three can run in a row before another Benchmark is required.

• Preparation without ratings

An Evaluation appraisal produces no ratings and helps an organization gauge progress toward a target level profile before a Benchmark.

How does it work?

CMMI describes what an organization should do, not a prescriptive control list. The model has 31 practice areas, as the Institute's July 2026 CMMI AIM announcement states. Practices sit in practice areas, and the practices of each practice area are organized into groups labeled Level 0 to Level 3, each building on the one before (CMMI Institute, CMMI Levels of Capability and Performance).

Capability levels are Level 0 Incomplete, Level 1 Initial, Level 2 Managed, with a simple but complete set of practices for the full intent of the practice area, and Level 3 Defined, which uses organizational standards and tailoring. Maturity levels run from 0 Incomplete and 1 Initial through 2 Managed and 3 Defined to 4 Quantitatively Managed and 5 Optimizing.

The CMMI Appraisal Method Definition Document describes four appraisal types: Benchmark, Sustainment, Evaluation and Action Plan Reappraisal. An Action Plan Reappraisal must finish within four months of the prior appraisal's end. The model itself is read in the CMMI Model Viewer, sold by one-year subscription.

Key Elements

• Domains

ISACA's April 2023 announcement lists five domains new in V3.0, Security, Safety, Data Management, People Management and Virtual Work, alongside Development, Services and Supplier Management. ISACA's March 2024 Q&A said users of only the original three would notice few changes.

• Capability levels 0 to 3

Capability levels rate performance in a single practice area: Incomplete, Initial, Managed and Defined. Level 2 means a complete set of practices that identifies and monitors progress toward project objectives; Level 3 adds organizational standards and tailoring.

• Maturity levels 0 to 5

Maturity levels rate an organization across predefined sets of practice areas: Incomplete, Initial, Managed, Defined, Quantitatively Managed and Optimizing. Level 4 is data-driven with quantitative objectives, and Level 5 is focused on continuous improvement.

• Appraisal types

Benchmark appraisals produce ratings valid for three years and need four or more team members including the appraisal team leader. Sustainment appraisals need two or more, last two years and must be accepted by ISACA before the earlier validity date. Evaluation appraisals give no ratings.

• Lead appraisers and partners

A CMMI Certified Lead Appraiser manages the appraisal team for a Benchmark appraisal. ISACA lists lead appraisers and partners in its partner directory, and individuals can earn CMMI certifications through ISACA training.

• Model access

The CMMI Model Viewer is sold as a one-year subscription. Model Viewer Plus adds CMMI AI Maturity content and AI crosswalks, and enterprise subscriptions are sold for 10, 25 and 50 licenses (CMMI Institute).

What does it cover?

CMMI V3.0 applies to organizations in any industry that want to measure and improve capability: product developers, service providers, suppliers and, through the Security, Safety, Data Management, People Management and Virtual Work domains, functions beyond engineering. The appraisal method focuses on how processes are implemented rather than on assessing individual people.

What are its objectives?

CMMI V3.0 aims to tie process improvement to business objectives and to measure the result.

Understand current capability and performance against business objectives.

Focus improvement on a manageable set of practice areas chosen from those objectives.

Reach a target capability or maturity level through a Benchmark appraisal when a rating is needed.

Keep a rating current through Sustainment appraisals before its validity date expires.

Use Evaluation appraisals to prepare and track progress without ratings.

Choose the domains that fit the organization's work.

Framework in Context

CMMI is a performance improvement model, not a regulation and not a certification of an organization to a standard such as ISO 9001. Organizations are appraised and rated, and ISACA certifies individuals such as lead appraisers. The CMMI Institute, part of ISACA, says the model is designed to integrate with agile and other methodologies, and in July 2026 it launched CMMI AI Maturity (CMMI AIM), an expansion of the model that adds AI-related content to all 31 practice areas.

Common Framework Mappings

Organizations run CMMI alongside process, quality and service frameworks such as ISO 9001, ISO/IEC 330xx for process assessment, COBIT 2019 and ITIL 4, and the list below is the set this library tracks. CMMI rates capability, so it complements those standards rather than replacing their requirements.

Mapped frameworks include:

COBIT 2019

ISO 13485:2016

ISO 9001

ISO/IEC 330xx (Process Assessment)

ITIL 4

People Capability Maturity Model (People CMM)

Six Sigma

TMMi (Test Maturity Model integration)