What Does SEI CMM, ISO, IEEE and ANSI Stands For?

Want to know what is SEI? CMM? ISO? IEEE? ANSI? Will it Help? Why do software and other industries need to get the right certification? Read this tutorial.

In this tutorial, we will discuss the definitions of the terms like SEI, CMM, ISO, IEEE, and ANSI with a detailed explanation.

We will understand how these standards and certifications will be helpful in the software industry.

Let us begin!!

SEI, CMM, ISO, IEEE, and ANSI – Certification Details

#1) SEI

SEI stands for Software Engineering Institute

SEI at Carnegie-Mellon University was started by the U.S. Defence Department to help in improving software development processes, with a wide range of research & development. SEI has offices all around the world and is federally funded.

This institute specializes in research and training around various types of complex software engineering, network, and application security & design problems. It serves as a public resource and engages in various kinds of initiatives.

Some of the activities which this institute covers are as follows:

• Software Engineering
• Software Quality Assurance
• Cyber Security
• Component Capabilities
• Acquisition
• DevOps
• Artificial Intelligence

SEI’s Areas of Work:

#1) Engineering Practices: Its work in engineering practices helps in improving software engineers’ abilities to analyze, predict, and control specific functional and non-functional attributes of software systems.

#2) Security: Its primary objective is to make sure that the right technology and systems-management procedures are used to defend against attacks on networked systems, minimize damage, and guarantee the continuity of critical services despite successful attacks, accidents, or failures.

SEI houses a dedicated center called CERT/CC (CERT Coordination Center) to look into security practices. SEI CERT program provides guidelines for implementing security in every phase of the Software Development Life Cycle.

#3) Management Practices: SEI has designed CMM (now known as CMMI) so that organizations can follow established guidelines and improve. Organizations can predict and manage quality, schedule, cost, cycle time, and productivity with the help of successful software engineering management practices.

There are various ways in which one can get involved with SEI and carry forward their work.

#4) SEI Partner Network: Organizations and individuals can join SEI’s partner network to spread the best practices in Software Engineering. Those in the partner network are selected, trained, and licensed by SEI to provide genuine and authentic SEI services such as courses, consulting methods, and management processes.

Currently, this partner network consists of approximately 250 organizations worldwide.

#5) Membership Program: By joining the SEI membership program, software engineers and the entire community can expand their network.

#6) Affiliate Program: Organizations place technical experts with the SEI for periods ranging from 12 months to four years through the SEI Affiliate Program. Affiliates collaborate with the SEI on projects to identify, develop, and demonstrate improved software engineering practices.

#7) Conferences: National and international conferences, workshops, and user-group meetings are sponsored by the SEI. Other events cover topics like software-intensive system acquisition, Commercial Off-The-Shelf (COTS)-based systems, network security and survivability, software process research, software product lines, CMMI, and the SEI Team Software Process.

Here are some of the upcoming events/conferences:

Software Architecture Design and Analysis (April 24-27, 2023). Click here for details on the agenda and topics covered.

RSA Conference 2023 (April 24-27, 2023)

Have a look at the short preview of the full session at the RSA Conference 2023:

>> Visit the official site for more such events and information.

#2) CMM & CMMI

CMM stands for Capability Maturity Model

It was developed by the SEI in 1987. Click here to visit the official website.

CMM can be defined as a standard or framework based on which software development organizations/institutes are classified into different levels of capability.

The analysis and examination of the processes and methods followed by a software company are done based on the following two diverse methods of SEI CMM:

• Capability Evaluation: Analysis and assessment of a given organization’s capability are done based on the vendor’s level of integrity, employees’ rank on skills, contractor’s routine on work, and the techniques followed, etc. The resulting outcome is taken as a factor for evaluating the organization’s overall capability concerning performance and standards against the entire software industry’s standards.
• Software Process Assessment: It is a set of measures based on software development procedures that pertain to the range, with respect to the model, established by the organization as a prototype for projects to follow for all the activities carried out under the organization’s name. This assessment aids in the improvement of the current level of processes and techniques in use.

SEI CMM is a model of 5 different stages and levels of organizational ‘Maturity’ that determines the effectiveness in delivering quality software. The Key Process Area (KPA) is another important factor that is being considered for this classification process. KPAs are the minimum requirement set for any software development organization.

It is geared toward large organizations such as large U.S. Defence Department contractors. However, many of the QA processes involved are appropriate to any organization, and if reasonably applied, they can be extremely helpful.

Organizations can receive CMM-level ratings by undergoing assessments by qualified external auditors.

Initial: Level 1 (CMM1): The software process is characterized by chaos, periodic panics, and inconsistency. Heroic efforts are required by individuals to complete projects successfully. All the processes/standards are set aside during any crisis. Work success may not be repeatable against only a few processes in place.

Repeatable: Level 2 (CMM2): More consistent and basic software development processes in place for project tracking, requirements management, time schedule, and cost tracking.

Also, realistic planning & configuration management processes are in place. A successful set of processes and patterns are established, managed, and documented. As a result, successful practices in key areas of similar applications can be repeated.

Defined: Level 3 (CMM3): Standard software development, management, and maintenance processes are well documented, standardized, and integrated into a standard set of processes for the whole organization. All projects across the organization refer to standard and custom software development processes.

A Software Engineering Process Group (sometimes referred to as a Quality group) is in place to oversee software processes, and training programs are used to ensure understanding and compliance.

Managed: Level 4 (CMM4): The organization implements various measures and metrics for continuously monitoring and controlling its own processes, through the relentless collection of data and analysis of the collected data.

In short, an organization puts in checks for its own assessment both for the product and process points. Project performance is predictable, and quality is consistently high.

Optimized: Level 5 (CMM5): The focus of the organization at this level remains on continuous process improvement by making use of continuous feedback, and incremental and innovative/new process improvements. The impact of new processes and technologies can be predicted and effectively implemented whenever required.

Also, read => How To Achieve Level 5 Maturity For QA And Testing Process

CMMI stands for Capability Maturity Model Integration

It was developed by SEI in 2006 to overcome the shortcomings of CMM and is a more evolved model. The idea was to combine the following three Source Models into a single framework that can be used by organizations chasing process improvement.

• Capability Maturity Model for Software
• Electronic Industries Alliance Interim Standard
• Integrated Product Development Capability Maturity Model

This model not only pays attention to the tasks but also focuses on their performance and success rate. It assesses how an organization performs even after the tasks are completed and makes recommendations for improvements. All the branches of CMM are integrated into this model, thereby providing a much better and integrated approach.

Benefits of implementing CMMI:

• Enhanced Customer Satisfaction
• Increased Market Share & ROI
• Added value for Stakeholders
• Deliver Quality Products or Services
• Industry-wide Recognition for Service Excellence
• Increased Productivity and Reduced Quality Costs

Differences between CMM and CMMI

#3) ISO

ISO stands for International Organization for Standards

>> Click here to browse through the official website.

Popular standards (family of standards) developed by ISO consist of ISO 9000, ISO/IEC 27000, ISO 14000

ISO 9000: ISO developed and published a series of standards commonly known as ISO 9000.

ISO 9000 is a series of individual standards which is widely known and perhaps had the most significant impact. ISO 9000 basically defines, establishes and very well maintains an effective quality assurance system for both manufacturing and service industries.

It gives proper direction to different organizations and industries as a guide to achieving the quality of products, management, and services.

The ISO 9001, 9002, and 9003 standards concern quality systems that are assessed by outside auditors, and they apply to many kinds of production and manufacturing organizations, not just software.

The most comprehensive among the series is ISO 9001 which is also the most widely used certification by software development organizations. It covers documentation, design, development, production, testing, installation, servicing, and other processes.

The organization with this certification shows that it is compliant with the ISO 9001 standards of its industry.

To get this certification, an outside examiner/auditor must check the practices/standards, and processes followed by the organization. The auditor creates a detailed report about the non-compliance (if any).

The organization then carefully analyses the report and agrees to rectify the issues within a specified time by the examiner (certificate issuing body). Once all the mentioned problems are resolved, the organization can be certified with ISO 9001. Certification is typically valid for about 3 years, after which a complete reassessment is required

All the core standards in the series are as follows:

• ISO 9000 (2015): Provides definitions of the quality management system (QMS) -fundamentals and vocabulary.
• ISO 9001 (2015): Outlines QMS – Requirements – Provides guidance on the requirements, an organization must comply with.
• ISO 9004 (2018): Provides guidelines to achieve sustained success (continuous improvement) in quality management.
• ISO 19011 (2018): Provides guidance and understanding on auditing management systems.

ISO 9000-3 (not the same as 9003) is a guideline for applying ISO 9001 to software development organizations. The U.S. version of the ISO 9000 series standards is exactly the same as the international version and is called the ANSI/ASQ Q9000 series.

The U.S. version can be purchased directly from the ASQ (American Society for Quality) or the ANSI organizations

Note that ISO 9000 certification does not necessarily show quality products, but it indicates only that documented processes are followed.

ISO/IEC 27000: This series (which is also known as the ISMS family of standards) comprises information security standards. This is joint publication work of ISO and IEC (International Electrotechnical Commission).

In the context of an overall information security management system (ISMS), the series offers best practice recommendations for information security management or the management of information risks through information security controls.

Among the series ISO 27001 is the most widely adopted one. The latest revision of this standard is ISO 27001:2022.

ISO 27001 certification is important for safeguarding an organization’s vital assets like brand image, employee, client, and other private data. This includes a process-based approach to establishing, implementing, operating, and maintaining the ISMS.

This standard framework serves as a guideline for constantly reviewing the security of information, which will increase the reliability and value of the organization’s services.

The document says that ISO 27001 was developed to “provide a model for establishing, implementing, operating, monitoring, reviewing, maintaining and improving an information security management system.”

The standard necessitates collaboration from all levels of an organization. Organizations must apply the controls specified in ISO 27001 in accordance with their specific risks. It recommends a third-party accredited certification.

ISO/IEC 27001:2022 implementation phases are as mentioned below:

• Defining Information Security Policy
• Defining the scope of the ISMS
• Perform Risk Assessment and Treatment
• Managing Identified Risk
• Select the Controls for Implementing
• Implementing the Controls

Other notable standards for ISO 27000 families are listed below:

ISO 14000: This series of standards was introduced in 1996. It is related to environmental management and helps organizations around the world to reduce their adverse impact (if any) on the environment. Organizations may obtain relevant certifications to prove their compliance with environmentally friendly practices.

ISO 14001 is the most popular standard amongst the family of ISO 14000. It defines the core set of standards that organizations must follow for designing and implementing an effective Environmental Management System (EMS).

The standard’s requirements can be incorporated into any environmental management system (any organization irrespective of its size, type, and nature), to varying degrees depending on several factors such as the organization’s industry, environmental policy, product and service offerings, and location. The latest revision of this standard was done in 2021.

ISO 14001 framework revolves around the following factors:

• Context (size) of the organization
• Leadership
• Planning
• Support
• Operations
• Performance Evaluation
• Improvement

[image source]

Other notable standards for ISO 14000 family are listed below:

Apart from the above-mentioned standards, there are a few standards (as listed below) related to Quality Assurance and testing, which are widely used across the globe.

ISO/IEC 9126: 

This standard addresses the following factors in determining the quality of a software application:

• Quality Model
• Internal Metrics
• External Metrics
• Quality in use Metrics

This standard specifies a set of quality characteristics for any software, as listed below:

• Usability
• Efficiency
• Reliability
• Functionality
• Portability
• Maintainability

ISO/IEC 9241-11: Part 11 of this standard addresses the extent to which a product can be used by specified users to achieve specified goals in a specified context of use with effectiveness, efficiency, and satisfaction.

The suggested framework describes the usability components and their relationships. It considers usability in terms of user satisfaction and performance. According to this standard (ISO 9241-11), usability is context-dependent and the level of usability changes as the context changes.

ISO/IEC 25000:2005: This standard defines the procedures and guidelines to achieve the highest software quality requirements and evaluation (commonly referred to as SQuaRE). ISO-25000 replaces the two older ISO standards, namely ISO-9126 and ISO-14598.

SQuaRE comprises of

• Terms and Conditions
• Reference Models
• General Guide
• Individual Division Guides
• Standards of Requirement Engineering (specification, planning, measurement, and evaluation process)

SQuaRE has sub-divisions as listed below:

• ISO 2500n: Quality Management Division
• ISO 2501n: Quality Model Division
• ISO 2502n: Quality Measurement Division
• ISO 2503n: Quality Requirements Division
• ISO 2504n: Quality Evaluation Division

ISO/IEC 12119: This ISO standard applies to and is responsible for the software packages delivered to the client but does not bother about the production process maintained by the client.

It gives guidance on the following aspects:

• Requirements for the software package(s).
• Set of predefined steps to be used to test the delivered package, against the specified requirements.

#4) IEEE

IEEE stands for Institute of Electrical and Electronics Engineers

>> Click here to visit the official website.

IEEE is a vast group of standards and practices for all engineering disciplines. Read this PDF for detailed and targeted IEEE standards for software systems and software lifecycle processes.

IEEE’s definition of Software Engineering is as follows:

The application of a systematic, disciplined, and quantifiable approach to the development, operation, and maintenance of the software, and the study of these approaches.

IEEE’s definition of Software Quality is as follows:

A well-planned and systematic pattern of all the actions necessary to provide adequate confidence that an item or product confirms stated & implied needs and established technical requirements, under specified conditions.

IEEE’s definition of Software Requirements is as follows:

A condition or capability that a system or system component must meet or possess in order to satisfy a contract, standard, specification, or other formally enforced documents. For a user, it is the condition or capability needed to solve a problem or achieve the set objective.

The following are the most notable IEEE standards: (IEEE/ANSI standards):

Also read => IEEE 802.11 And 802.11i Wireless LAN And 802.1x Authentication Standards

#5) ANSI

ANSI stands for American National Standards Institute

>> Click here to browse through the official website.

ANSI is the primary industrial standards body in the U.S. that supports the development of technology standards and publishes those in conjunction with the IEEE and ASQ (American Society for Quality).

It creates and regulates standards for a wide variety of industries that include computer programming languages as well (e.g. ANSI C).

There are currently ANSI standards for a wide range of seemingly unrelated items, including refrigerators, industrial carpets, and computer parts, among others.

The agency is perhaps best known for its efforts to coordinate voluntary standards for computers (floppy discs, magnetic tapes, and other computer parts), video, and programming languages among public and private industries.

As an end-user (someone who uses a computer for work rather than programming it), you may still hear the term ANSI when referring to the ANSI character set.

Relationship Between ANSI, IEEE, and ISO

ANSI is a private non-profit organization in charge of overseeing the development of voluntary consensus standards for products, services, processes, systems, and procedures. ANSI is a founding member of ISO and the only US member of ISO.

ANSI also coordinates US standards with international standards so that American products can be used worldwide. IEEE develops standards for the computer and electronics industry, which are published by ANSI.

Conclusion

We hope that this tutorial on various Standards and corresponding certifications will help you stay informed about best-known practices.

Please share your thoughts in the comment section below.