A Technical History of the SEI

neering CMM [SEI 1995] to describe the essential elements of an organization’s systems engineering
process, and the CERT Resilience Management Model for managing operational resilience
[Caralli 2010].
The People CMM
The People CMM employs the same Process Maturity Framework of the SW-CMM to support the
foundation of best practices for managing and developing an organization’s workforce. Based on
the best practices in fields such as human resources, knowledge management, and organizational
development, the People CMM guides organizations in improving their processes for managing
and developing their workforce. The People CMM helps organizations characterize the maturity
of their workforce practices, establish a program of continuous workforce development, set priorities
for improvement actions, integrate workforce development with process improvement, and
establish a culture of excellence.
The Systems Engineering CMM (SE-CMM)
The SE-CMM describes the essential elements that must exist to ensure good systems engineering
and provides a reference for comparing actual systems engineering practices against them. Good
systems engineering is the key to success in market-driven and contractually negotiated market
areas, and the SE-CMM provides a way to measure and enhance performance in that arena. It was
designed to help organizations improve through self-assessment and guidance in the application
of statistical process control principles. In conjunction with the model itself, a companion appraisal
method exists, the SE-CMM Appraisal Method, for benchmarking the process capability
of an organization’s or enterprise’s systems engineering function.
The CERT Resilience Management Model
In the late 1990s, the DoD faced a set of problems shared with organizations in every sector—
U.S. federal government agencies, defense and commercial industry, and academia—arising from
increasingly complex business and operational environments. These problems involved stress related
to operational resilience, that is, the ability of an organization to achieve its mission even under
degraded circumstances. The traditional disciplines of security, operational continuity, and information
technology operations needed to be expanded to provide protection and continuity
strategies for high-value services and supporting assets commensurate with these new operating
complexities. The SEI recognized that the best practices of such organizational challenges could
best be managed with a capability maturity model. Over the ensuing 10 years, the SEI engaged
the relevant communities in evolving such a model, reflecting the best practices of such diverse
organizations as the DoD, defense industry, commercial industries, and financial services, to
evolve a maturity model that embodied best practices. This work culminated in the CERT Resilience
Management Model that was released in 2010. It has been applied successfully to a wide
range of problems, including assessing the capability of U.S. IT-based critical infrastructures to be
resilient in the presence of an attack and building an incident management capability in developing
nations.
CMU/SEI-2016-SR-027 | SOFTWARE ENGINEERING INSTITUTE | CARNEGIE MELLON UNIVERSITY 103
Distribution Statement A: Approved for Public Release; Distribution is Unlimited.