CMMI Level 3

ISAO assesses the organisation's software development processes against the practices the model describes for maturity level 3, using its own documented assessment criteria, and the certificate names the activities and site covered. It is a certificate of compliance with those practices, not a CMMI appraisal or rating: it does not appear on PARS, ISAO is not a CMMI Institute partner and is not affiliated with CMMI Institute or ISACA, and the certificate must not be presented as a CMMI rating, in a tender or anywhere else. Where a buyer asks for a CMMI maturity level, only an appraisal published on PARS meets that request. ISAO carries out this certification itself and records every certificate it issues on the public register. It does not accredit certification bodies for it.

• Organisation-wide standard processes, tailored for each project and kept up to date
• Requirements developed with the customer, managed and traced through the work
• Planning, estimating, monitoring and controlling projects, with risks managed
• Design, build and integration of the solution, with peer reviews, verification and validation
• Configuration management and quality assurance of processes and work products
• Decisions on important choices made against set criteria
• Training, measurement and improvement of the processes across the organisation

The model is published by CMMI Institute, which revises it from time to time. ISAO assesses against the maturity level 3 practices of the model as published at the time of the audit, and records that on the audit report.

• Enter the certificate number or verification code at Verify a certificate, or scan the QR code on the certificate. The record shows the certificate's status today, for example valid, suspended, withdrawn or expired.
• Compare the organisation name, scope and site on the record with the copy you were given. Check the activities and site named in the scope. A CMMI maturity level can be checked only on CMMI Institute's PARS register; this certificate is not listed there.
• Check that the record names ISAO as the issuer: ISAO issues its certificates for CMMI Level 3 itself. Read the disclaimer on the record, which is also printed on the certificate: it says what the certificate is not, and that no authority issued or approved it.
• If the certificate is not on the register, ISAO cannot confirm it: another organisation may have issued it, or a detail may be wrong. Ask whoever gave it to you, and report a concern if something does not look right.