SlideShare a Scribd company logo
1 © 2017 Natural SPI
Using CMMI Process
Management Practices to
Build and Maintain a QMS
2 © 2017 Natural SPI
Question?
What does ISO 9001, AS9100, or
TL9000 have to say about QMS
development and maintenance?
3 © 2017 Natural SPI
Almost nothing.
Answer …
From AS9100D (inclusive of ISO 9001:2015) Section 0.3 Process
Approach (not a requirement), we get a 40-year-old process
model and PDCA.
4 © 2017 Natural SPI
However ...
Answer …
The CMMI provides two process areas (OPF and
OPD) and 14 practices for the establishment of a
persistent organization-level process definition,
deployment, and management focus.
So here’s what I’ve learned and used
from these good practices …
5 © 2017 Natural SPI
7 Rules for Designing and Developing Process
Processes that work are designed and built by applying
these rules:
1. All performance improvement comes from the performed process, not
the defined process.
2. Know what problem you’re solving before you begin developing or
improving your processes.
3. The process is the product.
4. Design and build processes for the process users.
5. Compliance – with standards or models – is not necessarily the same
as quality or improvement.
6. Plan and manage process development as a project.
7. Process information and data exists in only one place.
6 © 2017 Natural SPI
Know What Problem You’re Trying to Solve 1
If I had an hour to save the world, I
would spend 59 minutes defining the
problem … and one minute finding
solutions.
- Albert Einstein
7 © 2017 Natural SPI
Know What Problem You’re Trying to Solve 2
People
Organization as a System of Systems
Process
Technology
A modern organization
is an integrated system
of systems: people
(social) system,
technology systems, and
process systems.
If we have a problem to
solve or a performance
goal to achieve, we
need to first determine
which of these systems
most needs improving.
8 © 2017 Natural SPI
Know What Problem You’re Trying to Solve 3
Example of a
flawed RCA:
9 © 2017 Natural SPI
Know What Problem You’re Trying to Solve 3
How we know it’s
flawed:
X
X
X
10 © 2017 Natural SPI
Know What Problem You’re Trying to Solve 4
A logical RCA:
11 © 2017 Natural SPI
Know What Problem You’re Trying to Solve 5
In a system of systems, changes or improvements cannot be made to one
system without collateral changes to the other systems.
Relationship between improving people to improving Process and Technology
12 © 2017 Natural SPI
Know What Problem You’re Trying to Solve 6
Relationship between improving people to improving Process and Technology
Relationship between improving Technology to improving People and Process
13 © 2017 Natural SPI
Know What Problem You’re Trying to Solve 7
Relationship between improving Process to improving People and Technology
14 © 2017 Natural SPI
Know What Problem You’re Trying to Solve 8
Estimating the Return On Process (ROP)
ROP = Value of Performance Gain – Cost of Improvement
Value of Performance Gain = Value of future performance (post improvement) –
Value of current (baseline) performance
Cost of Improvement = Cost of improvement effort + cost of technology
investment + cost of training, implementation and
institutionalization of change.
15 © 2017 Natural SPI
Paradigm Shift: The Process is a Product
What am I? I …
1. Am complex and have many integrated subsystems and parts.
2. Have hundreds of high-level requirements or user stories.
3. Need to provably comply with international industry standards.
4. Have dozens of interfaces.
5. Need to be designed before being built.
6. Need to be built according to the design.
7. Can and should be verified against requirements or user stories.
8. Can and should be tested at the modular/unit level and system level.
9. Can and should be planned and managed using proven project
management practices.
16 © 2017 Natural SPI
Process System Requirements and Users 1
Just like a product or a technology system, a modern
process system can have hundreds of high-level
requirements including:
1. User requirements (user stories or use cases)
2. Functional requirements
3. Interface requirements
4. Compliance requirements
5. “Ilities” requirements
17 © 2017 Natural SPI
Process System Requirements and Users 2
Designing and building a process system for its users
means defining requirements or user stories that:
1. Define user preferences for ingesting information and acting
appropriately
2. Incorporate users’ learning modalities: reading, watching,
doing
3. Incorporate the range of user and potential user knowledge,
skill, and experience in performing the process
4. Defines not only what users want in the process, but also
not defining what they don’t want
18 © 2017 Natural SPI
Process System Requirements and Users 3
Develop and maintain requirements and user stories that can be
used to design and build processes that satisfy the “ilities.” To what
extent can we make the process:
 Adoptable
 Adaptable
 Maintainable
 Extensible
 Scalable
 Testable
 Measurable
 Auditable
See Ilities definitions
19 © 2017 Natural SPI
Process Improvement Project Management 1
Process Development Project Management involves:
1. Adopting the paradigm that developing enterprise processes should be
treated as a “project” that is delivering a complex process “system”
2. Establishing and maintaining the process system requirements
3. Manage the process development project using project plans:
a. Project Management Plan
b. Development Environment Plan
c. WBS-Schedule
d. Risk Management Plan
e. Data Management Plan
f. Measurement Plan
g. Stakeholder Involvement Plan
h. Quality Assurance Plan
i. Training and Knowledge Transfer Plan
j. Structured Decision Plan
20 © 2017 Natural SPI
Process Improvement Project Management 2
Process Improvement Project Management involves:
4. Regular project team meetings for status against plans, risk
management, and lessons-learned
5. Peer reviews to verify process designs and builds against
requirements
6. Periodic and event-driven project reviews with sponsors and
leadership
7. Phase-gate reviews with criteria for move-forward decisions
8. Collecting, analyzing, and reporting rocess performance
measures/metrics
21 © 2017 Natural SPI
Domain Knowledge/Experience
Knowledge of and experience in the environment in which the
processes are deployed.
Information Mapping or Process Modeling
Training and experience in modeling processes and in information
structuring and classification.
Models and Standards Knowledge
In-depth understanding of models and standards used to guide
processes (e.g., the CMMI).
The Process Development Project Team 1
Process Development Knowledge, Skills, Experience
22 © 2017 Natural SPI
Process Improvement Project Management
Knowledge and experience in applying project management
techniques to process improvement work. Skill in estimating and
planning process definition work, and skill in tracking, monitoring,
and measuring against the plans.
Communication and Presentation
New and revised processes need to be communicated and trained
to users. This requires strong interpersonal and communication
skills. Public speaking or presentation skills are also important.
Process Definition Tool Expertise
Extensive training and knowledge in the effective use of the tools
used to develop the process assets (e.g., MS Office products). Also
tools and systems used to manage and control process assets.
The Process Development Project Team 2
Process Development Knowledge, Skills, Experience (continued)
23 © 2017 Natural SPI
Process Project Roles
Process Project Manager (Sprint or Scrum Lead if Agile)
Manages process improvement project (one release of a process system) including
process design and definition work.
Process Requirements Analyst (User or Product Owner if Agile)
Role responsible for eliciting, gathering, and analyzing the project’s or organization’
performance goals, requirements and user stories for processes and process
improvement.
Process Designer
Role responsible for designing process assets based on requirements. Validates
process design using use cases, operational scenarios, or prototypes. Facilitates
make v. buy and reuse decisions.
Process Developer
Role responsible for developing and defining process assets and/or revising
existing assets.
The Process Development Project Team 3
24 © 2017 Natural SPI
Process Configuration and Data Management
Person/group responsible for establishing and maintaining integrity of PI project
data items and tools, and for CM and DM of process assets being developed and
released.
Process Tester
Person/group responsible for verifying and/or validating developed process assets.
Role plans and implements process verification and validation activities such as
peer reviews, walk-throughs, pilots, and simulations. Role documents, reports, and
tracks to closure process asset defects.
Process Project Quality Assurance
Role responsible for assuring PI project and process definition activities are
performed in compliance with plans. Also objectively evaluates PI project work
products to assure compliance with applicable organizational standards and
procedures.
Process Project Roles (continued)
The Process Development Project Team 4
25 © 2017 Natural SPI
Process Project Sponsors (Product Owner in Agile)
Individual or group responsible for authorizing PI project and allocating required
resources to process design and definition work.
Process User/SME
Process users are individuals and organizations who implement the process
assets in their software, system, or acquisition organizations.
Process Customer
Process customers are people or organizations who provide requirements to the
PI project and who sometimes fund PI work. They may also be beneficiaries of
the results of process performance and improvement.
Process Project Roles (continued)
The Process Development Project Team 4
26 © 2017 Natural SPI
Development Team
• Defines process requirements
• Develops process architecture
• Defines process asset standards
• Designs/defines PAL
PI Project Team
• Plans PI project
• Monitors and controls PI project
• Defines process release strategy
• Collects, analyzes, and reports PI
project performance measure
• Defines and coordinates integrated
team
Review/Test Team
• Peer reviews process assets
• Pilots/test process assets
• Reports process defects and tracks to
closure
Change Control Board
• Reviews/approves changes to assets
• Establishes process asset change
control
• Defines process asset release
baselines
Release/Implementation Team
• Plans/coordinates process releases
• Trains processes and assets to users
• Measures and reports implementation
results
Integrated
team
approach
to process
definition
and
delivery
Process
Customers
Processes &
Process Assets
The Process Development Project Team 5
27 © 2017 Natural SPI
www.susannemadsen.com 27
ISO 9001 Training Courses
 ISO 9001 Introduction
1 Day Course
 ISO 9001 Foundation
2 Days Course
 ISO 9001 Lead Implementer
5 Days Course
 ISO 9001 Lead Auditor
5 Days Course
 ISO 9001:2015 Transition
2 Days Course
Exam and certification fees are included in the training price.
https://pecb.com/en/education-and-certification-for-individuals/iso-9001/
https://pecb.com/en/partnerEvent/event_schedule_list
28 © 2017 Natural SPI
#PMSummit 28
? THANK YOU
Michael@naturalspi.com
http://www.naturalspi.com/
linkedin.com/in/michael-west-3b0812
435-901-4295

More Related Content

What's hot

Ch26 - software engineering 9
Ch26 - software engineering 9Ch26 - software engineering 9
Ch26 - software engineering 9
Ian Sommerville
 
Hilary Martin CV 07 16
Hilary Martin CV 07 16Hilary Martin CV 07 16
Hilary Martin CV 07 16
Hilary Martin
 
Carol Rodger CV 2016
Carol Rodger CV 2016Carol Rodger CV 2016
Carol Rodger CV 2016
Carol Rodger
 
Mei Fung Curriculum Vitae_2016
Mei Fung Curriculum Vitae_2016Mei Fung Curriculum Vitae_2016
Mei Fung Curriculum Vitae_2016
Mei Fung Chong
 

What's hot (20)

Ch26 - software engineering 9
Ch26 - software engineering 9Ch26 - software engineering 9
Ch26 - software engineering 9
 
A survey on software quality practice - Pilot study in the Walloon region
A survey on software quality practice - Pilot study in the Walloon regionA survey on software quality practice - Pilot study in the Walloon region
A survey on software quality practice - Pilot study in the Walloon region
 
Requirements Engineering: A Good Practice Guide
Requirements Engineering: A Good Practice GuideRequirements Engineering: A Good Practice Guide
Requirements Engineering: A Good Practice Guide
 
Quality management 27
Quality management 27Quality management 27
Quality management 27
 
Engineering quality assurance manual
Engineering quality assurance manualEngineering quality assurance manual
Engineering quality assurance manual
 
Ray Business Technologies Process Methodology
Ray Business Technologies Process MethodologyRay Business Technologies Process Methodology
Ray Business Technologies Process Methodology
 
Testing Centre Of Excellence From AppLabs
Testing Centre Of Excellence From AppLabsTesting Centre Of Excellence From AppLabs
Testing Centre Of Excellence From AppLabs
 
Test Process Improvement with TPI NEXT - what the model does not tell you but...
Test Process Improvement with TPI NEXT - what the model does not tell you but...Test Process Improvement with TPI NEXT - what the model does not tell you but...
Test Process Improvement with TPI NEXT - what the model does not tell you but...
 
Six sigma final
Six sigma finalSix sigma final
Six sigma final
 
Hilary Martin CV 07 16
Hilary Martin CV 07 16Hilary Martin CV 07 16
Hilary Martin CV 07 16
 
Carol Rodger CV 2016
Carol Rodger CV 2016Carol Rodger CV 2016
Carol Rodger CV 2016
 
Mei Fung Curriculum Vitae_2016
Mei Fung Curriculum Vitae_2016Mei Fung Curriculum Vitae_2016
Mei Fung Curriculum Vitae_2016
 
User Acceptance Testing in the Testing Center of Excellence
User Acceptance Testing in the Testing Center of ExcellenceUser Acceptance Testing in the Testing Center of Excellence
User Acceptance Testing in the Testing Center of Excellence
 
Gazelles_Mfg_casestudies
Gazelles_Mfg_casestudiesGazelles_Mfg_casestudies
Gazelles_Mfg_casestudies
 
Rohit_Awasthi_Final 1
Rohit_Awasthi_Final 1Rohit_Awasthi_Final 1
Rohit_Awasthi_Final 1
 
Trends in the quality assurance area
Trends in the quality assurance areaTrends in the quality assurance area
Trends in the quality assurance area
 
Process FMEA 2-Day Workshop by Tetrahedron
Process FMEA 2-Day Workshop by TetrahedronProcess FMEA 2-Day Workshop by Tetrahedron
Process FMEA 2-Day Workshop by Tetrahedron
 
Testing Centralization
Testing CentralizationTesting Centralization
Testing Centralization
 
Engineering DevOps Right the First Time
Engineering DevOps Right the First TimeEngineering DevOps Right the First Time
Engineering DevOps Right the First Time
 
The Quest for Quality at Speed
The Quest for Quality at SpeedThe Quest for Quality at Speed
The Quest for Quality at Speed
 

Similar to Using CMMI Process Management Practices to Build and Maintain a QMS

Diana M. Arias Resume - 2017
Diana M. Arias Resume - 2017Diana M. Arias Resume - 2017
Diana M. Arias Resume - 2017
Diana M. Arias
 
CRJS466 – Psychopathology and CriminalityUnit 5 Individual Proje.docx
CRJS466 – Psychopathology and CriminalityUnit 5 Individual Proje.docxCRJS466 – Psychopathology and CriminalityUnit 5 Individual Proje.docx
CRJS466 – Psychopathology and CriminalityUnit 5 Individual Proje.docx
faithxdunce63732
 
Quality Resume
Quality ResumeQuality Resume
Quality Resume
vipin rana
 
Quality Resume
Quality ResumeQuality Resume
Quality Resume
vipin rana
 
Leading the way in six sigma
Leading the way in six sigmaLeading the way in six sigma
Leading the way in six sigma
Invensis Learning
 

Similar to Using CMMI Process Management Practices to Build and Maintain a QMS (20)

Diana M. Arias Resume - 2017
Diana M. Arias Resume - 2017Diana M. Arias Resume - 2017
Diana M. Arias Resume - 2017
 
Asset Finance Systems: Project Initiation "101"
Asset Finance Systems: Project Initiation "101"Asset Finance Systems: Project Initiation "101"
Asset Finance Systems: Project Initiation "101"
 
Introduction to Software Engineering
Introduction to Software EngineeringIntroduction to Software Engineering
Introduction to Software Engineering
 
Asset Finance Systems: Project Initiation "101"
Asset Finance Systems: Project Initiation "101"Asset Finance Systems: Project Initiation "101"
Asset Finance Systems: Project Initiation "101"
 
SWE 333 - ISQM ISO 9000-3.ppt
SWE 333 - ISQM ISO 9000-3.pptSWE 333 - ISQM ISO 9000-3.ppt
SWE 333 - ISQM ISO 9000-3.ppt
 
CRJS466 – Psychopathology and CriminalityUnit 5 Individual Proje.docx
CRJS466 – Psychopathology and CriminalityUnit 5 Individual Proje.docxCRJS466 – Psychopathology and CriminalityUnit 5 Individual Proje.docx
CRJS466 – Psychopathology and CriminalityUnit 5 Individual Proje.docx
 
Psp Tsp Agile 3 1 En
Psp Tsp Agile 3 1 EnPsp Tsp Agile 3 1 En
Psp Tsp Agile 3 1 En
 
Software Engineering Practices and Issues.pptx
Software Engineering Practices and Issues.pptxSoftware Engineering Practices and Issues.pptx
Software Engineering Practices and Issues.pptx
 
SE Lecture 2.ppt
SE Lecture 2.pptSE Lecture 2.ppt
SE Lecture 2.ppt
 
Process Models IN software Engineering
Process Models IN software EngineeringProcess Models IN software Engineering
Process Models IN software Engineering
 
DevOps Test Engineering: Putting the ‘Continuous’ in Testing, an ITSM Academy...
DevOps Test Engineering: Putting the ‘Continuous’ in Testing, an ITSM Academy...DevOps Test Engineering: Putting the ‘Continuous’ in Testing, an ITSM Academy...
DevOps Test Engineering: Putting the ‘Continuous’ in Testing, an ITSM Academy...
 
Software development o & c
Software development o & cSoftware development o & c
Software development o & c
 
ISO 9001:2015 What Are the Main Changes?
ISO 9001:2015 What Are the Main Changes?ISO 9001:2015 What Are the Main Changes?
ISO 9001:2015 What Are the Main Changes?
 
Value Summary 2.0 Overview
Value Summary 2.0 OverviewValue Summary 2.0 Overview
Value Summary 2.0 Overview
 
Week_02.pptx
Week_02.pptxWeek_02.pptx
Week_02.pptx
 
Quality Resume
Quality ResumeQuality Resume
Quality Resume
 
Quality Resume
Quality ResumeQuality Resume
Quality Resume
 
Leading the way in six sigma
Leading the way in six sigmaLeading the way in six sigma
Leading the way in six sigma
 
Manpro ppt
Manpro pptManpro ppt
Manpro ppt
 
Bhalchandra_Rajadhyax_Resume
Bhalchandra_Rajadhyax_ResumeBhalchandra_Rajadhyax_Resume
Bhalchandra_Rajadhyax_Resume
 

More from PECB

Beyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global ImpactBeyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global Impact
PECB
 
DORA, ISO/IEC 27005, and the Rise of AI: Securing the Future of Cybersecurity
DORA, ISO/IEC 27005, and the Rise of AI: Securing the Future of CybersecurityDORA, ISO/IEC 27005, and the Rise of AI: Securing the Future of Cybersecurity
DORA, ISO/IEC 27005, and the Rise of AI: Securing the Future of Cybersecurity
PECB
 
Securing the Future: ISO/IEC 27001, ISO/IEC 42001, and AI Governance
Securing the Future: ISO/IEC 27001, ISO/IEC 42001, and AI GovernanceSecuring the Future: ISO/IEC 27001, ISO/IEC 42001, and AI Governance
Securing the Future: ISO/IEC 27001, ISO/IEC 42001, and AI Governance
PECB
 
ISO/IEC 27032, ISO/IEC 27002, and CMMC Frameworks - Achieving Cybersecurity M...
ISO/IEC 27032, ISO/IEC 27002, and CMMC Frameworks - Achieving Cybersecurity M...ISO/IEC 27032, ISO/IEC 27002, and CMMC Frameworks - Achieving Cybersecurity M...
ISO/IEC 27032, ISO/IEC 27002, and CMMC Frameworks - Achieving Cybersecurity M...
PECB
 
ISO/IEC 27001 and ISO/IEC 27035: Building a Resilient Cybersecurity Strategy ...
ISO/IEC 27001 and ISO/IEC 27035: Building a Resilient Cybersecurity Strategy ...ISO/IEC 27001 and ISO/IEC 27035: Building a Resilient Cybersecurity Strategy ...
ISO/IEC 27001 and ISO/IEC 27035: Building a Resilient Cybersecurity Strategy ...
PECB
 
ISO/IEC 27001 and ISO/IEC 27005: Managing AI Risks Effectively
ISO/IEC 27001 and ISO/IEC 27005: Managing AI Risks EffectivelyISO/IEC 27001 and ISO/IEC 27005: Managing AI Risks Effectively
ISO/IEC 27001 and ISO/IEC 27005: Managing AI Risks Effectively
PECB
 
Aligning ISO/IEC 27032:2023 and ISO/IEC 27701: Strengthening Cybersecurity Re...
Aligning ISO/IEC 27032:2023 and ISO/IEC 27701: Strengthening Cybersecurity Re...Aligning ISO/IEC 27032:2023 and ISO/IEC 27701: Strengthening Cybersecurity Re...
Aligning ISO/IEC 27032:2023 and ISO/IEC 27701: Strengthening Cybersecurity Re...
PECB
 
ISO/IEC 27001 and ISO/IEC 27032:2023 - Safeguarding Your Digital Transformation
ISO/IEC 27001 and ISO/IEC 27032:2023 - Safeguarding Your Digital TransformationISO/IEC 27001 and ISO/IEC 27032:2023 - Safeguarding Your Digital Transformation
ISO/IEC 27001 and ISO/IEC 27032:2023 - Safeguarding Your Digital Transformation
PECB
 
Managing ISO 31000 Framework in AI Systems - The EU ACT and other regulations
Managing ISO 31000 Framework in AI Systems - The EU ACT and other regulationsManaging ISO 31000 Framework in AI Systems - The EU ACT and other regulations
Managing ISO 31000 Framework in AI Systems - The EU ACT and other regulations
PECB
 
Impact of Generative AI in Cybersecurity - How can ISO/IEC 27032 help?
Impact of Generative AI in Cybersecurity - How can ISO/IEC 27032 help?Impact of Generative AI in Cybersecurity - How can ISO/IEC 27032 help?
Impact of Generative AI in Cybersecurity - How can ISO/IEC 27032 help?
PECB
 
GDPR and Data Protection: Ensure compliance and minimize the risk of penaltie...
GDPR and Data Protection: Ensure compliance and minimize the risk of penaltie...GDPR and Data Protection: Ensure compliance and minimize the risk of penaltie...
GDPR and Data Protection: Ensure compliance and minimize the risk of penaltie...
PECB
 
How Can ISO/IEC 27001 Help Organizations Align With the EU Cybersecurity Regu...
How Can ISO/IEC 27001 Help Organizations Align With the EU Cybersecurity Regu...How Can ISO/IEC 27001 Help Organizations Align With the EU Cybersecurity Regu...
How Can ISO/IEC 27001 Help Organizations Align With the EU Cybersecurity Regu...
PECB
 
ISO/IEC 27001 and ISO 22301 - How to ensure business survival against cyber a...
ISO/IEC 27001 and ISO 22301 - How to ensure business survival against cyber a...ISO/IEC 27001 and ISO 22301 - How to ensure business survival against cyber a...
ISO/IEC 27001 and ISO 22301 - How to ensure business survival against cyber a...
PECB
 
Integrating ISO/IEC 27001 and ISO 31000 for Effective Information Security an...
Integrating ISO/IEC 27001 and ISO 31000 for Effective Information Security an...Integrating ISO/IEC 27001 and ISO 31000 for Effective Information Security an...
Integrating ISO/IEC 27001 and ISO 31000 for Effective Information Security an...
PECB
 
IT Governance and Information Security – How do they map?
IT Governance and Information Security – How do they map?IT Governance and Information Security – How do they map?
IT Governance and Information Security – How do they map?
PECB
 
Student Information Session University Digital Encode.pptx
Student Information Session University Digital Encode.pptxStudent Information Session University Digital Encode.pptx
Student Information Session University Digital Encode.pptx
PECB
 
Cybersecurity trends - What to expect in 2023
Cybersecurity trends - What to expect in 2023Cybersecurity trends - What to expect in 2023
Cybersecurity trends - What to expect in 2023
PECB
 

More from PECB (20)

Beyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global ImpactBeyond the EU: DORA and NIS 2 Directive's Global Impact
Beyond the EU: DORA and NIS 2 Directive's Global Impact
 
DORA, ISO/IEC 27005, and the Rise of AI: Securing the Future of Cybersecurity
DORA, ISO/IEC 27005, and the Rise of AI: Securing the Future of CybersecurityDORA, ISO/IEC 27005, and the Rise of AI: Securing the Future of Cybersecurity
DORA, ISO/IEC 27005, and the Rise of AI: Securing the Future of Cybersecurity
 
Securing the Future: ISO/IEC 27001, ISO/IEC 42001, and AI Governance
Securing the Future: ISO/IEC 27001, ISO/IEC 42001, and AI GovernanceSecuring the Future: ISO/IEC 27001, ISO/IEC 42001, and AI Governance
Securing the Future: ISO/IEC 27001, ISO/IEC 42001, and AI Governance
 
ISO/IEC 27032, ISO/IEC 27002, and CMMC Frameworks - Achieving Cybersecurity M...
ISO/IEC 27032, ISO/IEC 27002, and CMMC Frameworks - Achieving Cybersecurity M...ISO/IEC 27032, ISO/IEC 27002, and CMMC Frameworks - Achieving Cybersecurity M...
ISO/IEC 27032, ISO/IEC 27002, and CMMC Frameworks - Achieving Cybersecurity M...
 
ISO/IEC 27001 and ISO/IEC 27035: Building a Resilient Cybersecurity Strategy ...
ISO/IEC 27001 and ISO/IEC 27035: Building a Resilient Cybersecurity Strategy ...ISO/IEC 27001 and ISO/IEC 27035: Building a Resilient Cybersecurity Strategy ...
ISO/IEC 27001 and ISO/IEC 27035: Building a Resilient Cybersecurity Strategy ...
 
ISO/IEC 27001 and ISO/IEC 27005: Managing AI Risks Effectively
ISO/IEC 27001 and ISO/IEC 27005: Managing AI Risks EffectivelyISO/IEC 27001 and ISO/IEC 27005: Managing AI Risks Effectively
ISO/IEC 27001 and ISO/IEC 27005: Managing AI Risks Effectively
 
Aligning ISO/IEC 27032:2023 and ISO/IEC 27701: Strengthening Cybersecurity Re...
Aligning ISO/IEC 27032:2023 and ISO/IEC 27701: Strengthening Cybersecurity Re...Aligning ISO/IEC 27032:2023 and ISO/IEC 27701: Strengthening Cybersecurity Re...
Aligning ISO/IEC 27032:2023 and ISO/IEC 27701: Strengthening Cybersecurity Re...
 
ISO/IEC 27001 and ISO/IEC 27032:2023 - Safeguarding Your Digital Transformation
ISO/IEC 27001 and ISO/IEC 27032:2023 - Safeguarding Your Digital TransformationISO/IEC 27001 and ISO/IEC 27032:2023 - Safeguarding Your Digital Transformation
ISO/IEC 27001 and ISO/IEC 27032:2023 - Safeguarding Your Digital Transformation
 
Managing ISO 31000 Framework in AI Systems - The EU ACT and other regulations
Managing ISO 31000 Framework in AI Systems - The EU ACT and other regulationsManaging ISO 31000 Framework in AI Systems - The EU ACT and other regulations
Managing ISO 31000 Framework in AI Systems - The EU ACT and other regulations
 
Impact of Generative AI in Cybersecurity - How can ISO/IEC 27032 help?
Impact of Generative AI in Cybersecurity - How can ISO/IEC 27032 help?Impact of Generative AI in Cybersecurity - How can ISO/IEC 27032 help?
Impact of Generative AI in Cybersecurity - How can ISO/IEC 27032 help?
 
GDPR and Data Protection: Ensure compliance and minimize the risk of penaltie...
GDPR and Data Protection: Ensure compliance and minimize the risk of penaltie...GDPR and Data Protection: Ensure compliance and minimize the risk of penaltie...
GDPR and Data Protection: Ensure compliance and minimize the risk of penaltie...
 
How Can ISO/IEC 27001 Help Organizations Align With the EU Cybersecurity Regu...
How Can ISO/IEC 27001 Help Organizations Align With the EU Cybersecurity Regu...How Can ISO/IEC 27001 Help Organizations Align With the EU Cybersecurity Regu...
How Can ISO/IEC 27001 Help Organizations Align With the EU Cybersecurity Regu...
 
Student Information Session University KTMC
Student Information Session University KTMC Student Information Session University KTMC
Student Information Session University KTMC
 
ISO/IEC 27001 and ISO 22301 - How to ensure business survival against cyber a...
ISO/IEC 27001 and ISO 22301 - How to ensure business survival against cyber a...ISO/IEC 27001 and ISO 22301 - How to ensure business survival against cyber a...
ISO/IEC 27001 and ISO 22301 - How to ensure business survival against cyber a...
 
Integrating ISO/IEC 27001 and ISO 31000 for Effective Information Security an...
Integrating ISO/IEC 27001 and ISO 31000 for Effective Information Security an...Integrating ISO/IEC 27001 and ISO 31000 for Effective Information Security an...
Integrating ISO/IEC 27001 and ISO 31000 for Effective Information Security an...
 
Student Information Session University CREST ADVISORY AFRICA
Student Information Session University CREST ADVISORY AFRICA Student Information Session University CREST ADVISORY AFRICA
Student Information Session University CREST ADVISORY AFRICA
 
IT Governance and Information Security – How do they map?
IT Governance and Information Security – How do they map?IT Governance and Information Security – How do they map?
IT Governance and Information Security – How do they map?
 
Information Session University Egybyte.pptx
Information Session University Egybyte.pptxInformation Session University Egybyte.pptx
Information Session University Egybyte.pptx
 
Student Information Session University Digital Encode.pptx
Student Information Session University Digital Encode.pptxStudent Information Session University Digital Encode.pptx
Student Information Session University Digital Encode.pptx
 
Cybersecurity trends - What to expect in 2023
Cybersecurity trends - What to expect in 2023Cybersecurity trends - What to expect in 2023
Cybersecurity trends - What to expect in 2023
 

Recently uploaded

Additional Benefits for Employee Website.pdf
Additional Benefits for Employee Website.pdfAdditional Benefits for Employee Website.pdf
Additional Benefits for Employee Website.pdf
joachimlavalley1
 
Accounting and finance exit exam 2016 E.C.pdf
Accounting and finance exit exam 2016 E.C.pdfAccounting and finance exit exam 2016 E.C.pdf
Accounting and finance exit exam 2016 E.C.pdf
YibeltalNibretu
 
The Roman Empire A Historical Colossus.pdf
The Roman Empire A Historical Colossus.pdfThe Roman Empire A Historical Colossus.pdf
The Roman Empire A Historical Colossus.pdf
kaushalkr1407
 

Recently uploaded (20)

Matatag-Curriculum and the 21st Century Skills Presentation.pptx
Matatag-Curriculum and the 21st Century Skills Presentation.pptxMatatag-Curriculum and the 21st Century Skills Presentation.pptx
Matatag-Curriculum and the 21st Century Skills Presentation.pptx
 
Introduction to Quality Improvement Essentials
Introduction to Quality Improvement EssentialsIntroduction to Quality Improvement Essentials
Introduction to Quality Improvement Essentials
 
Solid waste management & Types of Basic civil Engineering notes by DJ Sir.pptx
Solid waste management & Types of Basic civil Engineering notes by DJ Sir.pptxSolid waste management & Types of Basic civil Engineering notes by DJ Sir.pptx
Solid waste management & Types of Basic civil Engineering notes by DJ Sir.pptx
 
Additional Benefits for Employee Website.pdf
Additional Benefits for Employee Website.pdfAdditional Benefits for Employee Website.pdf
Additional Benefits for Employee Website.pdf
 
Overview on Edible Vaccine: Pros & Cons with Mechanism
Overview on Edible Vaccine: Pros & Cons with MechanismOverview on Edible Vaccine: Pros & Cons with Mechanism
Overview on Edible Vaccine: Pros & Cons with Mechanism
 
Accounting and finance exit exam 2016 E.C.pdf
Accounting and finance exit exam 2016 E.C.pdfAccounting and finance exit exam 2016 E.C.pdf
Accounting and finance exit exam 2016 E.C.pdf
 
Salient features of Environment protection Act 1986.pptx
Salient features of Environment protection Act 1986.pptxSalient features of Environment protection Act 1986.pptx
Salient features of Environment protection Act 1986.pptx
 
How to Split Bills in the Odoo 17 POS Module
How to Split Bills in the Odoo 17 POS ModuleHow to Split Bills in the Odoo 17 POS Module
How to Split Bills in the Odoo 17 POS Module
 
Supporting (UKRI) OA monographs at Salford.pptx
Supporting (UKRI) OA monographs at Salford.pptxSupporting (UKRI) OA monographs at Salford.pptx
Supporting (UKRI) OA monographs at Salford.pptx
 
GIÁO ÁN DẠY THÊM (KẾ HOẠCH BÀI BUỔI 2) - TIẾNG ANH 8 GLOBAL SUCCESS (2 CỘT) N...
GIÁO ÁN DẠY THÊM (KẾ HOẠCH BÀI BUỔI 2) - TIẾNG ANH 8 GLOBAL SUCCESS (2 CỘT) N...GIÁO ÁN DẠY THÊM (KẾ HOẠCH BÀI BUỔI 2) - TIẾNG ANH 8 GLOBAL SUCCESS (2 CỘT) N...
GIÁO ÁN DẠY THÊM (KẾ HOẠCH BÀI BUỔI 2) - TIẾNG ANH 8 GLOBAL SUCCESS (2 CỘT) N...
 
The Roman Empire A Historical Colossus.pdf
The Roman Empire A Historical Colossus.pdfThe Roman Empire A Historical Colossus.pdf
The Roman Empire A Historical Colossus.pdf
 
INU_CAPSTONEDESIGN_비밀번호486_업로드용 발표자료.pdf
INU_CAPSTONEDESIGN_비밀번호486_업로드용 발표자료.pdfINU_CAPSTONEDESIGN_비밀번호486_업로드용 발표자료.pdf
INU_CAPSTONEDESIGN_비밀번호486_업로드용 발표자료.pdf
 
Danh sách HSG Bộ môn cấp trường - Cấp THPT.pdf
Danh sách HSG Bộ môn cấp trường - Cấp THPT.pdfDanh sách HSG Bộ môn cấp trường - Cấp THPT.pdf
Danh sách HSG Bộ môn cấp trường - Cấp THPT.pdf
 
Basic_QTL_Marker-assisted_Selection_Sourabh.ppt
Basic_QTL_Marker-assisted_Selection_Sourabh.pptBasic_QTL_Marker-assisted_Selection_Sourabh.ppt
Basic_QTL_Marker-assisted_Selection_Sourabh.ppt
 
B.ed spl. HI pdusu exam paper-2023-24.pdf
B.ed spl. HI pdusu exam paper-2023-24.pdfB.ed spl. HI pdusu exam paper-2023-24.pdf
B.ed spl. HI pdusu exam paper-2023-24.pdf
 
Chapter 3 - Islamic Banking Products and Services.pptx
Chapter 3 - Islamic Banking Products and Services.pptxChapter 3 - Islamic Banking Products and Services.pptx
Chapter 3 - Islamic Banking Products and Services.pptx
 
Sectors of the Indian Economy - Class 10 Study Notes pdf
Sectors of the Indian Economy - Class 10 Study Notes pdfSectors of the Indian Economy - Class 10 Study Notes pdf
Sectors of the Indian Economy - Class 10 Study Notes pdf
 
Synthetic Fiber Construction in lab .pptx
Synthetic Fiber Construction in lab .pptxSynthetic Fiber Construction in lab .pptx
Synthetic Fiber Construction in lab .pptx
 
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa
 
NCERT Solutions Power Sharing Class 10 Notes pdf
NCERT Solutions Power Sharing Class 10 Notes pdfNCERT Solutions Power Sharing Class 10 Notes pdf
NCERT Solutions Power Sharing Class 10 Notes pdf
 

Using CMMI Process Management Practices to Build and Maintain a QMS

  • 1. 1 © 2017 Natural SPI Using CMMI Process Management Practices to Build and Maintain a QMS
  • 2. 2 © 2017 Natural SPI Question? What does ISO 9001, AS9100, or TL9000 have to say about QMS development and maintenance?
  • 3. 3 © 2017 Natural SPI Almost nothing. Answer … From AS9100D (inclusive of ISO 9001:2015) Section 0.3 Process Approach (not a requirement), we get a 40-year-old process model and PDCA.
  • 4. 4 © 2017 Natural SPI However ... Answer … The CMMI provides two process areas (OPF and OPD) and 14 practices for the establishment of a persistent organization-level process definition, deployment, and management focus. So here’s what I’ve learned and used from these good practices …
  • 5. 5 © 2017 Natural SPI 7 Rules for Designing and Developing Process Processes that work are designed and built by applying these rules: 1. All performance improvement comes from the performed process, not the defined process. 2. Know what problem you’re solving before you begin developing or improving your processes. 3. The process is the product. 4. Design and build processes for the process users. 5. Compliance – with standards or models – is not necessarily the same as quality or improvement. 6. Plan and manage process development as a project. 7. Process information and data exists in only one place.
  • 6. 6 © 2017 Natural SPI Know What Problem You’re Trying to Solve 1 If I had an hour to save the world, I would spend 59 minutes defining the problem … and one minute finding solutions. - Albert Einstein
  • 7. 7 © 2017 Natural SPI Know What Problem You’re Trying to Solve 2 People Organization as a System of Systems Process Technology A modern organization is an integrated system of systems: people (social) system, technology systems, and process systems. If we have a problem to solve or a performance goal to achieve, we need to first determine which of these systems most needs improving.
  • 8. 8 © 2017 Natural SPI Know What Problem You’re Trying to Solve 3 Example of a flawed RCA:
  • 9. 9 © 2017 Natural SPI Know What Problem You’re Trying to Solve 3 How we know it’s flawed: X X X
  • 10. 10 © 2017 Natural SPI Know What Problem You’re Trying to Solve 4 A logical RCA:
  • 11. 11 © 2017 Natural SPI Know What Problem You’re Trying to Solve 5 In a system of systems, changes or improvements cannot be made to one system without collateral changes to the other systems. Relationship between improving people to improving Process and Technology
  • 12. 12 © 2017 Natural SPI Know What Problem You’re Trying to Solve 6 Relationship between improving people to improving Process and Technology Relationship between improving Technology to improving People and Process
  • 13. 13 © 2017 Natural SPI Know What Problem You’re Trying to Solve 7 Relationship between improving Process to improving People and Technology
  • 14. 14 © 2017 Natural SPI Know What Problem You’re Trying to Solve 8 Estimating the Return On Process (ROP) ROP = Value of Performance Gain – Cost of Improvement Value of Performance Gain = Value of future performance (post improvement) – Value of current (baseline) performance Cost of Improvement = Cost of improvement effort + cost of technology investment + cost of training, implementation and institutionalization of change.
  • 15. 15 © 2017 Natural SPI Paradigm Shift: The Process is a Product What am I? I … 1. Am complex and have many integrated subsystems and parts. 2. Have hundreds of high-level requirements or user stories. 3. Need to provably comply with international industry standards. 4. Have dozens of interfaces. 5. Need to be designed before being built. 6. Need to be built according to the design. 7. Can and should be verified against requirements or user stories. 8. Can and should be tested at the modular/unit level and system level. 9. Can and should be planned and managed using proven project management practices.
  • 16. 16 © 2017 Natural SPI Process System Requirements and Users 1 Just like a product or a technology system, a modern process system can have hundreds of high-level requirements including: 1. User requirements (user stories or use cases) 2. Functional requirements 3. Interface requirements 4. Compliance requirements 5. “Ilities” requirements
  • 17. 17 © 2017 Natural SPI Process System Requirements and Users 2 Designing and building a process system for its users means defining requirements or user stories that: 1. Define user preferences for ingesting information and acting appropriately 2. Incorporate users’ learning modalities: reading, watching, doing 3. Incorporate the range of user and potential user knowledge, skill, and experience in performing the process 4. Defines not only what users want in the process, but also not defining what they don’t want
  • 18. 18 © 2017 Natural SPI Process System Requirements and Users 3 Develop and maintain requirements and user stories that can be used to design and build processes that satisfy the “ilities.” To what extent can we make the process:  Adoptable  Adaptable  Maintainable  Extensible  Scalable  Testable  Measurable  Auditable See Ilities definitions
  • 19. 19 © 2017 Natural SPI Process Improvement Project Management 1 Process Development Project Management involves: 1. Adopting the paradigm that developing enterprise processes should be treated as a “project” that is delivering a complex process “system” 2. Establishing and maintaining the process system requirements 3. Manage the process development project using project plans: a. Project Management Plan b. Development Environment Plan c. WBS-Schedule d. Risk Management Plan e. Data Management Plan f. Measurement Plan g. Stakeholder Involvement Plan h. Quality Assurance Plan i. Training and Knowledge Transfer Plan j. Structured Decision Plan
  • 20. 20 © 2017 Natural SPI Process Improvement Project Management 2 Process Improvement Project Management involves: 4. Regular project team meetings for status against plans, risk management, and lessons-learned 5. Peer reviews to verify process designs and builds against requirements 6. Periodic and event-driven project reviews with sponsors and leadership 7. Phase-gate reviews with criteria for move-forward decisions 8. Collecting, analyzing, and reporting rocess performance measures/metrics
  • 21. 21 © 2017 Natural SPI Domain Knowledge/Experience Knowledge of and experience in the environment in which the processes are deployed. Information Mapping or Process Modeling Training and experience in modeling processes and in information structuring and classification. Models and Standards Knowledge In-depth understanding of models and standards used to guide processes (e.g., the CMMI). The Process Development Project Team 1 Process Development Knowledge, Skills, Experience
  • 22. 22 © 2017 Natural SPI Process Improvement Project Management Knowledge and experience in applying project management techniques to process improvement work. Skill in estimating and planning process definition work, and skill in tracking, monitoring, and measuring against the plans. Communication and Presentation New and revised processes need to be communicated and trained to users. This requires strong interpersonal and communication skills. Public speaking or presentation skills are also important. Process Definition Tool Expertise Extensive training and knowledge in the effective use of the tools used to develop the process assets (e.g., MS Office products). Also tools and systems used to manage and control process assets. The Process Development Project Team 2 Process Development Knowledge, Skills, Experience (continued)
  • 23. 23 © 2017 Natural SPI Process Project Roles Process Project Manager (Sprint or Scrum Lead if Agile) Manages process improvement project (one release of a process system) including process design and definition work. Process Requirements Analyst (User or Product Owner if Agile) Role responsible for eliciting, gathering, and analyzing the project’s or organization’ performance goals, requirements and user stories for processes and process improvement. Process Designer Role responsible for designing process assets based on requirements. Validates process design using use cases, operational scenarios, or prototypes. Facilitates make v. buy and reuse decisions. Process Developer Role responsible for developing and defining process assets and/or revising existing assets. The Process Development Project Team 3
  • 24. 24 © 2017 Natural SPI Process Configuration and Data Management Person/group responsible for establishing and maintaining integrity of PI project data items and tools, and for CM and DM of process assets being developed and released. Process Tester Person/group responsible for verifying and/or validating developed process assets. Role plans and implements process verification and validation activities such as peer reviews, walk-throughs, pilots, and simulations. Role documents, reports, and tracks to closure process asset defects. Process Project Quality Assurance Role responsible for assuring PI project and process definition activities are performed in compliance with plans. Also objectively evaluates PI project work products to assure compliance with applicable organizational standards and procedures. Process Project Roles (continued) The Process Development Project Team 4
  • 25. 25 © 2017 Natural SPI Process Project Sponsors (Product Owner in Agile) Individual or group responsible for authorizing PI project and allocating required resources to process design and definition work. Process User/SME Process users are individuals and organizations who implement the process assets in their software, system, or acquisition organizations. Process Customer Process customers are people or organizations who provide requirements to the PI project and who sometimes fund PI work. They may also be beneficiaries of the results of process performance and improvement. Process Project Roles (continued) The Process Development Project Team 4
  • 26. 26 © 2017 Natural SPI Development Team • Defines process requirements • Develops process architecture • Defines process asset standards • Designs/defines PAL PI Project Team • Plans PI project • Monitors and controls PI project • Defines process release strategy • Collects, analyzes, and reports PI project performance measure • Defines and coordinates integrated team Review/Test Team • Peer reviews process assets • Pilots/test process assets • Reports process defects and tracks to closure Change Control Board • Reviews/approves changes to assets • Establishes process asset change control • Defines process asset release baselines Release/Implementation Team • Plans/coordinates process releases • Trains processes and assets to users • Measures and reports implementation results Integrated team approach to process definition and delivery Process Customers Processes & Process Assets The Process Development Project Team 5
  • 27. 27 © 2017 Natural SPI www.susannemadsen.com 27 ISO 9001 Training Courses  ISO 9001 Introduction 1 Day Course  ISO 9001 Foundation 2 Days Course  ISO 9001 Lead Implementer 5 Days Course  ISO 9001 Lead Auditor 5 Days Course  ISO 9001:2015 Transition 2 Days Course Exam and certification fees are included in the training price. https://pecb.com/en/education-and-certification-for-individuals/iso-9001/ https://pecb.com/en/partnerEvent/event_schedule_list
  • 28. 28 © 2017 Natural SPI #PMSummit 28 ? THANK YOU Michael@naturalspi.com http://www.naturalspi.com/ linkedin.com/in/michael-west-3b0812 435-901-4295