Search NASA⌕ Search

SEARCH · Search NASA

Results for “Capability Maturity Model”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 19 records
All sourcesNASA NTRSDOE OSTI
DOE OSTI2023

User Guide to the Facility Cybersecurity Capability Maturity Model (F-C2M2) Assessment

The Facility Cybersecurity Capability Maturity Model (F-C2M2) assessment was designed to help facilities address their unique cybersecurity challenges. Building upon the foundational principles of the U.S. Department of Energy (DOE) Cybersecurity Capability Maturity Model (C2M2), the F-C2M2 was explicitly tailored for federal facilities to help evaluate, benchmark, and enhance the cybersecurity capabilities of both their information technology (IT) and operational technology (OT) environments. This user guide was developed to facilitate a thorough understanding of the tool. Whether users are familiar with the original C2M2 or are new to the maturity model concept, this guide was designed to offer clarity, direction, and support.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2020

Secure Design and Development Cyber Security Capability Maturity Model” (SD2-CM2)

The "Secure Design and Development Cyber Security Capability Maturity Model" (SD2-CM2) allows electrical system managers to assess the maturity of their cybersecurity systems, including designs reflecting internet of things devices (IOT). The content provides best practices in the field and users can assess the level of their designs. Modules are "Content" and "Infrastructure"

Gourisetti, Sri Nikhil Gupta↗
DOE OSTI2023

Predictive Capability Maturity Model Demonstration for Cylindrical Cavity Coupling Using Gemma in the Next Generation Workflow

The predictive capability maturity model (PCMM) uses the expert elicitation process to generate credibility evidence for a particular analysis. To ensure Gemma has the capability to efficiently produce this credibility evidence, next generation workflows (NGW) are created for the solution verification, calibration/validation, and input uncertainty quantification portions of the PCMM assessment. These workflows are then used on the Higgins cylinder problem, which is representative of applications involving external-to-internal electromagnetic field coupling through a slot. The uncertainties calculated using these workflows are then used to calculate the validation comparison error and the validation uncertainty for the model following the American Society of Mechanical Engineers (ASME) verification and validation (V&V) 20 standard. These workflows will enable analysts to iterate each element of PCMM more efficiently than if completed without using a NGW workflow. An example of this iterative process is shown in Section 7.2.

42 ENGINEERING↗
NASA NTRS2000

Capability Maturity Model (CMM) for Software Process Improvements

This slide presentation reviews the Avionic Systems Division's implementation of the Capability Maturity Model (CMM) for improvements in the software development process. The presentation reviews the process involved in implementing the model and the benefits of using CMM to improve the software development process.

Ling, Robert Y.↗
NASA NTRS2002

ISO 9000 and/or Systems Engineering Capability Maturity Model?

For businesses and organizations to remain competitive today they must have processes and systems in place that will allow them to first identify customer needs and then develop products/processes that will meet or exceed the customers needs and expectations. Customer needs, once identified, are normally stated as requirements. Designers can then develop products/processes that will meet these requirements. Several functions, such as quality management and systems engineering management are used to assist product development teams in the development process. Both functions exist in all organizations and both have a similar objective, which is to ensure that developed processes will meet customer requirements. Are efforts in these organizations being duplicated? Are both functions needed by organizations? What are the similarities and differences between the functions listed above? ISO 9000 is an international standard of goods and services. It sets broad requirements for the assurance of quality and for management's involvement. It requires organizations to document the processes and to follow these documented processes. ISO 9000 gives customers assurance that the suppliers have control of the process for product development. Systems engineering can broadly be defined as a discipline that seeks to ensure that all requirements for a system are satisfied throughout the life of the system by preserving their interrelationship. The key activities of systems engineering include requirements analysis, functional analysis/allocation, design synthesis and verification, and system analysis and control. The systems engineering process, when followed properly, will lead to higher quality products, lower cost products, and shorter development cycles. The System Engineering Capability Maturity Model (SE-CMM) will allow companies to measure their system engineering capability and continuously improve those capabilities. ISO 9000 and SE-CMM seem to have a similar objective, which is to document the organization's processes and certify to potential customers the capability of a supplier to control the processes that determine the quality of the product or services being produced. The remaining sections of this report examine the differences and similarities between ISO 9000 and SE-CMM and make recommendations for implementation.

Sampson E. Gholston↗
NASA NTRS2010

NASA Experience with CMM and CMMI

This slide presentation reviews the experience NASA has had in using Capability Maturity Model (CMM) and Capability Maturity Model Integration (CMMI). In particular this presentation reviews the agency's experience within the software engineering discipline and the lessons learned and key impacts from using CMMI.

Crumbley, Tim↗
DOE OSTI2026

Preparing For Advanced Air Mobility: A System-Level Framework For Infrastructure, Investment, and Deployment

Advanced air mobility (AAM) is moving from demonstration toward early deployment, supported by a growing national strategy that outlines how these systems may evolve across airspace, infrastructure, and operations. As this transition takes shape, a more practical question comes into focus: what does it mean to be ready? This paper introduces a Capability Maturity Model (CMM) as a structured way to think about that challenge. Rather than treating readiness as a fixed condition, it frames it as a progression - one that develops across multiple, interdependent domains over time.

24 POWER TRANSMISSION AND DISTRIBUTION↗
NASA NTRS2008

Reaching for the APEX at Ames

The multidimensional design of the APEX program is the result of an extensive research and development effort dating back nearly a decade. "In the late 1990s and early 2000, we were pretty successful at getting new research and technology projects here at the center," Johnson says, "and we had a lack of critical mass of project managers. We were taking people who were primarily researchers and putting them in the position of managing projects." Smith and Johnson held a series of workshops across the center during 2000 and 2001 to gather feedback about how to address this issue. When they briefed the center's senior management on their findings, one of the top recommendations was to establish a project manager development program at Ames. At that point, they cast a wide net for ideas and information. "We did centerwide needs assessment, we did focus groups, we did surveys," Smith says. "We came up with a proposal for what a program would look like, tying in what we knew about the Academy of Program1 Project Leadership (now the Academy for Program/Project and Engineering Leadership, or APPEL), what we've seen at other centers, what other centers have tried. We were always checking to make sure our program mapped to APPEL. We also looked at the PMI [Project Management Institute] model, INCOSE [International Council on Systems Engineering], CMMI [Capability Maturity Model Integration], you name it." "We had a lot of conversations with the Jet Propulsion Lab and Goddard," Johnson adds. "We saw those centers as models for what Ames was aspiring to be in terms of a center for managing space flight missions." Their research confirmed what they already knew-that strong practitioner involvement would be critical to their program design process. 'XPEX is for the practitioner by the practitioner," Smith says. "They have to be a part of designing it. Otherwise there's no way we could design a program that meets their needs." At the same time that they worked at the grassroots level, they also solicited feedback from the center's senior management. "We recognized that in order for anything to succeed here, we needed to have a champion at the center management level," Johnson said. "You have to have champions, and you have to listen to what the senior managers are saying. They have their own ideas." In the case of APEX, one of those ideas fundamentally reshaped the program. "When we originally started, it was a project management development program," Johnson says, "but in our meeting with our center director, he said, 'Project management is important, but we also need to strengthen our systems engineering.' So we basically added that component to the program based on what he wanted."

Kohut, Matthew↗
DOE OSTI2020

APPLICATION OF MATURITY MODELS FOR EVALUATING CYBERSECURITY PROGRAMS AT NUCLEAR AND RADIOLOGICAL FACILITIES

Maturity models can be used to provide government agencies, industry associations, and organizations operating nuclear facilities with the ability to quickly evaluate the maturity of their cybersecurity programs and identify areas to prioritize for improvement. The Cybersecurity Capability Maturity Model (C2M2) was developed by the U.S. Department of Energy to allow organizations in the energy sector to evaluate the programmatic capabilities of their cybersecurity programs in a consistent manner, communicate programmatic maturity information, prioritize cybersecurity investments in targeted areas of concern, and track how the maturity of their cybersecurity program evolves over time. The C2M2 is designed for use by any critical infrastructure organization regardless of ownership, structure, or size. The C2M2 can be easily fine-tuned to access the maturity of nuclear cybersecurity programs and their application at individual facilities. Built on a foundation of existing cybersecurity standards, frameworks, programs, and initiatives, the model features 10 security domains. Performance in each security domain is characterized using a structured set of cybersecurity practices that represent activities an organization can perform to improve cybersecurity in their domain. Each practice can be quickly evaluated as being either fully, largely, partially, or not implemented. Once practices are evaluated for each security domain, the model defines four maturity indicator levels that apply independently to each domain in the model. To earn a maturity level in a given domain, an organization must adequately perform all the practices for that maturity level and its predecessor level(s). A small assessment team can conduct a C2M2 assessment in a single day. A screening version of the C2M2 allows an initial look at the maturity of nuclear cybersecurity programs that could be completed in under an hour.

Cyber security, Nuclear security, maturity model↗
NASA NTRS2005

Program Facilitates CMMI Appraisals

A computer program has been written to facilitate appraisals according to the methodology of Capability Maturity Model Integration (CMMI). [CMMI is a government/industry standard, maintained by the Software Engineering Institute at Carnegie Mellon University, for objectively assessing the engineering capability and maturity of an organization (especially, an organization that produces software)]. The program assists in preparation for a CMMI appraisal by providing drop-down lists suggesting required artifacts or evidence. It identifies process areas for which similar evidence is required and includes a copy feature that reduces or eliminates repetitive data entry. It generates reports to show the entire framework for reference, the appraisal artifacts to determine readiness for an appraisal, and lists of interviewees and questions to ask them during the appraisal. During an appraisal, the program provides screens for entering observations and ratings, and reviewing evidence provided thus far. Findings concerning strengths and weaknesses can be exported for use in a report or a graphical presentation. The program generates a chart showing capability level ratings of the organization. A context-sensitive Windows help system enables a novice to use the program and learn about the CMMI appraisal process.

Sweetser, Wesley↗
DOE OSTI2021

Code and Solution Verification Assessment of the CTF Thermal Hydraulic Subchannel Code

CTF is a thermal-hydraulics subchannel code jointly developed by Oak Ridge National Laboratory and North Carolina State University. Over the past seven years, the Consortium for Advanced Simulation of Light Water Reactors (CASL) has made a significant investment in developing CTF so it can be used to model light water reactors, including nominal operating conditions, departure from nucleate boiling analysis, and transients ranging from loss of flow to reactivity insertion accidents. In addition to implementing new modeling capabilities and developing the user input and output interface, extensive work has been performed to improve the code’s quality assurance program, resulting in a development process that conforms with NQA-1 requirements. The CASL program follows the Predictive Capability Maturity Model (PCMM) approach for assessing code quality, which emphasizes performing code verification(ensuring the code converges to the correct answer) and solution verification (ensuring the code converges for the intended application). Code and solution verification are used to identify uncertainty errors introduced by numerical approximations in the code and are important for demonstrating that the model is coded without error, which is an important aspect of the Best Estimate plus Uncertainty method. This paper presents a comprehensive overview of the code and solution verification testing that has been performed on CTF. A top-down approach is taken in which the intended CTF applications are presented, followed by the code features required for their modeling. These features are then linked to the applicable code and solution verification tests that demonstrate proper functioning. Past testing efforts are summarized, and new tests are added to help close gaps in the presented test matrix. Rather than performing “one-off” exercises, these tests are added to the automated CTF regression test suite to ensure continual code quality.

21 SPECIFIC NUCLEAR REACTORS AND ASSOCIATED PLANTS↗
NASA NTRS1992

The experience factory: Can it make you a 5? or what is its relationship to other quality and improvement concepts?

The concepts of quality improvements have permeated many businesses. It is clear that the nineties will be the quality era for software and there is a growing need to develop or adapt quality improvement approaches to the software business. Thus we must understand software as an artifact and software as a business. Since the business we are dealing with is software, we must understand the nature of software and software development. The software discipline is evolutionary and experimental; it is a laboratory science. Software is development not production. The technologies of the discipline are human based. There is a lack of models that allow us to reason about the process and the product. All software is not the same; process is a variable, goals are variable, etc. Packaged, reusable, experiences require additional resources in the form of organization, processes, people, etc. There have been a variety of organizational frameworks proposed to improve quality for various businesses. The ones discussed in this presentation include: Plan-Do-Check-Act, a quality improvement process based upon a feedback cycle for optimizing a single process model/production line; the Experience Factory/Quality Improvement Paradigm, continuous improvements through the experimentation, packaging, and reuse of experiences based upon a business's needs; Total Quality Management, a management approach to long term success through customer satisfaction based on the participation of all members of an organization; the SEI capability maturity model, a staged process improvement based upon assessment with regard to a set of key process areas until you reach a level 5 which represents a continuous process improvement; and Lean (software) Development, a principle supporting the concentration of the production on 'value added' activities and the elimination of reduction of 'not value added' activities.

Basili, Victor R.↗
NASA NTRS2012

Mission Analysis, Operations, and Navigation Toolkit Environment (Monte) Version 040

Monte is a software set designed for use in mission design and spacecraft navigation operations. The system can process measurement data, design optimal trajectories and maneuvers, and do orbit determination, all in one application. For the first time, a single software set can be used for mission design and navigation operations. This eliminates problems due to different models and fidelities used in legacy mission design and navigation software. The unique features of Monte 040 include a blowdown thruster model for GRAIL (Gravity Recovery and Interior Laboratory) with associated pressure models, as well as an updated, optimalsearch capability (COSMIC) that facilitated mission design for ARTEMIS. Existing legacy software lacked the capabilities necessary for these two missions. There is also a mean orbital element propagator and an osculating to mean element converter that allows long-term orbital stability analysis for the first time in compiled code. The optimized trajectory search tool COSMIC allows users to place constraints and controls on their searches without any restrictions. Constraints may be user-defined and depend on trajectory information either forward or backwards in time. In addition, a long-term orbit stability analysis tool (morbiter) existed previously as a set of scripts on top of Monte. Monte is becoming the primary tool for navigation operations, a core competency at JPL. The mission design capabilities in Monte are becoming mature enough for use in project proposals as well as post-phase A mission design. Monte has three distinct advantages over existing software. First, it is being developed in a modern paradigm: object- oriented C++ and Python. Second, the software has been developed as a toolkit, which allows users to customize their own applications and allows the development team to implement requirements quickly, efficiently, and with minimal bugs. Finally, the software is managed in accordance with the CMMI (Capability Maturity Model Integration), where it has been ap praised at maturity level 3.

Sunseri, Richard F.↗
DOE OSTI2020

Cybersecurity Vulnerability Mitigation Framework through Empirical Paradigm: Enhanced Prioritized Gap Analysis

Existing cybersecurity vulnerability assessment tools were designed based on the policies and standards defined by organizations such as the U.S. Department of Energy and the National Institute of Standards and Technology (NIST). Frameworks such as the cybersecurity capability maturity model (C2M2) and the NIST Cybersecurity Framework (CSF) are often used by the critical infrastructure owners and operators to determine the cybersecurity maturity of their facility. Although these frameworks are exceptional at performing qualitative cybersecurity analysis and identifying vulnerabilities, they do not provide a means to perform prioritized mitigation of those vulnerabilities in order to achieve a desired cybersecurity maturity. To address that challenge, we developed a framework and software application called the cybersecurity vulnerability mitigation framework through empirical paradigm (CyFEr). This paper presents the detailed architecture of CyFEr’s enhanced prioritized gap analysis (EPGA) methodology and its application to CSF. The efficacy of the presented framework is demonstrated by comparing against existing similar models and testing against the cyber injects from a real-world cyber-attack that targeted industrial control systems (ICS) in critical infrastructures.

Gourisetti, Sri Nikhil G.↗
DOE OSTI2021

Credibility Framework (CF) v.1.0

Credibility Framework provides tools such as PIRT (Phenomena Identification and Ranking Table) and PCMM (Predictive Capability Maturity Model) configurable by non-programmers through simple Excel spreadsheets for tailoring the credibility process to meet the needs of the analysis provider organizations, customers and regulatory agencies. Sandia National Laboratories is a multimission laboratory managed and operated by National Technology & Engineering Solutions of Sandia, LLC, a wholly owned subsidiary of Honeywell International Inc., for the U.S. Department of Energy’s National Nuclear Security Administration under contract DE-NA0003525. SAND2020-10230 M

Clay, RobertL.↗
DOE OSTI2020

Facility Cybersecurity Framework Best Practices

Federal facilities are increasingly adopting automation and connecting to the Internet creating an energy-internet-of-things environment that converges operational technology (OT) and information technology (IT). Today's buildings increasingly weave together networked sensors and cyber and physical systems that enable data to be collected, aggregated, exchanged, stored and monetized in new ways. Building technological advances have created new energy technology, services, markets and value creation opportunities (e.g. transactive energy, two-way grid communications, machine learning, and increased use of renewable and distributed energy resources). But as larger data sets are being exchanged at faster speeds between an increasing number of OT systems, it becomes more difficult to protect the security of the data lifecycle and the physical equipment it interacts with. These challenges are especially difficult to overcome because the economic and environmental gain (interoperability, big data, social networks and ubiquitous information sharing) are driving these prominent trends in the digital age. Often cybersecurity is an afterthought. The U.S. Department of Energy’s (DOE) Federal Energy Management Program (FEMP) funded the Pacific Northwest National Laboratory (PNNL) to develop various cybersecurity tools, trainings, and reports to aid federal facility managers – and other building owners and operators – in better applying frameworks and lessons learned from the National Institute of Standards and Technology (NIST) Cybersecurity Framework (CSF), risk management framework (RMF), DOE’s cybersecurity capability maturity model (C2M2), and a wide variety of industry best practices and guidance documents (i.e., NIST 800 series, Department of Defense United Facilities Criteria). This set of tools, collectively known as the FEMP Facility-Related Control System Cyber Toolkit (FRCS Cyber Toolkit)2, is focused on cybersecurity concerns from facility-related control systems and other operational technology (OT), such as industrial control systems (ICS). The FRCS Cyber Toolkit can be applied across six of the sixteen critical infrastructure sectors designated by the Department of Homeland Security, including government facilities, healthcare and public health, commercial facilities (e.g., public assembly, offices, lodging), financial services (e.g., banking and insurance), emergency services (e.g., fire and police stations), and information technology. With increasingly converged IT and OT systems, it is crucial to address OT cybersecurity considerations and assess how the seam of these two systems could impact the overall cybersecurity posture of a facility. The objective of this report is to provide an overview of the best possible method to use FRCS Cyber Toolkit (section 2.0) and distilled cybersecurity best practices for the federal facilities to address growing non-linear cyber threats (section 3.0). Recommendations in this document are aggregated from several NIST and other documents (see Appendix A for additional details).

97 MATHEMATICS AND COMPUTING↗