At maturity level 3, acquirers use defined processes for managing projects and suppliers. They embed tenets of project management and acquisition best practices, such as integrated project management and acquisition technical management, into the standard process set. The acquirer verifies that selected work products meet their requirements and validates products and services to ensure they fulfill their intended use in the intended environment. These processes are well characterized and understood and are described in standards, procedures, tools, and methods.

The organization’s set of standard processes, which is the basis for maturity level 3, is established and improved over time. These standard processes are used to establish consistency across the organization. Projects establish their defined processes by tailoring the organization’s set of standard processes according to tailoring guidelines. (See the glossary for a definition of “organization’s set of standard processes.”)

A critical distinction between maturity levels 2 and 3 is the scope of standards, process descriptions, and procedures. At maturity level 2, the standards, process descriptions, and procedures may be quite different in each specific instance of the process (e.g., on a particular project). At maturity level 3, the standards, process descriptions, and procedures for a project are tailored from the organization’s set of standard processes to suit a particular project or organizational unit and therefore are more consistent except for the differences allowed by the tailoring guidelines.

Another critical distinction is that at maturity level 3, processes are typically described more rigorously than at maturity level 2. A defined process clearly states the purpose, inputs, entry criteria, activities, roles, measures, verification steps, outputs, and exit criteria. At maturity level 3, processes are managed more proactively using an understanding of the interrelationships of process activities and detailed measures of the process, its work products, and its services.

At maturity level 3, the organization must further mature the maturity level 2 process areas. Generic practices associated with generic goal 3 that were not addressed at maturity level 2 are applied to achieve maturity level 3.

Due to the acquirer-supplier relationship, the need for early and aggressive detection of risk is compounded by the complexity of projects acquiring products and services. The purpose of risk management is to identify and assess project risks during project planning and manage these risks throughout the project.