CM2 (configuration management)

CM2 is a proprietary methodology for enterprise change and configuration management. It was developed by the Institute of Configuration Management, which became the Institute for Process Excellence (IpX), and it was originally called CMII (Configuration Management II). It covers how an organization identifies configuration items, controls changes, manages baselines and keeps traceability across the product or system life cycle. The name is also used for a professional certification stream promoted by IpX and training organizations such as CMPIC.

CM2 is not a NATO standard and it is not a Government of Canada standard. Canadian defence policy and NATO publications use the general term "configuration management" and point to instruments such as STANAG 4427, ACMP-2100, ISO 10007 and SAE EIA-649. CM2 sits alongside those instruments as a method and credential that helps an organization carry them out. It is not a named contractual requirement in Canadian solicitations.

What the CM2 framework contains: CM2-500 and CM2-600

The CM2 framework is formalized in two proprietary standards. CM2-500 is the process foundation. It is organized around 19 core business process categories and links configuration management to requirements, design, production, service and support. Its baselines are kept in an as-planned and as-released form, so a team can see the current configuration and the planned changes with their effectivities.

CM2-600 is aimed at tool developers. It sets out the capabilities that enterprise software, such as product lifecycle management, enterprise resource planning and manufacturing execution systems, needs in order to support the CM2-500 processes. IpX presents CM2 as a framework for the digital thread, meaning connected and trustworthy product data across the life cycle.

How CM2 relates to EIA-649 and ISO 10007

SAE EIA-649 is principle-based. It defines five functions: planning and management, identification, change management, status accounting, and verification and audit. It deliberately leaves methods and tools to the user. CM2 goes further into detailed processes and procedures, so it is more prescriptive. IpX publishes a white paper arguing that CM2 satisfies the requirements of EIA-649. ISO 10007 is the guidance standard that NATO's ACMP-2100 builds on. A supplier can align a CM2-based internal system with ISO 10007 and EIA-649 to meet the obligations those documents create.

What Canadian defence policy and NATO publications require

The Department of National Defence governs configuration management through DAOD 3034-0, Configuration Management for Defence Systems. A French version is also published. The directive aligns DND and the Canadian Armed Forces with NATO STANAG 4427 and EIA-649-B. It requires them to:

• determine whether the Crown needs technical data for configuration management
• designate configuration items
• establish a configuration management plan during the definition phase of acquisition
• enforce that plan through later life-cycle stages, including disposal
• archive configuration management records on disposal

For NATO work, ACMP-2100 sets contractual configuration management requirements. It applies only when a contract names it. Chapter 4 requires a supplier's system to follow ISO 10007. Chapter 5 adds NATO-specific rules, including flowing requirements down to sub-suppliers, giving the acquirer access to the configuration management plan, and keeping product configuration information for each item. Under its change-control rules, a supplier that implements a change before approval carries that risk alone. Where the contract and ACMP-2100 disagree, the contract prevails.

CM2 certification and training

CM2 certification is offered by IpX and CMPIC and is built into academic programmes such as the CM2-CORE certification at Fort Hays State University. A six-course CM2-C series teaches the methodology and its closed-loop change process. CM2 credentials appear in NATO-related job requirements for configuration management expertise, including at the NATO Communications and Information Agency. In those settings CM2 signals advanced competence and is not a standalone NATO requirement.

What CM2 means for a supplier bidding on Canadian public contracts

Do not expect a Canadian solicitation to require CM2 by name. Expect requirements drawn from DAOD 3034-0, STANAG 4427, ACMP-2100 or ISO 10007. Your bid should show a documented configuration management plan, designated configuration items, controlled change records and a clear configuration management organization. If your team already uses CM2 or holds CM2 certifications, map that practice to the standard the contract names and cite the credentials as evidence of capability. Read the clauses in each solicitation to see which configuration management standard applies and whether it is passed down to your sub-suppliers.