Maturity assessment framework
Definition
Maturity assessment framework
Maturity assessment framework is a scoring instrument for capability: a set of defined levels, the evidence each level demands, and rules for who scores and how often. It measures what a team can reliably do, not what it achieved last quarter.
The instrument is generic. A marketing capability model is one domain’s instance of it, filled with marketing practices, while the framework is the ladder, the evidence rules and the scoring method any domain can borrow.
It is also not benchmarking. Benchmarking compares you with other organisations; a maturity assessment compares you with a written ladder, so you can score poorly while still leading your sector.
Key takeaways
- Levels are defined in advance, usually four or five, each naming the practices it requires.
- Evidence rules decide what counts as proof that a practice is actually in place.
- Scoring rules name the assessor, settle disputes and set how often the assessment repeats.
- The output is a gap list with owners and dates, not a single number to celebrate.
How it works
A framework sets out levels, the practices each level requires, and the evidence an assessor must see before awarding it. You score where you are today, agree a target level, then work the gap as a list of changes with owners.
| Level | What it means | Evidence an assessor looks for |
|---|---|---|
| 1 Initial | Work gets done, outcomes depend on individuals | Little written down |
| 2 Managed | Practices exist in parts of the business | Local procedures, some records |
| 3 Defined | One standard practice across the business | Published standard, training records |
| 4 Measured | Performance is tracked against that standard | Metrics with a baseline and a trend |
| 5 Optimising | The standard itself improves on a cycle | Review records and the changes they caused |
Real instruments look exactly like this. The Department of Energy (DOE) publishes the Cybersecurity Capability Maturity Model (C2M2), a free self assessment built with input from more than 250 energy sector experts at around 100 organisations.
Version 2.1 arrived in June 2022. The model is designed so an organisation can finish a self evaluation in a single day — its tool produces dashboards that present a view of maturity and support comparison over time.
Maturity scoring is not only about teams. The Government Accountability Office (GAO) guide to technology readiness assessments warns that technologies not adequately mature have led to delays and cost increases.
That 2020 guide also sets four marks of a high quality assessment: credibility, objectivity, reliability and usefulness. Those four words are a decent audit of any scoring exercise, whatever the subject being scored.
Capability maturity model is the best known ancestor of this shape. It was written for software engineering and then copied into dozens of other fields, which is how the five level ladder became a default.
Decide what you are scoring before you score it. A business capability map lists what the organisation must be able to do, and the assessment puts a level against each line on that list.
Narrow instruments apply the same shape to one question. An AI readiness assessment scores whether data, skills and governance can carry an automation program.
A change readiness assessment is narrower still — it scores appetite and capacity for one specific change, where a maturity framework scores standing capability that outlives any single program.
Scoring works best when a level is all or nothing. Partial credit turns the ladder into an opinion poll — either the evidence for every practice at that level exists, or you sit on the level below.
Repeat the assessment with the same rules or you end up measuring the assessor. Changing the evidence bar between rounds produces movement nobody can explain — and a score nobody trusts.
Examples
Named frameworks are easier to judge than generic ones, because you can read the levels and the evidence rules yourself. Three public instruments below are free to download, and each shows a different answer to the question of who does the scoring.
Energy companies score cybersecurity with C2M2. It works in both information technology and operational technology settings, aligns with the national cybersecurity framework, and keeps all self assessment data on the user’s own devices.
Federal programs score technology, not teams. A technology readiness assessment judges whether a component is developed enough to be built into a larger system, and oversight bodies use the same guide to check that the assessment itself was done properly.
Outsourcing buyers run a lighter version on providers. A shortlist review scores each candidate on delivery, security, reporting and attrition against a written ladder, which stops a polished presentation outscoring a documented practice.
Shared services teams use it internally. Finance, procurement and human resources each get a level, and the board funds the two lowest rather than the one that complains loudest.
Level 5 is rarely the right target. Most organisations should aim at level 3 across the board rather than level 5 in one corner, because an advanced island surrounded by level 1 practice tends to fall over.
Related terms
- Capability maturity model: the named ancestor model; this page is the instrument class it belongs to.
- Benchmarking: compares you with other organisations rather than with a defined ladder.
- Change readiness assessment: scores appetite for one change, not standing capability.
- Benchmarking business: the comparison practice applied to processes and partners across a market.
- Business operating model: describes how the organisation runs; the assessment scores how well it runs.
FAQ
How many levels should a maturity assessment framework have?
Four or five is normal, and more than six makes the gaps between levels too small to argue about. What matters is that each level names practices and evidence rather than adjectives.
Who should do the scoring?
Someone independent of the team being scored, working from evidence rather than interviews alone. Self assessment is useful for direction but weak for comparison, because optimism is not evenly distributed.
How is it different from benchmarking?
Benchmarking answers how you compare with others. A maturity assessment answers how you compare with a defined standard, which is the more useful question when your sector is weak overall.
How often should you reassess?
Annually for a standing capability, or at the end of a program that was meant to move a level. Reassessing too often produces movement that reflects scoring drift rather than real change.
Is a maturity assessment framework the same as a capability model?
Close, but not identical. A capability model lists what you must be able to do; the framework adds the levels, the evidence and the scoring rules.
Compare delivery partners in the Outsource Accelerator hubs once you know your gaps.
Independent
