Capability Maturity Model
Definition
Capability Maturity Model
A capability maturity model rates how consistently and repeatably a business performs a set of processes, usually on a five-level scale from unpredictable to continuously improving. It scores behaviour, not ability — how reliably work gets done, not what you can do.
The confusion worth avoiding is with a business capability model, which names what an organisation can do. This scores how reliably it does those things, and the two answer completely different questions.
Levels describe consistency rather than quality. An organisation can perform a badly designed process at level four with admirable repeatability, and the model will say so without complaint.
The scale is also cumulative. Level three is not an alternative to level two; every practice from the lower level has to be in place before the higher one can be claimed honestly.
The model says nothing about whether the process is worth performing at all. An organisation can reach level four running a process that should have been deleted — and the appraisal will pass it.
Key takeaways
- Levels measure consistency and repeatability, not the quality of the process design.
- A capability model names what you can do; this rates how reliably you do it.
- Levels are cumulative, so lower-level practices must remain in place.
- Certification scope matters, because maturity is assessed per unit and per process.
How it works
The five levels run from initial, where results depend on individual effort, through managed, defined, quantitatively managed, and optimising, where measured data drives deliberate change to the process itself.
Assessment is evidence-based. An appraiser looks for artefacts, interviews practitioners and tests whether the documented practice matches what people actually do, which is where most claimed levels come apart.
Appraisals cost money and attention. A formal assessment typically absorbs several weeks of senior practitioner time, a real cost that the client demanding it rarely sees.
Outsourcing transitions are where levels quietly drop. Practices that lived in individual habits leave with the people, and the documented process turns out to have been a description rather than an instruction.
The lineage is well documented. The Software Engineering Institute records that its publication of the Capability Maturity Model for Software in 1991 “changed the view in government and industry about software quality”.
| Level | Characteristic | Typical evidence |
|---|---|---|
| 1 Initial | Results depend on individuals | None required |
| 2 Managed | Planned and tracked per project | Plans, tracking records |
| 3 Defined | Standard process used across the unit | Tailoring guidance, training |
| 4 Quantitative | Performance controlled by measurement | Statistical control data |
| 5 Optimising | Measured data drives process change | Improvement case records |
Governments run their own equivalents. The UK’s functional standard for commercial includes a framework that lets a body “assess your organisation’s commercial maturity” against defined criteria.
Examples
Maturity assessments are usually triggered by an external demand rather than by internal curiosity, and that shapes the result. The three cases below show the usual reasons for one.
A provider is assessed because a client’s tender requires it. The result is genuine, but the service level agreement compliance record mattered more to the buyer in the end.
A software business uses a process improvement analyst to close level-three gaps. Documentation improves, and so does the handover between teams.
A manufacturer measures cost of poor quality before and after. The figure falls as consistency rises, which is the clearest evidence a level change was real.
Related terms
Maturity models come in domain-specific variants and sit alongside several other assessment tools that answer different questions. The entries below are neighbours rather than substitutes for this one.
- AI maturity model: the same ladder applied to artificial intelligence practice.
- AI readiness assessment: a point-in-time check, not a graded scale.
- Benchmarking business: comparison against others, where maturity is absolute.
- Scalability: what higher maturity tends to make possible.
FAQ
Is a higher level always better?
Not for every unit. Reaching level four costs real money in measurement infrastructure, and a small team running stable work may get nothing back from it.
How long does it take to move up a level?
Twelve to twenty-four months for a genuine move. Faster claims usually reflect documentation written for an appraisal rather than practice that changed.
How is this different from a business capability model?
A capability model is a taxonomy of what the organisation can do. This is a rating scale for how consistently it does it, applied to processes rather than abilities.
Does certification apply to a whole company?
No. Appraisals cover a defined scope, so a supplier claiming a level should be asked which unit and which processes were actually assessed.
Can maturity fall?
Yes, and it often does after a reorganisation or an outsourcing transition. Maturity lives in habits — and habits do not survive staff turnover automatically.
Does it apply outside software?
Widely. Variants exist for acquisition, services, people management and commercial practice, all using the same cumulative five-level structure.
Explore more process and quality guidance at Outsource Accelerator.
Independent
