A staff member must log the purpose of the capability using verifiable terms and identify the individual accountable for it before scoring. Omitting that step means every subsequent level assigned is a subjective assessment: it survives the meeting and collapses the first time a board member wants to know who owns the control.
Technical capability maturity is the demonstrated, repeatable ability of an organisation to produce a defined technical outcome, backed by records that already existed before anybody started assessing. A maturity model supplies the terms for explaining that ability. It does not supply the ability, and it is unable to manufacture evidence. That distinction is why the order of work matters more than the choice of framework.
Three words that get used as one
Splunk's explainer on maturity models separates them. Process capability is the range of outcomes a process can reasonably be expected to produce. Process performance is the outcome it actually produced. Maturity is the potential to improve from where the organisation stands. Ask a team about capability and you will get a plan. Ask about performance and you will get a report. Asking about maturity with a poorly framed question will yield a value that lacks meaning.
Everything below assumes you want the plan.
1. Repair the limit and the owner
Make a single phrase stating the capability, the organisational limit it covers, and the accountable officer. For example: identity and access management across the UK retail estate, owned by the head of IT operations. Security, on its own, is not a limit.
The scope is set when a colleague from another department can say what it covers and who owns it, without asking you. If they are unable, cease. A score assigned now measures the ambiguity surrounding the capability.
2. Prepare the evidence guidelines before gathering evidence.
List the evidence required for every level you seek. For identity, an ownership matrix, completed access reviews and leaver records. For data, retention rules, quality measures and an example of a report that changed a decision. For service, a request log, an escalation path and proof that the path was followed.
KPMG's Technology Capability Maturity Assessment listing on the Digital Marketplace explains the same discipline from the supplier side: each area of capability is underpinned by predefined maturity statements, and the assessor compares collected evidence against them to determine the appropriate level. The statements come first. The evidence is tested against those statements.
Each evidence requirement defines a document, a database or an observable behaviour, plus a staff member who can produce it on request. Data that fails to identify a file is an opinion. Rewrite it or drop it.
3. Gather evidence from the people who run the work
Interview operators, not only managers. Pull configuration records, completed access reviews, backup test results, incident logs and adoption data. Compare what leadership believes happens with what the people doing the work describe.
The same KPMG listing is candid about the constraint. Outputs depend on the availability of client data and personnel, and delivery depends on the capacity of client personnel. An assessment scheduled against a quarter-end close will collect thinner evidence than one scheduled around it.
At least two independent sources agree for each capability. Mark the capability as unproven where they disagree. Do not reconcile the disagreement in the workshop. That is how optimistic scores are manufactured.
4. Score only what was demonstrated
Assign a level to each capability separately. Use published definitions as the terms. GRC Solutions sets out both the original software levels and the levels of the Capability Maturity Model Integration recorded by Carnegie Mellon, which is what most people mean when they say CMMI today.
Each level includes a reference to a particular bit of proof collected in step three. A capability with no citation is recorded as unproven. Unproven is a separate category from the lowest level, and it must not be silently rounded down to it.
5. Convert gaps into a backlog with owners and measures
Each gap becomes a line with a capability name, the evidence that exists today, the behaviour you want, the action that gets you there, the business measure that will show progress, and an owner outside the assessment team. Rank each item by operational, security and customer risk.
Each line has a defined owner and a metric that an existing report will produce without manual assembly. If the measure needs a new dashboard before it can exist, the line is not ready.
6. Schedule the reassessment before the work starts
Set the day and the proof you will re-request at that day. CyberOne's 2026 framework guidance recommends an annual cycle, with extra assessments triggered by a merger, a cloud migration or a significant infrastructure change. The logic remains true regardless of which model you use: an assessment is a snapshot, and controls decay after it.
The second assessment repeats steps three and four against the same evidence rules, and you can show two dated sets side by side. If only one set exists, you have a baseline and a story.
Four ways an assessment gets run, and what each one delivers
- Self-assessment by the leadership team: It is quick and inexpensive, and it produces a value quickly; the evidence behind that value is recollection, and memory tends to round upward.
- Wholesale adoption of an external framework: The CMMI provides a shared set of terms and comparability with other organisations, and imports scope, cost and terminology that a small firm may not need; UK companies that considered the original model in the late 1990s mostly rejected it, citing limited engineering culture, weak short-term business gains and the sense that it was being imposed on them, as F1Group's practical guide reports.
- Evidence-led internal review: shows the work as people actually perform it, and it costs operator time and requires an owner willing to hear the answer.
- Appraisal by an external assessor: This framework gives a defensible outside view and a route to comparison across organisations; it operates on the client's calendar and data, so the schedule is a real constraint.
What an appraisal does not certify
CMMI does not certify an organisation. It can be appraised, according to GRC Solutions, and the distinction is not pedantry. The traditional route establishes an engineering process group and process action teams, trains them in the model, conducts an informal appraisal, and then prioritises the process areas for improvement. There are also two representations to choose between. CMMI offers a staged representation, with the familiar ladder of levels, and a continuous one where each process area has its own level. The original CMM offered only the staged form.
The practical result is that the output shows current practice. It is not a badge. A buyer who requests a CMMI certificate seeks a document that does not exist, and a supplier who offers one refers to a different matter.
Where the level and the technology purchase come apart
The Heriot-Watt research portal records that Inan's comparative analysis of leading maturity models, alongside a capability maturity assessment tool applied in manufacturing SMEs in the United Kingdom, concludes that investing in new technology without addressing integration difficulties, insufficient technical skills, data governance and cybersecurity, the pace of technological advancement, and employee resistance impedes success and results in underutilisation and ineffective deployment.
The level you assign shows the capability you have demonstrated. The technology you buy supplies a possibility. The work between them is the capability build, and no maturity model performs it for you.
Sources
- Capability Maturity Models for Digital Transformation and Sustainable Competitiveness in Small and Medium-sized Enterprises
- Capability Maturity Model: A Practical Guide for UK SMEs
- Capability Maturity Model - GRC Solutions
- Technology Capability Maturity Assessment - Digital Marketplace
- Maturity Models for IT & Technology - Splunk
- Cyber Maturity Assessment Frameworks: Strategic Guidance for UK Organisations in 2026
