Skip to content
Strategic
Concierge
Book a discovery callBook a call
← Back to Insights

Capability Maturity Model: Levels, Assessment and Gap Analysis

Stepped planes showing a capability maturity gap

A capability maturity model is a structured set of capabilities and maturity levels against which an organisation is assessed, so you can see how reliably it does something today and what it would take to do it better. It started in software, but the logic applies to any repeatable work: sales, delivery, recruitment, governance, data. This guide explains where the model came from, what the five levels mean, how CMM differs from CMMI, and how to run an assessment and gap analysis that ends in action rather than a rating.

Strategic-concierge
Turn Capability Gaps Into Growth
Strategic Concierge helps businesses build, improve and embed the capabilities they need to strengthen execution and support long-term growth.
Explore Strategic Concierge

TL;DR

  • A capability maturity model scores how repeatable and well managed your processes are, usually on five levels from ad hoc to optimised.
  • The original CMM was built for software at Carnegie Mellon’s Software Engineering Institute. CMMI replaced it and is now administered by the CMMI Institute.
  • An assessment is a snapshot. Its value is the list of gaps, priorities and owners it produces, not the number.
  • Small and mid-sized firms rarely need a formal appraisal. A light, evidence-based assessment of three to five capabilities is usually enough.
  • Pick one capability tied to a real business decision, assess it honestly, close the biggest gap, then reassess.

Table of Contents

What a capability maturity model is

Strip away the vocabulary and a capability maturity model does two things. It lists the capabilities that matter in a given area, and it describes what each one looks like at increasing levels of reliability. You then compare your organisation against that description.

The UK Ministry of Defence describes the purpose in practical terms: a maturity model is used with an assessment to capture current maturity, understand how effectively change is embedded and identify priority actions and resources. The Office of Rail and Road (ORR) puts the underlying idea simply. Its capability maturity framework assesses how deterministic and repeatable processes are, because a process that is neither written down nor followed cannot be improved reliably.

That last point is the heart of it. Maturity is not about size or sophistication. A five-person firm can have a mature proposal process if everyone follows the same steps and learns from the outcomes. A 500-person firm can have an immature one if every bid is improvised.

The ORR also makes a useful allowance: repeatability does not mean rigidity. Processes can vary by circumstance as long as people can determine which process and actions apply to the situation in front of them.

What a capability maturity model is — overview diagram

Where the model came from: CMM and CMMI

The original Capability Maturity Model was developed to help the US Department of Defense judge software contractors. Watts Humphrey began formalising his process maturity framework at the Software Engineering Institute (SEI) at Carnegie Mellon University in Pittsburgh after joining in 1986, at the request of the US Air Force. The framework was described in his 1989 book Managing the Software Process, and the model itself was published as an article in 1993 and a book in 1994.

The SEI later built Capability Maturity Model Integration (CMMI) to combine several overlapping models into one framework, and CMMI largely superseded the original CMM. It is now administered by the CMMI Institute, a subsidiary of ISACA, and version 3.0 was released in April 2023.

The practical differences:

Original CMM CMMI
Scope Software development Development, services, suppliers and other areas
Structure One staged model Staged and continuous representations in earlier versions
Use today Largely historical Current, with appraisals and certifications
Typical user Government software contractors Technology firms, public bodies, service providers

Most people searching for the capability maturity model today want the general idea of staged maturity, not the formal CMMI appraisal. The rest of this guide treats the model as a general-purpose tool and flags where CMMI’s specifics matter.

The five maturity levels

There is no single universal scale, but the five-level pattern is the one most readers mean. CMMI’s staged representation uses five maturity levels: Initial, Managed, Defined, Quantitatively Managed and Optimizing. In plain business terms:

  1. Initial. Work gets done, but through individual effort. Results depend on who is doing it and how busy they are.
  2. Managed. Basic practices are planned and tracked on a project or team basis. You can repeat success within a team, but not necessarily across the firm.
  3. Defined. There is an organisation-wide standard process, and teams adapt it rather than inventing their own.
  4. Quantitatively managed. Performance is measured with data, and you know what normal looks like and when you are outside it.
  5. Optimising. You use that data deliberately to improve the process itself.

Non-software frameworks use the same shape with different labels. The ORR’s capability framework, for example, runs from Level 0 to Level 5. Level 0 shows no good practice, Level 1 has isolated good practice, Level 2 formalises repeatable practice inconsistently, Level 3 has an organisational process that is followed, Level 4 measures effectiveness and efficiency quantitatively, and Level 5 uses management information to optimise performance.

Capability levels versus maturity levels

This is where searchers often get confused. In CMMI, capability levels and maturity levels are different measures. Capability levels apply to individual practice areas, while maturity levels represent a staged path based on predefined sets of practice areas. In the older continuous representation, capability levels run from 0 Incomplete to 5 Optimizing for a single process area.

For a business, the distinction has a useful reading. You can be strong in one capability and weak in another, and a single organisation-wide score hides that. If you run a founder-led professional services firm, your delivery might sit at Defined while your business development sits at Initial. Averaging them produces a number that describes neither.

When a maturity model helps, and when it does not

Maturity models have critics, and the criticism is fair. A model can reward documentation over results. A firm can produce impressive process manuals and still deliver inconsistently. Higher is not always better either: a three-person consultancy does not need statistical process control on its invoicing.

The model earns its place when:

  • results vary more than they should between people, clients or months;
  • growth is exposing processes that only worked while the founder did everything;
  • you need a shared language to agree priorities across a leadership team;
  • a client, regulator or funder expects evidence of control.

It is a poor fit when the real problem is strategy, such as an unclear market or an offer nobody wants. Process maturity cannot rescue a weak proposition. That is why we start with direction before capability.

How to run a capability maturity assessment

An assessment does not need to be a certification exercise. The government guidance available in the UK shows a consistent pattern that scales down well to a smaller organisation.

1. Define the scope

GOV.UK’s digital capability model tells assessors to define scope, contributors and included assets, then map capabilities in a hierarchy. For a smaller firm, translate this into: which part of the business, which people, which tools and records.

A workable first scope is three to five capabilities, for example lead generation, proposal and pricing, client onboarding, delivery, and account growth.

2. Choose or build the framework

Frameworks differ, but good ones share traits. GOV.UK’s quality assurance maturity model says criteria should be observable in practice, backed by evidence, adaptable to organisational context and supported by benchmark measures to improve objectivity. Use that as your test. If a criterion cannot be checked by looking at real work, rewrite it.

GOV.UK’s digital and data continuous improvement framework organises assessment into themes, practice areas and assessment criteria, with indicative levels from Developing through Good and Better to Best. That three-tier structure is a good template for your own: a few themes, a handful of practices under each, and plain criteria for every level.

If technology is among your capabilities, you will also want clear domains. GOV.UK’s Digital Technology Capability Model uses nine Level 1 domains, including data and information management, artificial intelligence, DevOps, governance and standards, and security. For the AI part specifically, practical guidance on AI model governance shows what a mature control environment needs to cover.

3. Rate each capability on a few dimensions

The GOV.UK model rates capability for coverage, quality, alignment, efficiency and risk. Those five are a sensible default for any business capability. Keep the scale short and write what each score means before anyone is scored.

4. Gather evidence two ways

The Ministry of Defence guide recommends deciding whether to measure internal perceived maturity, external neutral maturity or both, and using questionnaires for large groups and structured interviews where detailed commentary is needed.

In a small firm, that translates to a short team survey plus conversations with the two or three people closest to each capability. Then check what they say against artefacts: the last five proposals, the onboarding checklist, the pipeline report. Where perception and evidence disagree, you have found something worth investigating.

The ORR’s 2024 assessment of capital investment capability followed the same logic at national scale, with self-assessment against 18 framework capabilities, evidence requests, desk-based review and interviews. Self-assessment alone flatters; evidence and interviews correct it.

5. Score, then stop and look at the pattern

Resist the urge to produce one overall figure. Plot each capability separately. The pattern, with one strong area, two middling and one weak, tells you far more than an average.

Capability gap analysis: turning scores into priorities

A rating describes where you are. A gap analysis decides what to do about it. The approach set out in a UK academic paper on planning systems engineering capability is general enough to borrow: compare target and current capability, consider timescale, cost, resource constraints and expected business gain, then prioritise gaps and improvement programmes.

In practice, a simple table does the job:

Capability Current level Target level Gap Cost and effort Business gain Priority
Proposal and pricing 1 3 2 Medium High 1
Client onboarding 2 3 1 Low Medium 2
Account growth 1 2 1 Medium Medium 3
Reporting 2 2 0 None None Hold

This is an illustration of the method, not data from a real firm. Note that the biggest gap is not automatically the first priority. Cost, effort and expected gain decide the order, and a target level should be set by what the business needs, not by the top of the scale.

The same paper recommends defining metrics when prioritising improvement programmes and collecting them during rollout, so you can assess impact and inform the next iteration. Decide before you start what a better result looks like: fewer proposals lost on price, shorter time to first value, fewer escalations.

If you are deciding which gap deserves attention first, our guide to choosing what to build next covers sequencing commercial work, and capability mapping built around one decision shows how to anchor the exercise in a decision you actually face.

Capability gap analysis: turning scores into priorities — overview diagram

Making repeatability real

Most firms stall between Levels 1 and 3, and the reason is usually mundane: the process exists in someone’s head, or it is documented but not used. Moving up means writing the steps down, agreeing them, and then using them on live work.

This is also where tooling matters. A process you cannot see running is hard to improve. A staged rollout, such as a short pilot followed by checkpoints, makes the change stick; a software rollout plan with a pilot and 30, 60 and 90 day checkpoints is a reasonable pattern to adapt. Two other methods help find where repeatability breaks down: service value stream mapping exposes the hidden waits between steps, and an after action review feeds real lessons back into the process after each piece of work.

Accountability matters just as much as documentation. A defined process with no owner decays. Our guide on building an accountability framework that works explains how to assign ownership so the standard is actually followed.

Using the result to improve, not just to score

The risk with any maturity assessment is that the rating becomes the goal. Two official UK sources push against that.

The Ministry of Defence’s view is that assessments are snapshots. Their value lies in revealing perceived challenges, resource priorities and critical actions for embedding change, and it advises identifying achievable actions and discussing them with prospective owners. GOV.UK’s digital framework likewise treats maturity as a diagnostic tool for understanding performance and deciding where further improvement is needed, rather than a label.

A good follow-up has four parts:

  • One owner per action. Named, agreed with them, not assigned in their absence.
  • A short list. Three to five actions for the next quarter, not twenty.
  • A measure for each. What will be different, and how you will see it.
  • A reassessment date. Reassess the same capabilities with the same criteria so you can see movement.

Our perspective

We use maturity thinking, but we are wary of treating it as a destination. Most small and mid-sized businesses and founder-led firms do not have a maturity problem in the abstract. They have one or two capabilities holding back growth, and they have not yet agreed which.

So we begin with direction: what the business is trying to achieve and which decision matters most. Only then do we assess the capability behind that decision. A launch-ready foundation in a month beats a comprehensive assessment that takes a quarter and changes nothing. After that, the work is iterative: improve execution, optimise using real measures, embed the practice so it survives staff changes, and then grow from a stronger base.

The common failure we see is a firm that documents a process and calls it mature. Maturity is when the process is followed, measured and improved without the founder chasing it. That is the standard we hold our own work to.

— Chris

How Strategic Concierge can help

Our staged approach runs through Build, Iterate, Optimise, Embed and Grow. It starts with a launch-ready foundation and develops toward ongoing managed capability, so the assessment, the gap priorities and the improvement work sit in one engagement. Managed Capability is priced on our pricing page at £999 per month, £2,850 per quarter or £10,000 per year. You can see how the stages fit together on our method page.

Strategic-concierge

If you would rather talk through which capability to assess first, book a discovery call and we will help you scope it.

FAQ

Who developed the capability maturity model?

Watts Humphrey developed the underlying process maturity framework, first at IBM and then at the Software Engineering Institute at Carnegie Mellon University, which he joined in 1986. The SEI published the model formally in the early 1990s, and CMMI later superseded it.

What is the difference between CMM and CMMI?

CMM was a software-focused model. CMMI integrated several models into one framework covering more areas, and it is now administered by the CMMI Institute. CMMI also distinguishes capability levels for individual practice areas from maturity levels for a whole organisation.

What are the five levels of a maturity model?

In CMMI’s staged form they are Initial, Managed, Defined, Quantitatively Managed and Optimizing. Other frameworks use different labels but the same progression, from ad hoc work to measured, continuously improved processes.

Do I need CMMI certification?

Only if a client, contract or sector requires it. For most small and mid-sized businesses, a lighter internal assessment against clear, evidence-based criteria gives the same improvement insight at a fraction of the effort. Check the CMMI Institute’s current appraisal requirements if a customer asks for it.

Sources

← Back to Insights