What Is a Maturity Model?

The short answer

A maturity model is a structured way of describing how a capability develops over time, from informal and inconsistent to deliberate, embedded and continuously improving. It breaks a broad topic such as leadership, cybersecurity or customer experience into a set of areas. For each area it describes what different levels of maturity look like in practice.

By comparing what your organisation actually does today against those descriptions, you get two things: an honest picture of where you stand, and a clear view of what "better" looks like as the next step.

Why organisations use maturity models

Most improvement efforts fail for one of three reasons: nobody agrees on where things stand, nobody agrees on what good looks like, or effort is spread too thinly across too many priorities. A maturity model tackles all three.

• A shared baseline. People across a team often hold very different views of how well something works. A structured assessment replaces opinion with a common reference point.
• A concrete target. "Improve our risk management" is vague. "Move from identifying risks only after incidents to keeping a reviewed risk register with named owners" is something a team can act on.
• Prioritisation. Scores by area show where the biggest gaps are, so you can focus effort where it will make the most difference instead of trying to fix everything at once.
• Tracking progress. Re-running the same assessment every six or twelve months shows whether changes are really sticking.
• Better conversations. A good maturity model gives leaders, specialists and frontline staff a shared vocabulary for discussing capability without blame.

How maturity levels work

Every maturity model defines a series of levels. Traditional frameworks often use five. The models on MaturityModel.io deliberately use three, because three levels are easier to tell apart, quicker to assess and harder to game:

1. Level 1: the starting point. The capability depends on individuals and good intentions. Practices are informal, inconsistent or reactive, and results vary from person to person.
2. Level 2: structured and repeatable. Defined processes, clear ownership and regular routines are in place. The capability works reliably, though it may still be applied unevenly across the organisation.
3. Level 3: embedded and improving. The capability is part of how the organisation works. It is measured, refined and adapted as conditions change, and it holds up when key people leave.

Each model uses level names that suit its field. Change management, for example, moves from Ad-hoc to Structured to Embedded. AI security moves from Unguarded to Risk-Aware to Hardened. Field-specific names make the levels easier to recognise and discuss.

Level 3 is not "perfect" and it is not right for everything. For a small organisation or a low-risk area, a solid Level 2 is often exactly the right target. The point is to make a conscious choice.

What makes a good maturity assessment question

The quality of a maturity model comes down to its questions. Good questions:

• Describe observable behaviour, not aspirations. "Lessons from each project are recorded and reviewed before the next one starts" can be checked. "We value learning" cannot.
• Are specific enough to answer honestly. If a question could reasonably describe every organisation, it gives you no information.
• Have clearly different answer options. You should be able to tell which description matches your reality without agonising over wording.
• Focus on practice, not policy. Many organisations have excellent documents that nobody follows. Assess what actually happens.

How to read your results

On MaturityModel.io, each answer scores 1, 2 or 3. An area score is the average of the questions you answered in that area, and the overall score is the average of the area scores, so every area carries equal weight. All scores fall between 1.0 and 3.0.

A few tips for interpreting them:

• The shape matters more than the overall number. The radar chart shows whether you are evenly developed or strong in some areas and weak in others. Uneven profiles often explain recurring problems. For example, strong planning combined with weak follow-through.
• Scores between levels are normal. An area score of 1.75 usually means some practices are structured while others still depend on individuals. Look at the individual answers to see which.
• Low scores aren't failures. They show where you'll get the biggest gains. An honest 1.5 is far more useful than an optimistic 2.5.
• Focus on the next level, not the top level. Moving a single practice from Level 1 to Level 2 is achievable within a quarter. Trying to leap to Level 3 everywhere at once is how improvement programmes stall.

Running a team assessment

A maturity assessment completed by one person is a useful starting point. The real value comes from comparing perspectives. A simple approach that works well:

1. Pick three to eight people who see the capability from different angles: leaders, specialists, and people who live with the results day to day.
2. Ask everyone to complete the assessment independently and share their results link. On MaturityModel.io, answers are stored in the URL, so nobody needs an account.
3. Compare the results in a short workshop. Start with the questions where answers differ most. These gaps in perception are often more revealing than the scores themselves.
4. Agree a single honest answer for each question and record it in one shared assessment.
5. Choose two or three priorities. The Focus Areas panel suggests questions where moving up one level makes the biggest difference. Use it as a starting point, then apply your own judgement about value and effort.
6. Turn each priority into an action with an owner and a date, using the next-level description as the definition of done.
7. Re-assess in six to twelve months using the same model so you can see real movement.

Choosing the right maturity model

Start with the capability that's causing the most friction or carrying the most risk right now. If you're unsure, a broad model in that area is usually the best first step. For example, Enterprise Security before more specialist cybersecurity models, or Strategic Planning & Alignment before narrower governance topics.

MaturityModel.io has 74 models across 9 domains:

• Leadership & People: leadership, hiring, performance, wellbeing, change and knowledge
• Strategy & Governance: strategy, boards, ethics, finance, ESG and AI governance
• Operations & Delivery: transformation, processes, agile, resilience, projects, quality and supply chains
• Technology & Data: data governance, AI and MLOps, cloud and FinOps, software, reliability and accessibility
• Cybersecurity: from enterprise security and identity to vulnerability management, incident response, zero trust and OT
• Risk & Compliance: risk, audit, fraud, privacy, regulation, contracts and health & safety
• Customer & Growth: product management, customer experience, success and service, marketing, sales and brand
• Social & Community: social impact, nonprofits, education and healthcare
• Emerging & Specialist: green IT, data monetisation and M&A integration

Maturity models vs. frameworks and standards

Maturity models are often confused with standards and compliance frameworks, but they do different jobs. A standard or framework defines what should be in place, often as a list of requirements or controls, and may lead to certification. A maturity model describes how well a capability works and how it evolves, so it's better suited to self-improvement than to proving compliance.

The two work well together. Many organisations use a maturity assessment to find their biggest gaps, then turn to the relevant standard for detailed guidance on closing them. Each model on this site lists related industry frameworks for exactly that purpose. Read more about how our models are built.

Common pitfalls to avoid

• Scoring aspirations. Answer for what happens today, across the organisation, not what happens in your best team or what the policy says.
• Treating the score as the goal. The goal is better outcomes. A higher score is just evidence that you're getting there.
• Assessing too much at once. One model, done well and acted on, beats five models completed and forgotten.
• Doing it once. A single assessment is a snapshot. Improvement only becomes visible when you measure again.

Get started

Pick a model from the homepage and answer the questions honestly. It takes 10–15 minutes, it's free, and no registration is needed. Your answers never leave your browser.