Maturity Models
Structured frameworks for progressively assessing and improving organizational capabilities, from CMMI to modern approaches like DORA and simplified models.
What is a maturity model
A maturity model is a framework that describes a progression of capabilities in a specific domain. It defines discrete levels representing increasingly sophisticated states, allowing an organization to locate itself on the scale and chart a path for improvement.
The fundamental premise: you can't improve what you can't measure, and you can't measure without a frame of reference.
Classic models
CMMI (Capability Maturity Model Integration)
Developed by Carnegie Mellon's SEI in the 90s, CMMI is the grandfather of maturity models. It defines 5 levels:
| Level | Name | Description |
|---|---|---|
| 1 | Initial | Unpredictable, reactive processes |
| 2 | Managed | Processes managed at the project level |
| 3 | Defined | Processes standardized at the organizational level |
| 4 | Quantitatively Managed | Processes measured and controlled |
| 5 | Optimizing | Continuous improvement based on data |
CMMI was revolutionary in its time. It introduced the idea that organizations mature predictably and that maturation can be accelerated with specific practices. But it has real problems:
- Heavy: Formal assessment (SCAMPI) requires months and certified consultants
- Rigid: The 5 levels are sequential — you can't be at level 4 without completing level 3
- Expensive: Formal certification costs tens of thousands of dollars
- Slow: The assessment-improvement-reassessment cycle takes years
ITIL Maturity Model
Similar to CMMI but focused on IT service management. Same 5-level scale, same complexity problems. Useful as a reference but rarely fully implemented outside large corporations.
Modern models
DORA (DevOps Research and Assessment)
DORA shifted the paradigm by focusing on outcome metrics rather than process practices. It defines 4 key metrics:
- Deployment Frequency: How often you deploy to production
- Lead Time for Changes: Time from commit to production
- Change Failure Rate: Percentage of deployments that cause failures
- Time to Restore Service: Time to recover from a failure
And classifies teams into 4 performance levels (Elite, High, Medium, Low) based on these metrics.
What DORA got right:
- Data-driven: Metrics are objective and automatically measurable
- Outcome-oriented: Measures what matters (speed + stability), not the process
- Statistically validated: Backed by years of research (Accelerate, State of DevOps Report)
What DORA doesn't cover:
- Only applies to software delivery — doesn't assess architecture, security, culture, or platform practices
- Metrics are team/organization-level, not individual practices
- Doesn't offer a prescriptive improvement path
Spotify Health Check
A lightweight model where teams assess their health across dimensions like speed, quality, fun, and learning using a traffic light system (green/yellow/red). Simple and effective for generating conversation, but subjective and hard to aggregate at the organizational level.
Team Topologies Maturity
Focused on team structure and interactions. Assesses whether teams are organized as stream-aligned, platform, enabling, or complicated-subsystem teams. Useful for evaluating organizational topology but not technical practices.
The complexity spectrum
From left to right: more precision, more cost, less frequency of use.
The sweet spot depends on context. For a 5-person team, Spotify Health Check is enough. For a 500-person organization that needs benchmarks across teams, something more structured is needed.
The case for simplicity
Most organizations don't need CMMI's granularity. What they need is:
- Know where they stand: A quick snapshot of the current state
- Know what to improve: Identify clear gaps
- Measure progress: Compare assessments over time
A 3-level system (Not Started / Partial / Complete) with explicit success criteria achieves this at a fraction of the cognitive cost. The question for each item reduces to: does it exist or not? Is it complete or not?
Simplification has a trade-off: you lose granularity in the intermediate levels. But in practice, the difference between a "3" and a "4" on a 5-point scale is where most unproductive discussions happen.
See AxiSight for a practical implementation of this simplified approach.
When to use each model
| Need | Recommended model |
|---|---|
| Quick team conversation | Spotify Health Check |
| Objective delivery metrics | DORA |
| Broad assessment with quick action | 3-level model (AxiSight) |
| Formal certification / compliance | CMMI |
| Organizational structure | Team Topologies |
References
- CMMI Institute — Official CMMI site, administered by ISACA. Originally developed at Carnegie Mellon University's Software Engineering Institute (SEI).
- DORA — Google Cloud's DevOps Research and Assessment program. The largest and longest-running research program on software delivery performance.
- Forsgren, N., Humble, J., & Kim, G. (2018). Accelerate: The Science of Lean Software and DevOps. IT Revolution Press. — The book presenting the research behind DORA metrics.
- Kniberg, H. & Lindwall, K. (2014). "Squad Health Check model – visualizing what to improve". Spotify Engineering Blog. — The original article introducing Spotify's Health Check model.
- Skelton, M. & Pais, M. (2019). Team Topologies: Organizing Business and Technology Teams for Fast Flow. IT Revolution Press. — The book defining the four fundamental team types and their interaction patterns.