Capability Maturity Model (CMM)

A Capability Maturity Model is a framework for assessing and improving an organization's processes and practices in a specific domain.

Originally developed by Carnegie Mellon University for software development, CMMs have been adapted for cybersecurity to help organizations evaluate their security posture and systematically enhance their capabilities.

The model typically consists of five maturity levels: Initial (ad hoc processes), Repeatable (basic project management), Defined (standardized processes), Managed (quantitatively controlled), and Optimizing (continuous improvement). Each level represents increasing sophistication in how an organization manages its processes, with higher levels indicating more predictable, controlled, and effective operations.

In cybersecurity contexts, CMMs help organizations identify gaps in their security programs, establish benchmarks against industry standards, and create roadmaps for improvement. They provide structured approaches to advancing from reactive, inconsistent security practices to proactive, data-driven security operations. Organizations use these models to prioritize investments, measure progress, and demonstrate security maturity to stakeholders, regulators, or customers.

While valuable for strategic planning and organizational development, CMMs require significant commitment and resources to implement effectively, and organizations must carefully adapt generic models to their specific operational contexts and risk environments.