◇ OpenCyber Academy
Bachelor's · Chapter 30 · English

Chapter 30 — Maturity assessment

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 30 — Maturity assessment

Lesson map

Lesson 30 published. Map, example, EX088.

flowchart TD
  N0["Learning outcomes"]
  N1["30.1 Maturity models"]
  N2["30.2 Gathering evidence"]
  N3["30.3 Targets"]
  N4["30.4 Repeating the assessment"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX088"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["30.1 Maturity models"]
  N2["30.2 Gathering evidence"]
  N3["30.3 Targets"]
  N4["30.4 Repeating the assessment"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX088"]
[Learning outcomes]
    |
    v
[30.1 Maturity models]
    |
    v
[30.2 Gathering evidence]
    |
    v
[30.3 Targets]
    |
    v
[30.4 Repeating the assessment]
    |
    v
[Worked example] --> [Exercise EX088]

Learning outcomes

You will (1) use a maturity model to assess governance; (2) gather evidence for ratings; (3) set realistic improvement targets.

30.1 Maturity models

Maturity models describe stages of capability, from ad hoc to managed and optimised. Amara uses a simple five-level model across Khatri and Brown's domains. Level one means practices depend on individuals; level three means documented and consistently applied; level five means measured and continuously improved. She notes that maturity models are useful for structured conversation and planning, but levels are judgements, not precise measurements, and should be presented as such. Amara writes a short description of each level for each domain, with examples from Harbourline.

30.2 Gathering evidence

Amara rates each domain using evidence: documents, interviews, scorecard results and issue logs. For quality, she finds documented rules, automated checks and escalation, rating level three. For life cycle, she finds a schedule and deletion started but not yet routine, rating level two. She records evidence for each rating so others can challenge it. Ratings without evidence tend to reflect optimism or the views of whoever is asked. She shares the ratings and evidence with owners, who challenge two ratings; one is adjusted after further evidence.

30.3 Targets

The governance group asks to reach level five everywhere. Amara explains that higher levels need investment and may not be worthwhile for a co-operative of Harbourline's size. She suggests targets of level three in all domains within two years, with level four for quality, where benefits are clearest. The group agrees. She notes that targets should reflect value, and that chasing maturity levels for their own sake wastes resources. Amara writes the targets into the governance plan, with actions and owners for each domain.

30.4 Repeating the assessment

Amara recommends repeating the assessment yearly using the same evidence approach, so progress is comparable. She also suggests that someone outside the data team take part, reducing bias. Dr. Lindqvist adds that maturity assessments are most useful when they lead to specific actions, and that the action plan matters more than the scores, which can otherwise become a point of pride or embarrassment rather than a tool for improvement. The governance group asks the records officer to take part in the next assessment as the outside participant.

Worked example

Amara rates Harbourline's domains with a five-level model and recorded evidence, sets targets of level three with level four for quality and plans yearly assessments with outside participation.

Synthetic case. Ratings are synthetic.

Errors and limits

Aiming for top maturity everywhere wastes resources in small organisations.

Exercises

Continue studying — lesson 30 (chapter 30 of 40)

← Chapter 29 · Course chapter index · Chapter 31 →

Continue to the next authored lesson.

Worked answers

EX088. Level three.

EX089. Level three in all domains and four for quality within two years.

EX090. Include someone from outside the data team.