Frameworks and scales
Maturity models
A maturity model tells you where you stand, topic by topic, on a five-level scale. More useful still, it tells you what separates your level from the next one, and that is what turns a finding into a costed action plan.
Get my first scoreWhat a maturity model is
A maturity model breaks a topic into themes, each theme into questions, and each question into written levels. You do not answer yes or no: you pick the wording that describes your actual situation. That is what makes an assessment repeatable across teams and comparable from one year to the next.
The difference with an audit checklist fits in one sentence. A checklist verifies compliance at a point in time and produces gaps. A maturity model measures progress and produces a trajectory: it says not only what is missing, but in which order to deal with it.
The method comes from CMMI, where five levels describe the move from informal to managed. It applies to any topic, not only IT: a quality program, a supply chain, data governance or a compliance framework are all described the same way.
The five levels
The exact wording changes from one topic to the next, and that is as it should be: level 3 in risk management looks nothing like level 3 in food traceability. What does not change is the progression.
Informal
Nothing is written down. Decisions are made case by case, with no shared reference, and the quality of the outcome depends on the people involved.
Documented
Rules exist in a document, but few people know them and the way they are applied varies across teams and sites.
Applied
Rules are circulated and generally followed. Gaps are occasional and get handled when someone notices them.
Measured
The rules are applied systematically and the record is kept. Indicators exist, and gaps are caught before they have consequences.
Managed
Measurement drives decisions. The framework is revised on its own results, and effort goes where it changes something.
What nobody else puts in the grid
A model that describes five levels tells you where you are. It does not tell you how to move up. In our models, every step from one level to the next carries the action that makes it possible, with its cost and its lead time. That column is what turns an assessment into a roadmap.
From a model to an action plan
Pick the model
One topic, one model. If you need several, they combine and the results consolidate into a single roadmap.
Assess
Direct entry, a self-assessment link sent to the teams, or an interview. The assistant can fill the assessment in from your notes.
Read the score
One overall gauge and a radar by theme. You see straight away what is pulling the average down.
Set the target
The level you are aiming for, theme by theme. The gap between score and target is what gets worked on.
Get the plan
Every gap carries its action, its cost and its lead time. The assistant groups them into a prioritized roadmap.
The models, by domain
Every model can be read in full before any assessment: its themes, its scale, what the diagnostic produces. Use it as it is, adapt it to your organization, or build your own from several.
- Application security maturity (DevSecOps, secure coding)
- Change management strategy maturity
- Customer relationship management (CRM) maturity
- Dematerialisation and paperless transition maturity
- Digital Markets Act (DMA) maturity - Regulation (EU) 2022/1925
- Digital maturity DMA - The European Commission's Digital Maturity Assessment
- Digital transformation maturity for solopreneurs
- DSA maturity - Digital Services Act
- Enterprise digital transformation maturity (100+ audit points - holistic approach / MIT)
- Innovation capability assessment maturity
- Inventory and warehouse management maturity
- MAREVA maturity - Digital project analysis for the public sector (France specific)
- Maturity - Digital transformation of financial services
- Maturity - ISO 19600 - Compliance management systems (corporate compliance)
- Maturity - ISO 20000 - IT service management (ITIL aligned)
- Maturity - ISO 22316 - Organisational resilience management
- Maturity - ISO 29119 - Software testing management and quality
- Maturity - ISO 31000 - Enterprise risk management
- Maturity - Omnichannel strategy maturity
- Maturity - UAE national standard for business continuity management systems
- Maturity ISO 56002: innovation management
- Maturity ISO 9001 - Quality management readiness and compliance
- Mixed reality adoption maturity (XR, AR, VR)
- OT environment security maturity (operational technology)
- Process automation maturity (RPA, hyperautomation)
- Procurement department maturity
- Procurement digitalisation maturity
- Protection and management of citizens' digital identities (eIDAS)
- Agentic AI maturity - Governance, strategy, culture, data and IT readiness
- Big data readiness and analytics maturity
- Blockchain applications maturity
- Data and AI driven strategy maturity
- Data maturity and data governance
- Ethical and responsible AI models maturity
- Maturity - Compliance with the European AI Act (use of AI in companies)
- Maturity - European Data Act
- Maturity - ISO 38500 - IT governance (strategic management of information systems)
- Maturity - ISO/IEC 42001 - Artificial intelligence management systems (AIMS)
- Maturity - Use of data and AI for marketing
- Open data adoption and API management maturity
- Open data strategy and data transparency maturity
- Overall enterprise AI maturity
- Predictive maintenance readiness maturity
- Sensitive data protection and advanced cryptography maturity
- Supply chain resilience index maturity
- EDI maturity (Equality, Diversity, Inclusion)
- Employee engagement and quality of life at work
- Future of work strategy maturity
- HR process digitalisation maturity
- Inclusion, diversity and equality strategy maturity
- Maturity - ISO 30401 - Knowledge management systems
- Maturity - ISO 45003 - Psychological health and well-being at work (complementary to ISO 45001)
- Cyber crisis management maturity: resilience after an attack
- Cyber Resilience Act maturity - Regulation (EU) 2024/2847 on the cyber resilience of digital products
- Cyber resilience of public institutions - Maturity
- Cyber risk management framework
- Cyber threat intelligence maturity
- DORA maturity (European regulation on digital resilience for financial services)
- Maturity - ISO 27005 - Cybersecurity risk management
- Maturity - ISO/IEC 27000 - Information security management systems (ISMS)
- Maturity - UAE information assurance regulation
- Maturity ISO 27001 and ISO 27032 - Cybersecurity
- NIS 2 maturity - Mandatory European directive
- SOC 2 maturity - Data and IT services security
- Zero Trust strategy and cloud environment security
- Anti-money laundering (AML) and know your customer (KYC) readiness
- Basel III and Solvency II - Financial regulation and banking risk management
- CSRD maturity - Corporate sustainability reporting directive
- Financial performance management maturity
- GDPR readiness - General Data Protection Regulation
- Maturity - ISO 27701 - Privacy protection and GDPR extension to privacy management systems
- Maturity - ISO 37001 - Anti-bribery management systems
- Maturity ISO 22301 - Business continuity and financial crisis management
- MiFID II directive - Investor protection and financial market transparency
- NFRD maturity - Non-financial reporting directive
- Readiness for the Sustainable Finance Disclosure Regulation (SFDR)
- AA1000 maturity - AccountAbility principles and stakeholder engagement
- Green IT / responsible digital maturity
- Maturity - ISO 14046 - Water footprint management
- Maturity - ISO 20400 - Sustainable procurement and supply chain
- Maturity ISO 14001 - Environmental management
- Maturity ISO 14064 - Greenhouse gas emissions management
- Maturity ISO 26000 - Corporate social responsibility (CSR)
- Animal by-products compliance · Regulation (EC) No 1069/2009
- Animal health law compliance · Regulation (EU) 2016/429
- Border control posts compliance · Regulation (EU) 2017/625
- BRCGS Food Safety · Issue 9
- Broiler chickens welfare compliance · Directive 2007/43/EC
- Calf welfare compliance · Directive 2008/119/EC
- CAP conditionality compliance · Regulation (EU) 2021/2115
- Contaminants requirements compliance (chemical risks) · Commission Regulation (EU) 2023/915
- Corporate sustainability reporting compliance (CSRD) · Directive (EU) 2022/2464
- EU deforestation-free products compliance · Regulation (EU) 2023/1115
- EU fertilising products compliance · Regulation (EU) 2019/1009
- Farmed animal welfare compliance · Directive 98/58/EC
- Feed additives compliance · Regulation (EC) No 1831/2003
- Feed hygiene compliance · Regulation (EC) No 183/2005
- Food additives compliance · Regulation (EC) No 1333/2008
- Food contact materials framework compliance · Regulation (EC) No 1935/2004
- Food enzymes compliance · Regulation (EC) No 1332/2008
- Food flavourings compliance · Regulation (EC) No 1334/2008
- Food hygiene compliance · Regulation (EC) No 852/2004
- Food information to consumers compliance · Regulation (EU) No 1169/2011
- Food safety management system · ISO 22000:2018
- Food safety system certification · FSSC 22000
- Food traceability compliance · Regulation (EC) No 178/2002
- Food traceability standard · ISO 22005:2007
- General food law compliance · Regulation (EC) No 178/2002
- Genetically modified food and feed compliance · Regulation (EC) No 1829/2003
- Geographical indications compliance (PDO/PGI) · Regulation (EU) No 1151/2012
- GLOBALG.A.P. Integrated Farm Assurance · Version 6
- GMO traceability and labelling compliance · Regulation (EC) No 1830/2003
- GMP+ Feed Safety Assurance · GMP+ FSA
- Good manufacturing practice for FCM compliance · Regulation (EC) No 2023/2006
- HACCP compliance · Regulation (EC) No 852/2004
- Hygiene of food of animal origin compliance · Regulation (EC) No 853/2004
- IFS Food · Version 8
- Import conditions for products of animal origin · Regulation (EU) 2020/2235
- Industrial emissions compliance (agro-industrial installations) · Directive 2010/75/EU
- Laying hens welfare compliance · Directive 1999/74/EC
- Medicated feed compliance · Regulation (EU) 2019/4
- Microbiological criteria - Compliance with Regulation (EC) No 2073/2005
- Mycotoxins compliance · Commission Regulation (EU) 2023/915
- Nitrates directive compliance · Directive 91/676/EEC
- Novel foods compliance · Regulation (EU) 2015/2283
- Nutrition and health claims · Compliance with Regulation (EC) No 1924/2006
- Official controls compliance · Regulation (EU) 2017/625
- Official controls on products of animal origin · Regulation (EU) 2019/627
- Organic imports compliance · Regulation (EU) 2021/2306
- Organic production and labelling compliance · Regulation (EU) 2018/848
- Packaging and packaging waste compliance · Directive 94/62/EC
- Pesticide maximum residue levels (MRL) compliance · Regulation (EC) No 396/2005
- Pharmacologically active substances compliance · Regulation (EU) No 37/2010
- Phytosanitary certification compliance · Regulation (EU) 2016/2031
- Pig welfare compliance · Directive 2008/120/EC
- Plant health compliance · Regulation (EU) 2016/2031
- Plastic food contact materials compliance · Regulation (EU) No 10/2011
- Protective measures against plant pests compliance · Regulation (EU) 2019/2072
- RASFF obligations compliance · Regulation (EC) No 178/2002
- Recycled plastic food contact materials compliance · Regulation (EU) 2022/1616
- Sustainable use of pesticides compliance · Directive 2009/128/EC
- TRACES NT certification compliance · Regulation (EU) 2019/1715
- Transmissible animal diseases compliance · Regulation (EU) 2018/1882
- Veterinary medicinal products compliance · Regulation (EU) 2019/6
- Veterinary medicine residues compliance · Regulation (EU) No 37/2010
- Waste framework compliance · Directive 2008/98/EC
- Welfare at slaughter · Compliance with Regulation (EC) No 1099/2009
- Welfare during transport compliance · Regulation (EC) No 1/2005
- Access to environmental information compliance · Directive 2003/4/EC
- Air quality standards compliance · Directive 2008/50/EC
- ATEX equipment compliance · Directive 2014/34/EU
- Battery raw materials compliance · Regulation (EU) 2023/1542
- Birds directive compliance · Directive 2009/147/EC
- Carbon border adjustment mechanism (CBAM) · Regulation (EU) 2023/956
- Civil explosives compliance · Directive 2014/28/EU
- CLP compliance · Regulation (EC) No 1272/2008
- Conflict minerals due diligence · Regulation (EU) 2017/821
- Critical raw materials act compliance · Regulation (EU) 2024/1252
- Energy efficiency compliance · Directive (EU) 2023/1791
- EU emissions trading system compliance · Directive 2003/87/EC
- EU taxonomy alignment · Regulation (EU) 2020/852
- Explosives precursors compliance · Regulation (EU) 2019/1148
- Extractive waste management compliance · Directive 2006/21/EC
- Groundwater protection directive compliance · Directive 2006/118/EC
- Landfill directive compliance · Directive 1999/31/EC
- Machinery safety compliance · Regulation (EU) 2023/1230
- Major accident prevention (mining waste facilities) · Directive 2006/21/EC
- Mercury regulation compliance · Regulation (EU) 2017/852
- Natura 2000 / Habitats compliance · Directive 92/43/EEC
- Occupational health and safety management · ISO 45001:2018
- Occupational safety framework compliance · Directive 89/391/EEC
- REACH regulation compliance · Regulation (EC) No 1907/2006
- Renewable energy directive compliance · Directive (EU) 2018/2001
- Safety requirements in drilling · Directive 92/91/EEC
- Safety requirements in extractive industries · Directive 92/104/EEC
- Seveso III directive compliance · Directive 2012/18/EU
- Urban waste water treatment compliance · Directive 91/271/EEC
- Water framework directive compliance · Directive 2000/60/EC
- Workplace ATEX compliance · Directive 1999/92/EC
- Border control posts compliance · Regulation (EU) 2017/625
- Compliance management system · ISO 37301:2021
- Contaminant criteria compliance · Regulation (EU) 2023/915
- Environmental liability compliance · Directive 2004/35/EC
- Industrial emissions directive (IED) compliance · Directive 2010/75/EU
- Internal audit guidelines · ISO 19011:2018
- Mining permits and concessions compliance · National mining codes (member state level)
- Nitrates directive compliance · Directive 91/676/EEC
- Strategic environmental assessment (SEA) compliance · Directive 2001/42/EC
- AI maturity in manufacturing
- Blockchain and industrial flow traceability maturity
- Carbon footprint and decarbonisation maturity in industry
- Carbon footprint and decarbonisation strategy
- Carbon footprint assessment of IT infrastructure
- Circular economy and industrial waste optimisation
- Circular raw material management and industrial recycling maturity
- Cobotics and advanced robotics maturity
- Digital twin and industrial process simulation maturity
- Digital twin technologies and immersive simulation maturity (industry)
- Factory energy management maturity
- Future mobility maturity (autonomous vehicles, industrial drones, etc.)
- Green manufacturing and zero waste maturity
- Industrial energy transition maturity
- Industry 4.0 readiness index
- IoT and connected industry maturity
- Machine vision and automated quality control maturity
- Maturity - ISO 10012 - Measurement management systems (industrial metrology)
- Maturity - ISO 17025 - Competence of testing and calibration laboratories
- Maturity - ISO 28000 - Supply chain security management systems
- Maturity - ISO 44001 - Collaborative relationship management (industrial partnerships and supply chain)
- Maturity - ISO 50006 - Energy performance indicators and benchmarking
- Maturity - ISO 55001 - Physical and industrial asset management (maintenance, infrastructure)
- Maturity ISO 50001 - Energy management
- MES architecture maturity (manufacturing execution system)
- Net zero strategies and carbon offsetting maturity
- Security of critical and industrial infrastructure
- Smart factory maturity model
- Digital transformation maturity in hospitals
- Digital transformation maturity in local authorities
- Digital transformation maturity in schools and universities
- Ecological transition maturity of local authorities
- Health systems interoperability maturity
- ISO 13485 - Medical devices - Quality management systems
- ISO 7101 - Healthcare organisation management maturity
- Maturity - ISO 21001 - Management of educational organisations
- Museum safety and security
- ISO 19650 (Parts 1 to 5) Organisation and digitisation of information about buildings and civil engineering works
- ISO 21542 - Building construction - Accessibility and usability of the built environment
- ISO 21929-1 Sustainability in buildings and civil engineering works
- Maturity - ISO 41001 - Facility management (buildings, infrastructure and services)
- Bank recovery plan · CEMAC bank resolution regulation
- CEMAC AML/CFT framework · CEMAC AML/CFT regulation
- CEMAC banking governance · COBAC governance regulation
- CEMAC Basel II/III standards · COBAC prudential framework
- CEMAC internal control · COBAC internal control regulation
- CEMAC microfinance (EMF) · CEMAC EMF regulation
- Consolidated supervision · COBAC group supervision regulation
- Credit risk · COBAC credit risk regulation
- Customer protection · CEMAC consumer protection regulation
- Foreign exchange regulation · CEMAC exchange regulation
- ICAAP / risk governance · COBAC ICAAP instruction
- Information systems security · COBAC IT security regulation
- Liquidity risk · COBAC liquidity regulation
- Operational risk · COBAC operational risk regulation
- Outsourcing · COBAC subcontracting regulation
- Payment services · CEMAC payment services regulation
- Prudential capital · COBAC capital regulation
- Prudential reporting · COBAC reporting instructions
- Risk division · COBAC large exposures regulation
- Solvency ratio · COBAC solvency regulation
- Banking customer protection - BCEAO customer protection instruction
- Banking group governance - BCEAO consolidated supervision instruction
- Banking internal control - BCEAO internal control instruction
- Business continuity plan - BCEAO BCP directive
- Capital adequacy (ICAAP) - BCEAO ICAAP instruction
- Credit institution governance - WAEMU banking law + BCEAO circulars
- Electronic money - BCEAO directive to e-money issuers
- Global risk management - WAEMU Basel II/III prudential framework
- Information systems security - BCEAO directive on IT risk management
- Liquidity ratio (LCR) - BCEAO directive on liquidity risk
- Microfinance institutions (SFD) - Revised PARMEC law + BCEAO instructions
- Outsourcing - BCEAO outsourcing directive
- Participations and subsidiaries - WAEMU regulation on banking participations
- Payment services - WAEMU payment services regulation
- Prudential reporting - BCEAO regulatory statements directive
- Regulatory capital - WAEMU capital regulation
- Risk division / Large exposures - WAEMU regulation on risk division
- Solvency ratio - WAEMU prudential framework
- Transparency and financial disclosure - WAEMU Basel pillar III framework
Measure first, decide after
A thirty-minute walkthrough on the model that concerns you, with your themes and your scale. No generic demo.