The model contains more than 350 cybersecurity practices, which are grouped by objective into 10 logical domains. Each practice is assigned a maturity indicator level (MIL) that indicates the progression of practices within a domain.
Maturity models are valuable instruments for IT managers because they allow the assessment of the current situation of a company as well as the identification of reasonable improvement measures. Over the last few years, more than a hundred maturity models have been developed to support IT management. They address a broad range of different application areas, comprising holistic assessments of IT management as well as appraisals of specific subareas (e. g. Business Process Management, Business Intelligence).
data management maturity model v1.0 pdf download
The evergrowing number of maturity models indicates a certain degree of arbitrariness concerning their development processes. Especially, this is highlighted by incomplete documentation of methodologies applied for maturity model development.
In this paper, we will try to work against this trend by proposing requirements concerning the development of maturity models. A selection of the few well-documented maturity models is compared to these requirements. The results lead us to a generic and consolidated procedure model for the design of maturity models. It provides a manual for the theoretically founded development and evaluation of maturity models. Finally, we will apply this procedure model to the development of the IT Performance Measurement Maturity Model (ITPM3).
In IT management, maturity models have proved to be an important instrument because they allow for a better positioning of the organization and help find better solutions for change. Over the last few years, over a hundred maturity models have been developed to support IT management. However, the procedures and methods that led to these models have only been documented very sketchily. Using a scientific approach, we have developed criteria for the development of maturity models. These criteria also serve as a basis for the comparison of sparsely documented maturity approaches. The results thus obtained have been generalised and consolidated into a generally applicable model. A case study will illustrate the applicability of our model. The results of this paper are meant to serve as a manual for methodically well-founded designs and evaluations of maturity models.
Studies have shown that more than a hundred different maturity models have been proposed (de Bruin et al. 2005). The constant publication of new maturity models for often fairly similar applications however suggests a certain arbitrariness. The authors only rarely reveal their motivation and the development of the model, or their procedural method and the results of their evaluation.
The aim of this paper is therefore to propose a procedural model for the design of maturity models hoping to remedy these widespread shortcomings. In a first step, the requirements necessary for the development process of maturity models will be identified (section 2). On the basis of these requirements, the few well-documented development processes of maturity models will be compared (section 3). The results from section 3 provide the groundwork for the construction of a procedure model for the development of maturity models (section 4). In section 5, the procedure model will be illustrated by the development of a maturity model for the implementation of IT performance measurement supported by BI tools. Finally, an outlook on further research will complete this article (section 6).
R4 (Multi-methodological Procedure): The development of maturity models employs a variety of research methods, the use of which needs to be well-founded and finely attuned. (Zelewski (2007, p. 98) points at the difficulties of operationalising research rigor and proposes an ontological approach (Frank 2004, p. 377) to address those.)
R8 (Scientific Documentation): The design process of the maturity model needs to be documented in detail, considering each step of the process, the parties involved, the applied methods, and the results.
In the following section, a comparison will show to what extent existing maturity models meet these requirements. On the basis of these results, a generically applicable model for the development of maturity models will be extracted, enabling designers of maturity models to fulfil the requirements established above in the course of the design process.
An essential prerequisite for a comparison of design processes of specific maturity models can be found in requirement R8 (Scientific Documentation). Only maturity models for which a detailed documentation is available can be effectively compared. In order to identify adequate objects for the comparison, 51 maturity models were culled from the internet and pertinent literature, and then analyzed. Each of these models was checked for free and publicly available information about the design process (as of July 2008). In order to be able to include models that offered only little information about the design process, we asked model designers per e-mail to advise us of potential publications on the subject. This, however, led in only a few cases to an improvement of the data available. The maturity models have been described according to requirement R8 using three criteria which may also work in combination (see Tab. 1). Our results show that the documentation quality of these models is generally fairly patchy (for more detail see Becker et al. 2009).
For the appraisal of the remaining requirements only those models can be considered that comply with requirement R8-III. On the basis of this appraisal, six maturity models were chosen and synoptically reviewed with regard to requirements R1 to R7 (see Tab. 2). Naturally, requirement R8 will not be reappraised here.
One of the selected models is the Analysis Capability Maturity Model (ACMM), which has been developed for the US-American National Reconnaissance Office (NRO). It has been designed to evaluate processes of organizations that conduct state-commissioned studies (Covey and Hixon 2005). The second model is the maturity model of Rosemann et al. (2006), which investigates Business Process Management Maturity (BPMM). The designers emphasize that their model must comply with scientific standards (de Bruin and Rosemann 2007; de Bruin et al. 2005). The third model included in our synopsis is Capability Maturity Model Integration (CMMI), which integrates several models that evolved from the context of the initially very popular Capability Maturity Model (CMM; CMMI Product Team 2006; Paulk et al. 1993). On the basis of CMM, Cook and Visconti started in 1992 to develop the Document Process Maturity Model (DPMM), which is also included in our study. This model focuses on documentation as an important supporting factor in software development (Cook and Visconti 2000). Another model included is the E-Learning Maturity Model (eMM), published by the Victoria University of Wellington and designed to help colleges and other institutions to assess their capabilities with regard to a sustained development, introduction and use of e-learning and to compare their results with other institutions (Marshall 2007). Finally, the IS/ICT Management Capability Maturity Framework (IC/ICT CMF) represents a maturity model for IT management (Renken 2004).
In spite of their comparatively good documentation, the following models have been excluded from the synopsis: the Business Process Maturity Model (Lee et al. 2007), which is less well documented than the BPMM, a maturity model from the same domain; the Capability Maturity Model (CMM; Paulk et al. 1993), since it is the precursor of CMMI; and the Knowledge Management Capability Assessment (KMCA; Freeze and Kulkarni 2005; Kulkarni and Freeze 2004), since the main phases of its development process match those of the BPMM (de Bruin et al. 2005).
In the following, we propose a procedure model that distinguishes eight phases in the development of maturity models (see Fig. 1). The elements of this model are informed by the requirements identified above and by correspondent procedures from the well-documented examples. In the graphic representation of the procedure model, which is based on a flow chart (see DIN 1966), notations for references to requirements R1R7 have been applied to the individual procedure model elements. Requirement R8 has been incorporated by identifying the documents generated in the course of the maturity model design, referenced by the document symbol which has been assigned to R8 in the caption. Moreover, the model generalizes the reviewed well-documented development processes and illustrates possible procedures for each phase by examples from the synopsis.
According to R6, the procedure model starts with the problem definition. All reviewed models start by defining the problem. For this purpose both the targeted domain (e. g. IT management as a whole (see IS/ICT CMF) vs. partial discipline (see CMM, DPMM)) and the target group (e. g. intra-corporate vs. external) of the maturity model need to be determined.
At the same time, according to R5, the problem relevance, i.e. the actual demand for the maturity model, must be clearly demonstrated. The reviewed models, however, generally explain this demand only by pointing out the relevance of the targeted domain, except for ACMM and CMMI, which were initiated by state commissions.
The central phase of the procedure model is the iterative maturity model development, which reflects requirement R2. The sub-steps of this phase, selecting the design level, selecting the approach, designing the model section, and testing the results will be iterated. The design level with the highest degree of abstraction provides the architecture, i.e. the fundamental structure of the maturity model. Besides the one-dimensional sequence of discrete steps (DPMM), a multi-dimensional maturity assessment is common (IS/ICT CMF). The different dimensions may be organized hierarchically (BPMM). After this basic structural design basic, the individual dimensions and their attributes must be devised to flesh out the model architecture. 2ff7e9595c
Commentaires