Most organizations believe they are more technologically mature than they are. This is not cynicism — it is a structural consequence of how IT capability is typically evaluated. The people best positioned to assess maturity are also the people whose careers and reputations are attached to the current state of IT. An honest maturity assessment requires a framework that makes the evaluation criteria explicit, a process that includes perspectives from outside the IT function, and the institutional courage to accept findings that are uncomfortable.
What Maturity Actually Measures
IT maturity is not primarily about which systems you have. It measures how consistently, reliably, and efficiently your IT function delivers value to the business. An organization can have modern, expensive systems and still have low maturity if those systems are poorly managed, inconsistently used, or disconnected from business processes. Conversely, an organization can have older technology and high maturity if its processes are disciplined, its people are capable, and its governance is effective.
I assess maturity across six dimensions: governance and strategy, service management, security and risk, infrastructure reliability, application management, and data and analytics capability. Each dimension is scored from one to five, with descriptors at each level that allow honest calibration without requiring subjective judgment calls.
Getting Honest Input
The most reliable input for a maturity assessment comes from three sources: structured interviews with business stakeholders who depend on IT services, operational data on IT performance metrics, and benchmarking against comparable organizations. Business stakeholders will tell you where IT is failing the business in ways that internal IT reviews never surface. Performance data will reveal gaps between what the IT function believes it delivers and what it actually delivers. Benchmarking provides context that prevents the common mistake of judging maturity against an internal standard that is simply too low.
Using the Results
A maturity assessment is useful only if it leads to action. The output should be a prioritized list of maturity gaps, with each gap framed in terms of its business impact — what risk does low maturity in this dimension create for the organization? The highest-impact gaps become the foundation of the IT improvement roadmap. Organizations that use maturity assessments well revisit them annually, treating the score as a leading indicator of IT’s ability to support business growth and resilience.