IT-CMF (IT Capability Maturity Framework): IT-CMF – Tutorial (about 60 minutes)

The IT Capability Maturity Framework (IT-CMF) is a management framework from the Innovation Value Institute (IVI) at Maynooth University in Ireland that helps organisations understand, measure and improve the way they manage information technology so that it delivers business value. It is used by chief information officers (CIOs), IT leadership teams, enterprise architects, transformation and portfolio managers, consultants and business executives who need a shared, business-oriented language for discussing IT. After this tutorial you will be able to explain how IT-CMF is structured, read an IT-CMF maturity profile, and plan a sensible capability improvement programme with it.

Free tutorial · about 60 minutes · 7 lessons · 4 diagrams · then a 25-question knowledge check and a certificate.

Course overview

Edition and status: IT-CMF is owned and maintained by the Innovation Value Institute, a research and education centre of Maynooth University, and is not an ISO or national standard. The most recent published books are IT Capability Maturity Framework: The Body of Knowledge Guide (2nd edition, 2016) and IT-CMF – A Management Guide (Van Haren Publishing, 2017), which describe four Macro-Capabilities, 36 Critical Capabilities and 315 Capability Building Blocks. IVI then revised the framework online in a series of numbered revisions (18.01, 18.04, 18.07, 18.10 and 19.01); the latest numbered revision shown in IVI's public Framework Viewer is 19.01, which has 37 Critical Capabilities. IVI now also presents an updated version, called simply the Capability Maturity Framework (CMF), through its online portal; at the time of checking no public version number, release year or new book had been announced for it. This tutorial teaches the stable architecture shared by these versions and uses the 37 capability names of revision 19.01 — verified 2026-10-29.

Who it is for: IT managers and team leads, CIO office and strategy staff, enterprise and solution architects, project, programme and portfolio managers, finance business partners who look after IT budgets, IT governance, risk and audit professionals, consultants, and business leaders who sponsor digital transformation.

Prerequisites: none. A general idea of how an IT department works (projects, services, budgets, suppliers) will help you connect the ideas to your own organisation. No technical knowledge is needed; IT-CMF is about management, not technology products.

How to use this tutorial: read the seven lessons in order (about 45 minutes), study the four diagrams, then use the remaining time on the reflection questions before you take the 25-question knowledge check.

Learning objectives:

You will be able to explain why IT-CMF was created, who owns it and how it differs from process-focused frameworks.
You will be able to describe its architecture: Macro-Capabilities, Critical Capabilities, Capability Building Blocks and the supporting components.
You will be able to interpret the five maturity levels and explain why a higher score is not automatically better.
You will be able to outline the four phases of IVI's Capability Improvement Programme and the roles involved.
You will be able to describe how IT-CMF assessments collect current maturity, target maturity and importance, and what the results can and cannot prove.
You will be able to apply the framework to a realistic organisation and choose a small set of priority capabilities.
You will be able to position IT-CMF next to COBIT, ITIL, CMMI, ISO/IEC 38500 and TOGAF.

Lesson 1 – Origins, purpose and scope

The problem IT-CMF set out to solve

Most organisations spend a large and growing share of their budget on technology, yet many executives struggle to say what they get back. Large IT initiatives regularly run late, exceed their budgets or fail to deliver the benefits that justified them. When researchers and practitioners looked at these failures, they often found that the technology itself was sound. What was missing was the management capability around it: clear strategy, sensible funding, disciplined portfolio choices, good supplier relationships, realistic benefit tracking and the skills to run all of this consistently.

By the mid-2000s there was no shortage of guidance for individual parts of IT management. There were frameworks for service management, for software development processes, for governance and control, for architecture and for project management. The difficulty was the opposite: so many tools, each covering one domain in its own vocabulary, that leaders found it hard to choose among them and even harder to see how they fitted together. A CIO who wanted one picture of "how good are we at managing IT, and where should we improve first?" had no single, business-oriented map to work from.

Where IT-CMF came from

IT-CMF grew out of work inside Intel Corporation's IT organisation, where leaders had been developing ways to measure and improve the business value of IT. In 2006 Intel and the National University of Ireland Maynooth (now Maynooth University) co-founded the Innovation Value Institute as a not-for-profit, multi-disciplinary research and education institute. The aim was to gather an international consortium of companies and public-sector bodies that would build on Intel's work and create a common approach to managing IT. The Boston Consulting Group was an early supporter with a seat on the consortium's board, and the Irish state agencies Enterprise Ireland and IDA Ireland supported the research through their Technology Centre programme.

The framework was developed with a research approach called design science, in which researchers build a useful artefact (here, a framework), test it with practitioners and refine it in repeated cycles. Member organisations contributed their experience under an open innovation model. IVI first published IT-CMF in 2009 and has revised it many times since. The two books from 2016 and 2017 captured a mature version; the online revisions of 2018 and early 2019 merged, split and updated several capabilities and added new ones such as Data Analytics and Organization Change Management; and IVI's current description of the updated framework stresses sustainable, measurable efficiency and better decisions in the age of artificial intelligence.

What IT-CMF is for

IVI presents IT-CMF as an integrated framework, with supporting tools, for building and running information systems in a way that produces lasting business value and innovation. In practical terms it does four things for an organisation:

It gives a map of the management disciplines that an IT function needs, expressed in business terms rather than technical ones.
It gives a ruler: a five-level maturity scale for each discipline, so that the organisation can see where it stands today and decide where it needs to be.
It gives a playbook: representative practices, expected outcomes and metrics that show how to move from one level to the next.
It gives a common language that business and IT people can both use when they set goals, argue about priorities and review progress.

Scope and a key difference from older maturity models

IT-CMF borrowed the maturity-level idea from the Software Engineering Institute's Capability Maturity Model (CMM), but it applies it much more widely. CMM and its successor CMMI look mainly at the processes used to build and deliver software and services. IT-CMF looks at the whole job of managing IT as a business: strategy, governance, budgeting, funding, sourcing, people, architecture, security, data, services, portfolio choices and benefit realisation.

It also adds a second dimension. Besides asking whether the organisation's practices are mature, IT-CMF asks what business outcomes each maturity level should produce. This focus on outcome maturity is one of its defining ideas: a capability is only valuable if it contributes to the organisation's goals. Finally, IT-CMF is deliberately industry-neutral and vendor-neutral. It is designed to sit above the specialist frameworks an organisation already uses, linking them rather than replacing them.

Lesson 2 – Key concepts and vocabulary

IT-CMF has a precise vocabulary. Learning these terms first will make the rest of the course much easier. Each definition below is written in plain words; the official wording is in IVI's publications.

Capability – the ability of an organisation to perform a coordinated set of tasks repeatedly and reliably, using its resources, to achieve a particular result. A one-off success by a talented individual is not yet a capability.
Dynamic capability – the ability to sense change and reconfigure resources and routines in response, for example when strategy shifts or a new technology appears. IT-CMF is designed to help organisations build this adaptability, not just efficiency.
IT capability – the organisation's ability to mobilise and deploy IT-based resources (integrating, reconfiguring, acquiring and releasing them) to achieve a desired end, often together with other business resources. Resources can be tangible, such as money, infrastructure and people, or intangible, such as software, data, intellectual property and culture.
Business value – in IT-CMF, the contribution that IT-based resources and capabilities make to helping the organisation achieve its objectives, whether those are financial or not.
Maturity – the degree to which a capability has evolved along an expected path from ad hoc and fragile towards consistent, broad and continually improving. IT-CMF uses five maturity levels.
Macro-Capability – one of four top-level strategic areas of IT management in IT-CMF. They group the detailed capabilities and form a continuous management loop.
Critical Capability (CC) – a key management discipline, such as Strategic Planning or Total Cost of Ownership, that an organisation needs to consider when it plans and delivers IT-enabled agility, innovation and value. Each CC has a two- or three-letter abbreviation, for example SP or TCO.
Capability Building Block (CBB) – one of the components that together make up a Critical Capability. CBBs are grouped into categories that are specific to each CC, and each CBB has its own five-level maturity description.
Practices-Outcomes-Metrics (POMs) – representative improvement practices for each maturity level, each paired with the outcome it should produce and one or more metrics that show whether it worked. POMs are indicative, not mandatory.
Capability Performance Indicator (CPI) – a business or operational performance indicator tied to a specific Critical Capability, grouped by balanced scorecard perspective (financial, process, customer, learning and growth). CPIs connect capability improvements to business results.
Management artefacts – templates, documents, tools and examples that help practitioners put the practices into effect, for instance a business case template or a benefits register.
Maturity profile – the picture produced by an assessment: current and target maturity for each assessed capability, often with importance ratings and comparison to benchmark data.
Capability Improvement Programme (CIP) – IVI's change methodology and toolset for using IT-CMF to plan and deliver improvement in four phases.
IT posture – the organisation's attitude towards the use of IT, for example whether it treats technology mainly as a cost to control or as a source of competitive advantage. Posture strongly influences which capabilities matter most.

Capabilities, processes and competences

A frequent source of confusion is the difference between a capability and a process. A process is a sequence of actions that gets a specific task done, such as approving a project or onboarding a supplier. A competence is the knowledge, skill and experience that people bring to that process. Processes and competences reinforce each other: people learn by working in processes, and processes only work when people are competent.

A capability sits one level above both. It combines people (competences), routines (processes) and resources (assets) and links them to the organisation's strategy and environment. That is why IT-CMF talks about capability management rather than process improvement alone. An organisation can have a beautifully documented process that nobody follows, or skilled people who are starved of funding; in both cases the capability is weak. Improving capability means looking at all three ingredients together and asking whether the result supports what the business is trying to achieve.

Lesson 3 – Structure of the framework

Four Macro-Capabilities in a feedback loop

At the top level IT-CMF organises IT management into four Macro-Capabilities. Each answers a different management question:

Managing IT like a Business – How do we run the IT function with professional business practices, focused on customers and business problems rather than on technology for its own sake? This area sets direction for the whole IT capability and aims to reposition IT from a cost centre to a value centre.
Managing the IT Budget – How do we turn that direction into a sustainable funding model, control costs, cope with legacy spending and still invest in new technology?
Managing the IT Capability – How do we run existing services and solutions well while continuously developing new ones? This is the production engine of IT.
Managing IT for Business Value – How do we justify IT investments, choose between them and prove that they deliver the expected benefits?

These four areas are not independent boxes. IT-CMF presents them as a continuous loop. Direction from the first area is converted into a budget; the budget fuels the production engine; the value area checks whether the resulting activities create value; and performance information flows back to the first area, which may adjust strategy, priorities or funding. Figure 1 shows this cycle.

Figure 1 – The four IT-CMF Macro-Capabilities form a continuous management loop from direction to funding, delivery, value and back.

Strategies within each Macro-Capability

For each Macro-Capability IT-CMF describes a progression of typical strategies, from a basic starting point to the most advanced. They help leadership teams agree, in plain language, what kind of IT function they want before they look at detailed capabilities. Paraphrased from the Management Guide, the progressions run roughly as follows:

Macro-Capability	Starting strategy	Most advanced strategy
Managing IT like a Business	IT run as a cost centre, moving through service centre and investment centre	IT run as a value centre
Managing the IT Budget	Predictable spending performance, then systematic cost reduction and expanded funding options	A sustainable economic model for IT
Managing the IT Capability	IT as a technology supplier, then technology expert and business partner	IT as a core capability of the whole organisation
Managing IT for Business Value	Attention to total cost of ownership, then return on investment and business cases, then options and portfolio thinking	Optimised value from the whole investment portfolio

Choosing a strategy for each area is a useful first conversation for an executive team. A public-sector body with a tight, fixed budget may deliberately aim for predictable performance and systematic cost reduction, while a fast-growing digital company may aim for IT as a core capability. Neither is wrong; they reflect different contexts and IT postures.

Critical Capabilities

Below the four Macro-Capabilities sits a modular library of Critical Capabilities. The 2016 Body of Knowledge Guide contained 36 CCs; after the online revisions (from 18.10 onwards) IVI's public list shows 37. The list below uses the names published by IVI for revision 19.01, grouped by Macro-Capability.

Managing IT like a Business (16): Accounting and Allocation (AA), Business Planning (BP), Business Process Management (BPM), Capacity Forecasting and Planning (CFP), Demand and Supply Management (DSM), Enterprise Information Management (EIM), Governance (GOV), Green Information Technology (GIT), Innovation Management (IM), Leadership (LDP), Organization Change Management (OCM), Organization Design and Planning (ODP), Risk Management (RM), Service Analytics and Intelligence (SAI), Sourcing and Supplier Management (SSM) and Strategic Planning (SP).

Managing the IT Budget (3): Budget Management (BGM), Budget Oversight and Performance Analysis (BOP) and Funding and Financing (FF).

Managing the IT Capability (15): Capability Assessment Management (CAM), Data Analytics (DA), Enterprise Architecture Management (EAM), Information Security Management (ISM), Knowledge Management (KM), People Asset Management (PAM), Personal Data Protection (PDP), Programme Management (PGM), Project Management (PM), Relationship Management (REM), Service Provisioning (SRP), Solutions Delivery (SD), Technical Infrastructure Management (TIM), User Experience Design (UED) and User Training Management (UTM).

Managing IT for Business Value (3): Benefits Assessment and Realization (BAR), Project Portfolio Management (PPM) and Total Cost of Ownership (TCO).

If you read the 2016 or 2017 books you will find slightly different names and groupings. For example, the books still have separate Sourcing and Supplier Management capabilities, which revision 18.01 merged into Sourcing and Supplier Management (SSM); the books have a combined IT Leadership and Governance capability, which revision 18.07 replaced with separate Leadership and Governance capabilities; and the books' project, programme and portfolio capabilities were reorganised into the three capabilities PM, PGM and PPM. Do not memorise the list. What matters is understanding that the library is modular, that it evolves as IT management evolves, and that an organisation selects the few capabilities that matter most to it.

Capability Building Blocks and supporting components

Each Critical Capability is broken down into Capability Building Blocks, grouped into a few categories. For instance, in online revision 19.01 Sourcing and Supplier Management has categories covering sourcing strategy, supplier contracting and classification, supplier integration and engagement, and supplier operations management, with several CBBs in each. The 2016 version of the framework contained 315 CBBs in total.

Around this three-layer architecture, IT-CMF provides supporting components for each Critical Capability:

a maturity description for the CC as a whole and for every CBB at each of the five levels;
assessment questions, each with a set of maturity statements from which respondents choose the one closest to their situation;
POMs that suggest how to stabilise the current level or move to the next one;
typical challenges organisations face when improving the capability, with suggested actions;
CPIs to connect capability improvement with business performance;
management artefacts such as templates and tools;
relationships to other CCs, because capabilities depend on each other (for example, benefits realisation depends on good portfolio management and business planning).

Figure 2 – IT-CMF's architecture: Macro-Capabilities contain Critical Capabilities, which break down into Capability Building Blocks with levels, questions and supporting material.

The five maturity levels

Every Critical Capability and every CBB is described at five levels of maturity. The detailed wording is specific to each capability, but IVI gives general characteristics that apply everywhere. They look at three aspects: the quality of the approach (how well defined and stable the practices are), its scope (how widely it is applied), and the predictability of outcomes (how often actions lead to the expected result).

Level 1 – Initial: approaches are inadequate and unstable, scope is fragmented, and repeatable outcomes are rare. Success depends on individuals.
Level 2 – Basic: approaches are defined but inconsistent, they cover only part of a function or domain, and repeatable outcomes happen occasionally.
Level 3 – Intermediate: approaches are standardised and inconsistencies are being addressed; they cover a whole business function (usually IT) or domain; repeatable outcomes are often achieved.
Level 4 – Advanced: approaches can flex systematically for innovation; they cover the organisation end to end and neighbouring domains; repeatable outcomes are very often achieved.
Level 5 – Optimizing: approaches show world-class attributes; they extend beyond the organisation's borders, for example into partners and the wider ecosystem; repeatable outcomes are virtually always achieved. (Some online versions label this level "Optimized".)

Figure 3 – The five IT-CMF maturity levels build on each other, widening scope and making outcomes more predictable at each step.

Two rules matter. First, levels are cumulative: each level provides the foundation for the next, and POMs are cumulative in the same way. Trying to jump from level 1 straight to level 5 is unwise and usually impossible, although good planning can speed up progress. Second, level 5 is not the goal for every capability. The right target depends on business strategy and on how important the capability is. Investing to reach level 5 in a capability that matters little to the business wastes money.

Lesson 4 – How it works in practice

The improvement logic

IT-CMF is used in a cycle that will feel familiar if you know other improvement methods: understand the business issue, measure where you are, decide where you need to be, plan and carry out targeted changes, measure again and make the gains stick. The distinctive part is that every step is anchored in business outcomes. The question is never simply "how do we get from level 2 to level 3?" but "which capabilities, improved by how much, will help us reach this business goal?"

The Capability Improvement Programme

To support this cycle IVI developed the Capability Improvement Programme (CIP), a change methodology with defined activities, tasks, deliverables and templates. Its activities are also linked to well-known change management actions, such as increasing urgency, removing complacency and creating a shared vision. The CIP has four phases and eleven numbered activities:

Phase 1 – Discover. The leadership team agrees which business outcomes the programme should deliver. Activities: (1) create awareness of capability management and define the problem or opportunity; (2) complete an initial assessment chosen to fit the context; (3) hold a capability foundation workshop to agree goals, priority capabilities, programme scope (which may start with a pilot) and governance.
Phase 2 – Design. The programme is planned and the circle widens to improvement team leaders and subject matter experts. Activities: (4) establish the programme with a charter, governance, operating model and roadmap; (5) train key participants; (6) mobilise capability improvement teams, which carry out deeper assessments, draft recommendations and turn them into project plans with benefits, metrics and targets; (7) hold a mobilisation workshop to prioritise across teams, set a programme scorecard and align plans with strategy and budget.
Phase 3 – Execute. Teams implement the changes. Activities: (8) carry out the improvement work plans, report progress, communicate changes and run follow-up assessments; (9) hold an execution review that checks deliverables, benefits and KPIs and integrates the results into normal performance management.
Phase 4 – Scaling and sustaining. The final phase extends what worked. Activities: (10) scale the programme to further areas or capabilities as needed; (11) sustain the improvements by embedding them in the organisation's culture.

Figure 4 – The Capability Improvement Programme moves from discovering priorities through design and execution to scaling and sustaining the gains.

Roles

The CIP distinguishes two broad groups. Practitioners lead or facilitate the improvement: programme leaders, improvement team leaders, key subject matter experts and IT-CMF assessors. Participants need to understand the programme and take part in it: senior managers, sponsors, assessment respondents and staff whose work changes. In practice you will also see an executive sponsor (often the CIO, ideally with a business counterpart), a programme office that runs scorecards and reporting, and capability owners who are accountable for the maturity of specific CCs.

Artefacts you will typically produce

A problem or opportunity statement and an assessment plan.
An assessment report with current and target maturity and the gaps between them.
A programme charter, roadmap and governance model.
Improvement project plans, each tied to expected benefits, metrics and targets drawn from the POMs and CPIs.
Team scorecards and a programme scorecard, reviewed regularly.
Follow-up assessment results showing whether maturity and business performance actually moved.

Using POMs well

Once a team knows that, say, Budget Management sits at level 2 and needs to reach level 3, it looks at the POMs for the relevant CBBs. Each practice suggests something to do, the outcome to expect and a metric to track it. The team chooses the POMs that fit its circumstances and that it can resource. Because POMs are representative rather than mandatory, a team may use a different practice that achieves the same outcome. Choosing two or three high-impact practices and tracking their metrics is usually more effective than trying to implement every suggestion at once.

Starting small

Few organisations improve all 37 capabilities at once. A typical programme selects three to six capabilities that are both important to the business and clearly below their target, often runs a pilot in one area, and expands once it has shown results. This modularity is one of IT-CMF's strengths: the library is broad so that you can pick the right pieces, not so that you must work on all of them.

Lesson 5 – Assessment, certification and compliance

Why assess?

An assessment turns opinions ("our budgeting is a mess", "architecture is fine") into a structured, comparable picture. It helps leadership see where the organisation stands, build agreement about priorities, compare business and IT views, and later prove that improvements happened. IVI's own research with organisations that used its assessments stresses that the assessment is only the start of a change process; the value comes from the actions that follow.

Types of assessment

IVI offers several assessment formats, and their names and packaging have changed over time. The common types described in IVI publications are:

Executive Assessment – a broad, point-in-time survey across all (or almost all) Critical Capabilities. Senior business and IT stakeholders rate current maturity, target maturity and the importance of each capability. The result is an overall maturity profile that highlights low-maturity, high-importance areas. Early versions covered 35 capabilities.
Accelerator-style assessment – a rapid, business-oriented review organised around a set of key management issues rather than around the framework's components. It suits a first conversation with business executives who are not IT specialists, and it points to the CCs that matter for their issues.
In-depth Critical Capability assessment – a deep dive into one CC, asking detailed questions at CBB level. It is used by improvement teams once priorities are known, and produces CBB-level gaps that map directly onto POMs.

How a maturity survey works

Each assessment question comes with a set of maturity statements, one for each level. Respondents choose the statement that best matches reality today and, in many assessments, the one that describes where the organisation should be. Answers from many respondents are aggregated, so the result reflects a group view rather than one person's opinion. Typical outputs include:

current and target maturity per capability, and the gap between them;
importance ratings, which show where improvement matters most to strategy;
differences between respondent groups, for example business versus IT, or headquarters versus regions;
comparison with IVI benchmark data from other organisations, where available.

Interpreting the results

Two interpretation points are essential. First, the one-to-five scale is not a simple bad-to-good grade. IVI's research notes that executives sometimes read it that way and draw the wrong conclusions. A capability at level 2 may be perfectly adequate if it is unimportant to the strategy, and a very high score in a low-importance capability can even signal over-investment. Second, disagreements between groups are findings, not noise. If business leaders rate a capability two levels lower than IT does, that gap in perception is itself something to manage.

Good assessment practice therefore includes a facilitated review of the results, in which the leadership team discusses the profile, agrees which gaps really matter and connects them to business objectives before any improvement work starts.

Certification and compliance

IT-CMF is a voluntary management framework, not a regulation or a certifiable management system standard. There is no public, third-party certification of an organisation against IT-CMF in the way that, for example, ISO/IEC 27001 or ISO/IEC 20000-1 certificates are issued by accredited bodies. An IT-CMF maturity profile is evidence for internal decision-making and benchmarking; it is not a certificate that an auditor or customer can rely on as proof of compliance.

For individuals, IVI has offered training programmes in online and classroom formats. The 2017 Management Guide says that training is available for the people who take part in an improvement programme and that formal IVI examinations and certification are available as an option. Course names, formats and exam arrangements change, so check IVI's current offer directly rather than relying on older lists.

Because the framework is proprietary, full access to detailed content (assessment questions, POMs, CPIs and artefacts) is generally through IVI membership, licensing, the books or IVI-supported engagements. The high-level structure explained in this course is publicly described.

Lesson 6 – Worked example

This example is fictional but realistic. It shows how the concepts fit together. All numbers are illustrative.

The organisation and its problem

Harbourline Insurance is a mid-sized insurer with about 4,000 employees and an IT function of 350 people plus several outsourcing partners. The board has approved a five-year digital strategy: online self-service for customers, faster product launches and lower operating costs. Two years in, results are disappointing. Projects are late, the IT budget overran twice, and business leaders complain that they cannot see what they are getting for the money. The new CIO wants a clear, shared picture of what needs to change.

Step 1 – Discover: frame the business issue

The CIO and the chief operating officer agree a problem statement: "IT investment is not translating into the digital outcomes in the strategy, and we cannot show where value is lost." They agree that the programme must be judged by business results — time to launch a product, cost per policy and customer satisfaction with online channels — and not by maturity scores alone.

Step 2 – Discover: run an executive-level assessment

Forty respondents take part: twenty from IT leadership and twenty from business units, finance and risk. For each capability they rate current maturity, target maturity and importance. The facilitated results workshop focuses on a handful of capabilities where the gap is large and importance is high:

Critical Capability	Current	Target	Importance	Observation
Project Portfolio Management (PPM)	1.8	3.5	Very high	Projects approved one by one; no comparison of value or capacity
Benefits Assessment and Realization (BAR)	1.5	3.0	Very high	Business cases written to get funding, never revisited
Budget Oversight and Performance Analysis (BOP)	2.0	3.0	High	Spending tracked monthly but not linked to outcomes
Sourcing and Supplier Management (SSM)	2.2	3.0	High	Contracts managed per supplier; little performance review
Technical Infrastructure Management (TIM)	3.4	3.0	Medium	Already above target; IT rates it higher than business does

Two insights emerge. First, the biggest gaps are in the value and portfolio areas, not in technology operations. Second, Technical Infrastructure Management already exceeds its target; the team agrees not to invest further there for now and to look at whether some infrastructure spending could be redirected. Business respondents also rated Relationship Management much lower than IT did, which the leadership team records as a perception gap to address.

Step 3 – Discover: foundation workshop

The leadership team selects three priority capabilities — PPM, BAR and BOP — because together they address the visible problem: money going into projects whose value nobody tracks. SSM is placed on the roadmap for year two. They agree to pilot in the commercial lines division, which has the largest project pipeline, and appoint a programme lead and capability owners for each priority CC. Governance is a monthly steering group chaired jointly by the CIO and the COO.

Step 4 – Design: deeper assessment and planning

Improvement teams run in-depth assessments for the three capabilities. For Project Portfolio Management the deep dive shows that the weakest building blocks are those dealing with prioritisation criteria and with ongoing portfolio review; capacity planning is only slightly better. For Benefits Assessment and Realization, benefits are rarely defined in measurable terms and nobody owns them after go-live.

Each team reviews the POMs for its weakest CBBs and picks a few practices. For example, the portfolio team chooses to introduce a single scoring model for all investment proposals, agreed with business leaders, and a quarterly portfolio review that can stop or re-scope projects. Each practice has an expected outcome (fewer low-value projects started, clearer trade-offs) and a metric (share of portfolio spend on top-ranked proposals, number of projects stopped or re-scoped after review). The benefits team chooses to require measurable benefits with named business owners in every business case and to run a benefits review six months after go-live.

The mobilisation workshop combines the team plans into a programme roadmap and scorecard. The finance team aligns the budget-oversight improvements with the portfolio scoring model, so that spending reports show money by strategic objective and not only by cost centre.

Step 5 – Execute: implement, measure and review

Over nine months the pilot division runs two quarterly portfolio reviews, which stop three low-value projects and re-scope two others. Every new business case now names a business owner and measurable benefits. The first post-implementation benefits review shows that one online self-service project delivered most of its promised call-centre savings, while another delivered little because the old process was never switched off. That finding leads to a change in the release checklist.

A follow-up assessment after a year shows PPM moving from 1.8 to about 2.8 and BAR from 1.5 to about 2.4 in the pilot division. More importantly, the business indicators chosen at the start begin to move: the average time to launch a product has dropped, and steering group members say they can finally see where IT money goes.

Step 6 – Scale and sustain

The programme now extends the portfolio and benefits practices to the other divisions, adds Sourcing and Supplier Management as planned, and starts a community of practice for capability owners. To make the changes stick, portfolio and benefits metrics are added to the executive scorecard, the scoring model becomes part of the annual planning cycle, and the in-depth assessments are repeated each year.

What the example teaches

The starting point was a business problem, not a wish to "get to level 3".
Importance ratings prevented wasted effort on a capability that was already good enough.
A few priority capabilities, piloted in one area, produced visible results that justified scaling.
POMs gave concrete practices and metrics, and success was judged by business indicators as well as maturity scores.

Lesson 7 – Relationship to other standards and frameworks

IT-CMF calls itself an umbrella framework. It is intended to work above and alongside specialist frameworks, helping leaders decide which capabilities need attention; the specialist frameworks then supply detailed practices for those areas. Understanding the differences helps you avoid both duplication and gaps.

Framework	Owner	Main focus	How it relates to IT-CMF
COBIT 2019	ISACA	Governance and management objectives for enterprise information and technology, with a capability and maturity approach	Strong overlap on governance, risk and value. COBIT is control- and audit-oriented and widely used by auditors; IT-CMF is more business-value and improvement-oriented. Many organisations use COBIT for control objectives and IT-CMF to prioritise improvement.
ITIL (ITIL 4; ITIL Version 5 launched in 2026)	PeopleCert (which acquired Axelos)	Service management guidance and practices	ITIL gives detailed guidance for capabilities such as Service Provisioning and Relationship Management; IT-CMF places service management inside a wider picture that includes budgeting, portfolio and benefits.
CMMI	CMMI Institute (ISACA)	Process maturity for development, services, suppliers and related areas, with formal appraisals	IT-CMF borrowed the maturity-level concept from the CMM family but applies it to IT management as a whole and adds outcome maturity. CMMI has a formal appraisal and rating scheme; IT-CMF does not have an equivalent public rating scheme.
ISO/IEC 38500	ISO and IEC	Principles for the governance of IT by a board and top management	Short, principle-based standard for directors. IT-CMF's Governance, Leadership and value capabilities help put such principles into management practice.
TOGAF Standard	The Open Group	Enterprise architecture method and content	Provides detailed method for the Enterprise Architecture Management capability; IT-CMF measures how mature that capability is and how it links to strategy and portfolio decisions.
ISO/IEC 20000-1 and ISO/IEC 27001	ISO and IEC	Certifiable management system requirements for service management and information security	Give auditable requirements and certificates for specific domains. IT-CMF can show how mature the related capabilities (Service Provisioning, Information Security Management) are, but does not certify them.

Choosing how to combine them

A practical pattern is to use IT-CMF at the top to agree strategy, priorities and target maturity in business terms, then use specialist frameworks inside each priority capability. If the assessment says Information Security Management is the priority, the team might use ISO/IEC 27001 and its controls to implement improvements, while still tracking progress with IT-CMF's maturity scale and CPIs. If Service Provisioning is the priority, ITIL practices are the natural toolbox. This avoids the trap of adopting every framework everywhere, which was exactly the problem IT-CMF was created to address.

IT-CMF is also distinct from other "capability maturity" models with similar names, such as the Business Process Maturity Model or the Portfolio, Programme and Project Management Maturity Model (P3M3). They measure narrower domains; IT-CMF's distinguishing feature is its breadth across the whole management of IT and its emphasis on business value.

Common pitfalls and best practices

Common pitfalls

Chasing scores. Treating maturity levels as targets in themselves leads to "level 3 everywhere" plans that are expensive and unrelated to strategy. The scale is a diagnostic tool, not a league table.
Assessing without acting. Running a large assessment, presenting attractive charts and then stopping wastes respondents' goodwill and makes the next assessment harder.
Too many priorities. Trying to improve ten or more capabilities at once spreads effort too thin and produces no visible results.
IT-only participation. If only IT people answer the survey, the profile shows how IT sees itself, not how the business experiences IT.
Ignoring importance. Investing in capabilities that are low in importance, or already above target, while important gaps remain open.
Copying POMs as a checklist. Implementing every listed practice regardless of context, instead of choosing those that fit and tracking their metrics.
Skipping levels. Expecting a capability to jump from level 1 to level 4 in one step without building the foundations of levels 2 and 3.

Best practices

Start from a business problem or opportunity and keep it visible throughout the programme.
Secure executive sponsorship early, ideally shared between IT and the business, and make improvement goals part of leaders' own objectives.
Explain the maturity scale to executives before they see results, so that a low score in an unimportant area does not cause alarm.
Pick a small set of priority capabilities where importance is high and the gap is large, and pilot before scaling.
Link every improvement to measurable outcomes using POMs and CPIs, and review benefits, not just activity.
Reassess periodically with the same method so that progress is comparable over time.
Build a community of practice around priority capabilities to share lessons and speed up adoption.
Combine frameworks deliberately, using IT-CMF to prioritise and specialist frameworks to implement.

Summary and key takeaways

IT-CMF is a proprietary, business-oriented framework from the Innovation Value Institute for managing and improving IT capabilities so that IT delivers agility, innovation and value.
Its architecture has three layers: four Macro-Capabilities, a modular library of Critical Capabilities (36 in the 2016 book, 37 in the current public list) and Capability Building Blocks.
The four Macro-Capabilities form a feedback loop: direction, budget, delivery, value and back to direction.
Each capability and building block has five cumulative maturity levels, from Initial to Optimizing, judged by approach, scope and predictability of outcomes.
Higher maturity is not automatically better: targets should follow business importance and strategy.
POMs, CPIs and management artefacts turn assessment gaps into concrete practices with measurable outcomes.
The Capability Improvement Programme provides a four-phase route from discovery to sustained improvement, and assessments are only its starting point.
There is no public organisational certification against IT-CMF; it complements, rather than replaces, frameworks such as COBIT, ITIL, CMMI and ISO standards.

Reflection questions

Which one of the four Macro-Capabilities do you think is weakest in your organisation today, and what concrete evidence would you show a sceptical executive to support that view?
Choose two Critical Capabilities that matter most for your organisation's current strategy. What target maturity would you set for each, and why not higher?
If business leaders and IT staff gave very different maturity ratings for the same capability, how would you run the conversation that follows?
Pick a business outcome your organisation cares about. Which capabilities would most influence it, and which metric would show that an improvement had worked?
Your organisation already uses ITIL and ISO/IEC 27001. How would you introduce IT-CMF without creating a sense of "yet another framework"?