What Is a Maturity Model in ITIL & ITSM?

Businesses and organizations constantly need to monitor performance and identify areas of improvement. Maturity models are a tool, often used in IT departments, customer-centric organizations, and software companies, to measure the success of management processes, styles, and IT systems.

In this article, we look at how maturity models apply to the following in a company's IT operations:

• Information Technology Infrastructure Library (ITIL)
• Information Technology Service Management (ITSM)

Both are areas where operational, management, and software efficiency is mission-critical for the overall success of an organization. ITIL is a set of best practices for ITSM, so an ITIL maturity assessment and an ITSM maturity assessment overlap heavily. A service desk maturity assessment is narrower, because it rates how the desk itself runs whether or not you follow ITIL.

What Is a Maturity Model in ITSM and What Is It Used For?

A maturity model is a staged scale that rates how consistently a team runs its processes and how well it improves them, from ad-hoc at the bottom to optimized at the top. In IT Service Management, it shows a service desk manager where the team stands today and which area to improve first.

A framework such as ITIL tells you which practices to follow. A maturity model rates how well you follow them.

Maturity models have a reputation for jargon, but the idea is simple. Key Performance Indicators (KPIs) and Objectives and Key Results (OKRs) track results against targets. A maturity model rates the capability behind those results. When it is applied well, it can make a noticeable difference to ITIL and ITSM operations and teams.

According to Process Street: "A maturity model shows how capable an organization or system is of achieving continuous improvement."

It's a way of assessing current IT performance and outputs (for example, KPIs and customer success scores) — using quantitative and qualitative data — looking at what you want to achieve within a fixed timescale. In any organization, including ITIL and ITSM teams, maturity is assessed on "how good your organization or system is at self-improvement."

It's not simply two milestones, where we are and where we want to get to. Maturity models are tools for assessing how well an organization or team can get from A to B. In other words:

• Have you, as an operational function, made improvements and iterations in the past?
• What have you learned from them?
• How skilled are you at making ongoing improvements? 

Maturity models measure operational improvement milestones on an upwards curve, from ad-hoc to optimized. Repeatable, controlled, and managed are milestones on the way towards optimized organizational self-improvement, and this applies to ITIL and ITSM departments as much as any within a business.

How Is an IT Maturity Model Used in ITIL?

Maturity models usually describe five levels. The scale below follows the structure of the classic Capability Maturity Model, which Carnegie Mellon University's Software Engineering Institute developed for software processes and which other maturity models have adapted over time. The level names below are an adaptation of the standard ones, and the scale works as a general ladder for ITIL and ITSM teams. The ITIL Maturity Model that PeopleCert publishes uses a different set of five names, covered later in this article:

1. Ad-hoc: ITIL is the best practice framework many organizations use to run ITSM, aligning IT systems and processes with business goals, but at the ad-hoc stage that guidance is applied inconsistently, if at all. At this stage of the maturity model, processes and functions, and the way systems and vendors are integrated and deployed to support ITSM operations are disorganized.

   Significant improvement is needed when a maturity model assessment identifies that ITIL and ITSM functions are only at the ad-hoc, or initial, stage of operational maturity.

2. Repeatable: At this stage, an organization has attempted to bring some order to ITIL operational functions, processes, systems, and vendor integration. Although far from perfect, KPIs are now in use and stakeholders and outcomes are identified before any service improvements are implemented.

3. Controlled: At the controlled, or defined level, there's a more regulated, qualitative and quantitative approach to ITIL operations. For example, organizations at this stage of maturity have usually:

   • Documented ITIL functions and how they relate to ITSM and business objectives and goals, with clear and continuously monitored KPIs and other performance indicators
   • Implemented appropriate measures and processes
   • Applied corporate knowledge, approaches, and an awareness of external stakeholder needs, including customers, to ITIL process execution
   • Provided regular training to ITIL and ITSM staff, with far greater integration and coordination between IT functions and vendors

4. Managed: At this level, the fourth of the five levels, organizations should have implemented the following:

   • A clear alignment between high-level organizational and corporate goals and objectives and ITIL and ITSM functions
   • Continuous wide-scale monitoring of appropriate metrics, including KPIs, OKRs, Service Level Agreements (SLAs), response times, and internal and external customer help desk satisfaction scores
   • Automation and monitoring tools are widely used
   • Cross-functional collaboration and knowledge sharing are in place and contributing to performance improvements and iterative best practice learnings

5. Optimized: At the fifth and final maturity model level, ITIL processes are reliable, reducing the risk of IT systems failures, and they are subject to strong governance controls.

   Automation and monitoring tools are implemented throughout every system and process touchpoint. At this stage, there are constant iterative feedback loops, and carefully managed, consistent governance controls across ITIL and ITSM functions. ITIL operations are integrated across the organization.

How Is an IT Maturity Model Used in ITSM? 

An IT maturity assessment is something that organizations should factor in before making further ITSM improvements. A tool automates the processes you already have, so automating an undefined process only produces inconsistent results faster.

Often, the gap between the ITSM service levels an organization needs and what it is achieving comes down to the maturity of its ITSM function. Ad-hoc and undocumented IT processes tend to produce poor outcomes, including missed SLAs and KPIs.

ITSM teams can apply the same maturity model framework outlined above to achieve continuous improvements. Once this model is applied, you can repeat the assessment on a regular schedule, and review your KPIs in between, to see whether the iterative changes you've made are moving your ITSM function up the scale.

How Do You Assess Your Own Service Desk's Maturity?

To assess your own service desk, score it against a fixed set of questions, then compare the total with a maturity scale. Giva offers two free Excel self-assessments for this, and they answer different questions:

What Should You Do After You Score Yourself?

1. Have two or three people score independently, then compare answers. Differences show where the team disagrees about how the work really gets done.
2. Start with the lowest-scoring area. The 25-question assessment gives a subtotal for each of its five sections, and the ITIL worksheet gives a score for each lifecycle stage.
3. Pick one or two weak areas and write down one specific change for each, with an owner and a due date.
4. Score again on a regular schedule, such as every six months, and compare the results with your earlier scores to see whether the changes worked.

Aim to move up one level at a time. Fixing the weaknesses that hold a team at its current level is a more realistic goal than jumping straight to optimized. If your scores are low or uneven, our article on the people, process, technology framework shows how to find out which layer is failing first, and our ITSM best practices cover what to improve once you know your starting level.

Giva's worksheets are not the only way to score yourself. Here are a few other ITIL and ITSM assessment tools that organizations use to assess maturity levels and make improvements.

IT Maturity Assessment Tools for ITIL and ITSM

1. Infotech Service Management Maturity Assessment Tool

   Infotech (formerly Info-Tech Research Group) is an IT research and advisory firm that says it has more than 30,000 members worldwide. It offers a Service Management Maturity Assessment Tool that sits behind a registration form.

   Using this tool, you can assess your ITIL and ITSM level of maturity, "as well as percentage of completeness for individual processes." The tool helps and guides IT leaders through a phased process which culminates in an IT service management roadmap.

2. Gartner IT Score

   Gartner IT Score is a Gartner assessment tool that helps IT leaders assess IT maturity and plan improvements. It offers separate diagnostics for several IT roles, such as the CIO and infrastructure and operations leaders, rather than a service desk assessment. Gartner offers an interactive demo after you enter a work email, along with a sample report for each role.

3. PeopleCert ITIL Maturity Model

   PeopleCert acquired Axelos in 2021 and now owns ITIL. ITIL was originally developed by the UK government, and Axelos, a joint venture of the UK Cabinet Office and Capita formed in 2013, managed it until the acquisition.

   PeopleCert also publishes the ITIL Maturity Model, which assesses an organization's service management capabilities and the maturity of its service value system. Depending on the type of assessment, it rates the service value system on five levels (Initial, Managed, Defined, Quantitative, and Optimizing), rates individual ITIL practices on capability levels from 1 to 5, or does both. PeopleCert says formal assessments are carried out by its Accredited Consulting Partners, and that the model can be used for any service management approach. PeopleCert's ITIL Capability and Maturity Assessment page explains the assessment types.

   The framework itself is also changing. ITIL (Version 5) is the next version of ITIL, which PeopleCert is rolling out in phases. ITIL 4 remains available for now.

   PeopleCert's ITIL certification scheme is a separate, modular path for individuals, so treat it as training rather than an assessment of your own service desk.

Although there are many software solutions out there to support IT service and maturity improvements, the best way forward is to assess your level of maturity first, and then find a suitable tool to take the organization and IT functions forward. A free self-assessment, such as Giva's 25-Question Service Desk Assessment, is a quick way to take that first step.