ISYS90038 Chap.9 ICT Governance Maturity
ICT Governance Maturity
Week 9 asks how mature an organisation's governance is, and how mature its alignment between business and IT is. Maturity models are guidelines rather than rigid frameworks, level five everywhere is seldom economically justified, and the module observes that in practice most organisations are found at the first or second level.
COBIT 2019 ties process activities to capability levels, starting at level 0 for an incomplete process, and rates each level as not, partially, largely or fully achieved; maturity levels apply to focus areas and are reached only when all required capability levels are met.
ITIL 4's maturity model gives practices a capability rating and the service value system a maturity rating, and the system is rated by its lowest-scoring component. Both frameworks therefore share a weakest-link logic: overall maturity is not an average of strengths and weaknesses.
Luftman's Strategic Alignment Maturity Model rates alignment through five stages and six criteria, from communication and value measurement to partnership and skills, and leads into a seven-step alignment process. Governance maturity and alignment maturity are related but not interchangeable.
The worked case applies the weakest-link rule to a college with a strong service desk and dormant governance, the shape of the practice exam's maturity question.
What this chapter covers
- 01
Maturity models as guidelines, and why level five is rarely the target
- 02
COBIT 2019 capability levels for processes and maturity levels for focus areas
- 03
COBIT's rating scale: not, partially, largely and fully achieved
- 04
The ITIL maturity model: capability for practices, maturity for the service value system
- 05
The weakest-link rule shared by both frameworks
- 06
Luftman's five stages and six alignment criteria, and the alignment process
Worked example · free
Justify a modest maturity target
- 1Principle: maturity models are guidelines, and pursuing high levels everywhere is costly and seldom economically justified.
- 1Evidence: starting mostly at level 0 (P5, L3–4) with a small budget (P6, L9) makes a jump to level 4 within a year (P7, L2) unrealistic.
- 1Alternative: set level 2 as the target, giving basic, repeatable control at a cost the hospital can carry.
- 1Sequence: raise the weakest governance processes first, since overall maturity is capped by the weakest area.
Key terms
- Capability level
- A rating of how well a single process or practice is performed, from incomplete upwards.
- Focus area
- In COBIT 2019, a collection of objectives and components that is given a maturity level.
- Weakest-link rule
- The principle that overall maturity is set by the lowest-rated component, not by an average.
- Practice success factor
- In ITIL 4, one of two to four factors per practice, each with criteria that set its capability level.
- Strategic alignment maturity
- Luftman's rating of how far business and IT are in harmony, across five stages and six criteria.
- Largely achieved
- A COBIT rating meaning more than half and up to 85 per cent of a level's activities are achieved.
ICT Governance Maturity FAQ
Why does the weakest area set the maturity rating?
Because governance holds only as well as its least developed part; one unresolved weakness can undermine outcomes however strong the rest are, so an average would overstate real capability.
Should an organisation aim for maturity level five?
Usually not. The module calls maturity models guidelines, notes that level five everywhere is seldom economically justified, and observes that in practice most organisations are found at the first or second level.
How does COBIT rate a capability level?
Each level's activities are rated not achieved, partially achieved, largely achieved or fully achieved by percentage. A level counts once it is largely or fully achieved, and only then is the next level assessed.
What are Luftman's six alignment criteria?
Communication, competency and value measurement, governance, partnership, scope and architecture, and skills. They rate the relationship between business and IT, which is different from rating governance processes.
Who can carry out a formal ITIL maturity assessment?
Only qualified assessors from accredited partners, not the organisation itself, and a representative assessment covers at least seven practices. In an exam you make an informal judgement, so name the framework whose logic you are applying.
Exam move
Learn the weakest-link rule as a sentence you can write without thinking, because the practice paper asks for it as a conceptual part with no case evidence. Then practise the applied part: find one strong and one weak area in a case, cite each, and state that the weak area caps overall maturity. Keep the COBIT rating scale and the ITIL level names straight, and remember that Luftman's model rates alignment, not processes.
When asked for a target, justify a modest one from cost and starting point.
Working through ICT Governance Maturity in ISYS90038? Sia is AskSia’s AI Information Technology tutor — ask any ISYS90038 ICT Governance Maturity question and get a clear, step-by-step explanation grounded in how ISYS90038 is taught and assessed. Read this chapter free, then take your hardest questions to Sia.
