CMMI, the Capability Maturity Model Integration, is a process improvement framework that rates an organization's maturity from Level 1 (Initial) to Level 5 (Optimizing), administered by ISACA. The current version is V3.0, released in April 2023, and since 1 January 2024 it is the only version accepted for appraisals. This guide covers the levels, the capability-versus-maturity distinction that trips up almost everyone, what an appraisal involves, and what changed recently enough that most articles are still wrong about it.
One disambiguation first, because the acronym is shared: this article is about the Capability Maturity Model Integration, not the Center for Medicare and Medicaid Innovation, which is also abbreviated CMMI.
What is CMMI?
CMMI is a model that describes what good process discipline looks like, in enough detail that an organization can be appraised against it and given a level. It began at Carnegie Mellon's Software Engineering Institute, funded by the US Department of Defense, with the original Capability Maturity Model study in 1986. The product suite moved from the SEI to the CMMI Institute by January 2013, and ISACA acquired the CMMI Institute in March 2016. ISACA administers it today, and reports more than 14,000 appraised organizations.
The core idea is that capability is a property of process, not of heroics. An organization at Level 1 can still ship excellent work, but it does so through individual effort that disappears when those individuals do. Higher levels mean the result is reproducible without them.
V3.0 organizes the model into 8 domains: Data, Development, People, Safety, Security, Services, Suppliers, and Virtual, spanning 31 practice areas.
CMMI maturity levels
Maturity levels describe the organization as a whole across a predefined set of practice areas. There are five, and they are sequential: each subsumes everything below it.
| Level | Name | What it actually means |
|---|---|---|
| 1 | Initial | Work gets done, unpredictably. Process is ad hoc and reactive, and success depends on who happens to be doing it. |
| 2 | Managed | A simple but complete set of practices exists and is followed at the project level. It does not yet require organization-wide standards. |
| 3 | Defined | Work runs on organizational standards, tailored to each project rather than reinvented. This is where most organizations aiming for a rating stop. |
| 4 | Quantitatively Managed | The organization identifies and understands variation, and predicts and improves its ability to hit quality and process performance objectives using data. |
| 5 | Optimizing | Statistical and other quantitative techniques are used to continuously optimize performance. |
A correction worth flagging: several widely-read articles list a "Level 0: Incomplete" among the maturity levels. That is wrong. Level 0 belongs to the capability levels, not the maturity levels, which run 1 through 5 only. If a source shows a Level 0 maturity level, it has conflated the two scales, which is the exact confusion the next section exists to clear up.
Capability levels vs maturity levels
This is the single most common point of confusion, to the extent that ISACA maintains a support article about it. The distinction is about scope.
| Capability levels | Maturity levels | |
|---|---|---|
| Applies to | An individual practice area | The organization, across a predefined set of practice areas |
| Range | 0 to 3 | 1 to 5 |
| Level 0 exists | Yes (Incomplete) | No |
| Answers | "How good are we at this one thing?" | "How mature is this organization overall?" |
The capability levels are 0 Incomplete, 1 Initial, 2 Managed, and 3 Defined. So you can hold a capability level in, say, Configuration Management specifically, while the organization holds a maturity level overall. Practically: capability levels let you improve the handful of areas your business actually cares about; maturity levels are what you pursue when a customer or a contract requires a rating.
Staged and continuous representations: historical, not a choice
Plenty of current articles present staged versus continuous as a decision you make when adopting CMMI. It is not, and has not been for years. In the V1.3 era the model shipped in two representations: staged, which gave you a standard sequence of improvements expressed as maturity levels, and continuous, which let you focus on the specific processes that mattered to your immediate business objectives, expressed as capability levels. In V2.0 that separation was cancelled, and there is now a single cohesive model. The capability-versus-maturity distinction above survives; the fork in the road does not.
This matters when you are reading up on CMMI: any page still walking you through "choosing your representation," or referring to SCAMPI appraisal classes, is describing a version of the model that has not been appraisable since the end of 2023.
CMMI appraisals: the four types
An appraisal is the formal evaluation against the model. There are four types, and only one of them produces a rating you can put in a proposal.
| Appraisal type | Purpose | Produces a rating? | Validity |
|---|---|---|---|
| Benchmark | The rigorous, full evaluation. The only route to a maturity or capability level rating. | Yes | 3 years |
| Sustainment | Extends an existing Benchmark rating without repeating the full appraisal. | Extends one | 2 additional years |
| Evaluation | Informal gap analysis and readiness check before the real thing. | No | Not applicable |
| Action Plan Reappraisal | Follows a Benchmark or Sustainment appraisal that narrowly missed the target level. | Yes | Per the original |
Note the terminology shift: SCAMPI is legacy. The Standard CMMI Appraisal Method for Process Improvement, with its Class A, B, and C appraisals, belongs to V1.3. Class A was the only one that could yield a level rating, which is why "SCAMPI Class A" still echoes around the internet. In 2026 the four types above are the current scheme.
On cost, we are going to decline to give you a number. ISACA does not publish appraisal pricing; its own guidance says cost varies by organization size, location, and context, and directs you to contact a CMMI Partner. The dollar figures circulating online trace back to low-authority aggregators and generally reference the obsolete SCAMPI method, so quoting them would be inventing precision. The one durable timing data point comes from historical SEI data: the median time to move from Level 1 to Level 2 was about 5 months, with another 21 months to reach Level 3. Budget in quarters, not weeks.
What changed in V3.0
V3.0 landed in April 2023 and became mandatory for appraisals on 1 January 2024. Against V2.0 it added a Managing Data capability area, three new practice areas (Data Management, Data Quality, and Workforce Empowerment), and renamed Enabling Virtual Solution Delivery to Enabling Virtual Work. The direction is obvious: data governance and distributed work became first-class concerns rather than footnotes.
The newest development is CMMI AIM, an AI Maturity framework. ISACA's CMMI Institute completed the AIM pilot with IBM Consulting, Infosys, and Government Technical Services Corporation, and the framework formally launched at the Capability Creates Conference on 23 and 24 June 2026. If you are evaluating maturity frameworks for AI adoption specifically, this is the newest option in the space and worth watching before you commit to a homegrown scale.
Maturity models beyond CMMI
CMMI is the ancestor, but "maturity model" now describes a whole genre: a framework that measures an organization's ability to improve in some discipline, usually as a sequence of levels from nonexistent to optimized, assessed across people and culture, process and structure, and technology. The broadest version, applied to the company as a whole, is the organizational maturity model, and the same five-level ladder is explained in our guide to organizational maturity levels.
Two distinctions help when you are comparing them. First, descriptive versus prescriptive: a descriptive model tells you your current level, while a prescriptive one also names a target and the route there. Second, staged versus focus-area: staged models like CMMI use fixed levels for the whole organization, while focus-area models assess a set of specific capabilities independently, which suits domains where nobody needs to be uniformly excellent.
The common ones you will run into:
- Digital maturity models borrow CMMI's level concept and apply it across digital, data, platform, and operating-model dimensions, usually landing on a 4 or 5 level scale. Our digital maturity model explainer covers this in detail.
- Cybersecurity maturity models including C2M2, SSE-CMM, and CMMC 2.0, the US Department of Defense scheme announced in November 2021.
- Domain-specific CMMs for project management, business process, DevOps, and performance management.
- AI maturity models, now including CMMI AIM.
Process maturity also runs straight into compliance, and the overlap is larger than most teams expect. The evidence a Level 3 appraisal wants (defined processes, documented tailoring, records showing the process was actually followed) is close to what an auditor asks for, which is why organizations serious about both usually end up tracking obligations and mapping them to controls in one place rather than rebuilding the evidence trail for every framework separately.
Frequently asked questions
What are the 5 levels of CMMI?
Level 1 Initial, Level 2 Managed, Level 3 Defined, Level 4 Quantitatively Managed, and Level 5 Optimizing. They are sequential and cumulative: Level 3 includes everything Level 2 requires. There is no Level 0 maturity level, despite what several popular articles say; Level 0 exists only on the capability scale.
What is the difference between a maturity level and a capability level?
A capability level rates a single practice area and runs 0 to 3. A maturity level rates the whole organization across a predefined set of practice areas and runs 1 to 5. Use capability levels to improve the specific areas your business depends on; pursue a maturity level when a customer or contract requires an overall rating.
Is CMMI a certification?
Not exactly, and the distinction matters in procurement. CMMI produces an appraisal rating, not a certification. A Benchmark appraisal conducted by a certified lead appraiser results in a maturity or capability level rating that is valid for three years, extendable by two more with a Sustainment appraisal. People say "CMMI certified" constantly; the accurate phrase is "appraised at Level 3."
How long is a CMMI appraisal valid?
A Benchmark appraisal rating is valid for three years. A Sustainment appraisal extends it by an additional two years without repeating the full Benchmark, which is why organizations that need to hold a level tend to alternate between the two rather than re-running the rigorous appraisal every three years.
What is the current version of CMMI?
CMMI V3.0, released in April 2023. Since 1 January 2024, only V3.0 appraisals are accepted. If you are reading material that references V1.3, staged versus continuous representations as a live choice, or SCAMPI appraisal classes, it predates the current model by two major versions.
How much does a CMMI appraisal cost?
ISACA does not publish appraisal pricing, and says cost depends on organization size, location, and context, directing prospective clients to CMMI Partners for a quote. Figures circulating online generally come from low-authority sources referencing the obsolete SCAMPI method, so treat any specific number you find with suspicion and get a quote from a Partner instead.
When you need a maturity read, not an appraisal
Most organizations asking about CMMI do not actually need an appraisal. They need to know roughly where they stand, and whether the problem they can feel is process discipline or something else. A formal appraisal is the right answer when a contract demands a rating; it is an expensive way to answer "are we any good at this?" Where the rating exists to satisfy a customer or regulator rather than to improve anything, the cheaper honest read is a compliance readiness assessment covering what you can actually evidence today.
That is the gap Assessmentcloud fills, and we want to be precise about the boundary. We are not a CMMI appraisal, we do not issue ratings, and no result from us satisfies a procurement requirement. What our process maturity assessment does is score your process discipline 0 to 100 against the industry median, alongside digital maturity, culture, skills, and compliance readiness, in one report with a ranked action plan, flat from $49 a month. It is diagnostic input designed to tell you where you stand and what to fix first, including whether a formal appraisal is worth pursuing at all.
Sources
- ISACA, CMMI Model Quick Reference Guide, CMMI V3.0 (2024).
- ISACA, CMMI Performance Solutions and appraisal support documentation.
- Software Engineering Institute historical maturity-level transition data.
- ISACA press release, CMMI Institute completes pilot for new AI Maturity (AIM) framework (2026).
RUN IT, NOT JUST READ IT
Score this dimension for your company
The interactive sample readout on the homepage shows exactly what you get: scored dimensions, industry benchmarks, and a prioritized action plan. Flat pricing from $49 a month.