{"id":79530,"date":"2026-10-28T05:07:24","date_gmt":"2026-10-28T05:07:24","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=79530"},"modified":"2026-10-28T05:07:25","modified_gmt":"2026-10-28T05:07:25","slug":"master-catalogue-process-maturity-models-standards-and-frameworks","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/master-catalogue-process-maturity-models-standards-and-frameworks\/","title":{"rendered":"Master Catalogue: Process Maturity Models, Standards and Frameworks"},"content":{"rendered":"\n

The key is to document each framework accurately: not every standard has maturity levels, and we shouldn’t invent levels for frameworks that don’t define them.<\/p>\n\n\n\n

Here’s the structure I recommend for the complete guide.<\/p>\n\n\n\n

1. Software process improvement and maturity<\/h2>\n\n\n\n
#<\/th>Framework<\/th>Main process area<\/th>Maturity \/ capability structure<\/th><\/tr>
1<\/td>ASPICE<\/td>Automotive software and systems engineering<\/td>Capability levels CL0\u2013CL5<\/td><\/tr>
2<\/td>SPICE<\/td>Software process assessment<\/td>Depends on the applicable assessment model; commonly CL0\u2013CL5<\/td><\/tr>
3<\/td>CMMI<\/td>Organizational capability and performance<\/td>Traditional maturity levels 1\u20135; capability ratings depend on model and appraisal<\/td><\/tr>
4<\/td>ISO\/IEC 330xx<\/td>Process assessment and capability determination<\/td>Defined by the relevant standard and assessment model<\/td><\/tr>
5<\/td>ISO\/IEC 15504<\/td>Legacy process assessment standards<\/td>Historical capability levels 0\u20135<\/td><\/tr>
6<\/td>Automotive SPICE for Cybersecurity<\/td>Automotive cybersecurity processes<\/td>Depends on the applicable model and assessment scope<\/td><\/tr>
7<\/td>MDevSPICE<\/td>Medical device software and systems processes<\/td>Model-specific assessment structure<\/td><\/tr>
8<\/td>TMMi<\/td>Software testing maturity<\/td>Maturity levels 1\u20135<\/td><\/tr>
9<\/td>TPI NEXT<\/td>Test process improvement<\/td>Maturity levels: Initial, Controlled, Efficient, Optimizing<\/td><\/tr>
10<\/td>IT-CMF<\/td>IT capability management<\/td>Capability assessment structure defined by the model<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

2. Software testing and product quality<\/h2>\n\n\n\n
#<\/th>Framework \/ standard<\/th>Main process area<\/th>Maturity \/ capability structure<\/th><\/tr>
11<\/td>TMMi<\/td>Testing process maturity<\/td>Levels 1\u20135<\/td><\/tr>
12<\/td>TPI NEXT<\/td>Testing process improvement<\/td>Four maturity levels<\/td><\/tr>
13<\/td>ISO\/IEC\/IEEE 29119<\/td>Software testing processes and documentation<\/td>No universal maturity-level scale<\/td><\/tr>
14<\/td>ISO\/IEC 25010<\/td>Software product quality<\/td>Quality characteristics and subcharacteristics, not maturity levels<\/td><\/tr>
15<\/td>ISO\/IEC\/IEEE 730<\/td>Software quality assurance<\/td>No universal maturity-level scale<\/td><\/tr>
16<\/td>Six Sigma<\/td>Process variation and defect reduction<\/td>DMAIC improvement cycle; not a universal maturity scale<\/td><\/tr>
17<\/td>CISQ<\/td>Software quality measurement<\/td>Quality characteristics and measurement approaches<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

3. Automotive, embedded and safety-critical engineering<\/h2>\n\n\n\n
#<\/th>Standard \/ framework<\/th>Main process area<\/th>Maturity \/ capability structure<\/th><\/tr>
18<\/td>ISO 26262<\/td>Automotive functional safety<\/td>ASIL classifications A\u2013D; these are not maturity levels<\/td><\/tr>
19<\/td>ISO\/SAE 21434<\/td>Automotive cybersecurity engineering<\/td>No universal organizational maturity scale<\/td><\/tr>
20<\/td>IEC 61508<\/td>Functional safety<\/td>Safety Integrity Levels SIL 1\u20134; not maturity levels<\/td><\/tr>
21<\/td>DO-178C<\/td>Airborne software assurance<\/td>Design Assurance Levels A\u2013E; not maturity levels<\/td><\/tr>
22<\/td>DO-254<\/td>Airborne electronic hardware assurance<\/td>Design Assurance Levels A\u2013E; not maturity levels<\/td><\/tr>
23<\/td>IEC 62304<\/td>Medical device software lifecycle<\/td>Software safety classes A, B and C; not maturity levels<\/td><\/tr>
24<\/td>ISO 13485<\/td>Medical device quality management<\/td>No universal maturity-level scale<\/td><\/tr>
25<\/td>EN 50128<\/td>Railway software<\/td>Safety integrity and assurance requirements depend on the applicable standard and context<\/td><\/tr>
26<\/td>ISO\/IEC\/IEEE 12207<\/td>Software lifecycle processes<\/td>No universal maturity-level scale<\/td><\/tr>
27<\/td>ISO\/IEC\/IEEE 15288<\/td>Systems lifecycle processes<\/td>No universal maturity-level scale<\/td><\/tr>
28<\/td>ISO\/IEC 29110<\/td>Very small software and systems engineering organizations<\/td>Profiles and lifecycle practices depend on the applicable profile<\/td><\/tr>
29<\/td>SPICE for Space<\/td>Space engineering process assessment<\/td>Depends on the specific assessment model<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

4. Cybersecurity and information security<\/h2>\n\n\n\n
#<\/th>Framework \/ standard<\/th>Main process area<\/th>Maturity \/ capability structure<\/th><\/tr>
30<\/td>ISO\/IEC 27001<\/td>Information security management<\/td>No universal maturity-level scale<\/td><\/tr>
31<\/td>NIST Cybersecurity Framework<\/td>Cybersecurity risk management<\/td>Four implementation tiers: Partial, Risk Informed, Repeatable, Adaptive<\/td><\/tr>
32<\/td>NIST SP 800-53<\/td>Security and privacy controls<\/td>Control baselines and assessment methods, not maturity levels<\/td><\/tr>
33<\/td>SOC 2<\/td>Trust services and control assurance<\/td>Type I and Type II examination\/reporting; not maturity levels<\/td><\/tr>
34<\/td>PCI DSS<\/td>Payment card data security<\/td>Compliance levels and validation requirements depend on applicable criteria<\/td><\/tr>
35<\/td>IEC 62443<\/td>Industrial automation and control security<\/td>Security levels SL0\u2013SL4 in relevant parts; not organizational maturity levels<\/td><\/tr>
36<\/td>ISO\/SAE 21434<\/td>Automotive cybersecurity<\/td>No universal maturity-level scale<\/td><\/tr>
37<\/td>CMMC<\/td>US defense industrial base cybersecurity<\/td>Three program levels in the current CMMC model; verify current requirements<\/td><\/tr>
38<\/td>ISO\/IEC 42001<\/td>AI management systems<\/td>No universal maturity-level scale<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

5. IT service management and governance<\/h2>\n\n\n\n
#<\/th>Framework \/ standard<\/th>Main process area<\/th>Maturity \/ capability structure<\/th><\/tr>
39<\/td>ITIL<\/td>IT service management<\/td>Version- and assessment-specific qualification or maturity approaches<\/td><\/tr>
40<\/td>COBIT<\/td>Enterprise IT governance and management<\/td>Capability and performance assessment approaches depend on the applicable COBIT components<\/td><\/tr>
41<\/td>ISO\/IEC 20000-1<\/td>IT service management system<\/td>No universal maturity-level scale<\/td><\/tr>
42<\/td>FitSM<\/td>Lightweight IT service management<\/td>Defined requirements and assessment approaches; not a universal maturity scale<\/td><\/tr>
43<\/td>VeriSM<\/td>Enterprise service management<\/td>No universal maturity-level scale<\/td><\/tr>
44<\/td>ISO 22301<\/td>Business continuity management<\/td>No universal maturity-level scale<\/td><\/tr>
45<\/td>ISO 31000<\/td>Risk management guidelines<\/td>No universal maturity-level scale<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

6. Business excellence and organizational maturity<\/h2>\n\n\n\n
#<\/th>Framework<\/th>Main process area<\/th>Maturity \/ capability structure<\/th><\/tr>
46<\/td>EFQM Model<\/td>Organizational excellence<\/td>Recognition and assessment approaches; not a universal five-level maturity scale<\/td><\/tr>
47<\/td>Baldrige Excellence Framework<\/td>Organizational performance<\/td>Criteria-based assessment and scoring<\/td><\/tr>
48<\/td>Lean Management<\/td>Waste reduction and value delivery<\/td>No universal maturity-level scale<\/td><\/tr>
49<\/td>Kaizen<\/td>Continuous improvement<\/td>No universal maturity-level scale<\/td><\/tr>
50<\/td>BPMM<\/td>Business process maturity<\/td>Depends on the specific BPMM model; commonly described using five maturity levels<\/td><\/tr>
51<\/td>OPM3<\/td>Organizational project management<\/td>Assessment and capability improvement structure defined by the model<\/td><\/tr>
52<\/td>P3M3<\/td>Portfolio, programme and project management<\/td>Maturity levels 1\u20135<\/td><\/tr>
53<\/td>People CMM<\/td>Workforce and people-management capability<\/td>Maturity levels 1\u20135<\/td><\/tr>
54<\/td>DMM<\/td>Data management maturity<\/td>Maturity levels 1\u20135 in the model<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

7. Additional categories to include in a truly comprehensive catalogue<\/h2>\n\n\n\n

To avoid limiting the guide to the original 54 entries, I would also add these related frameworks and standards.<\/p>\n\n\n\n

#<\/th>Framework \/ standard<\/th>Main area<\/th><\/tr>
55<\/td>ISO 9001<\/td>Quality management systems<\/td><\/tr>
56<\/td>ISO 14001<\/td>Environmental management<\/td><\/tr>
57<\/td>ISO 45001<\/td>Occupational health and safety<\/td><\/tr>
58<\/td>ISO 50001<\/td>Energy management<\/td><\/tr>
59<\/td>ISO 22316<\/td>Organizational resilience<\/td><\/tr>
60<\/td>ISO\/IEC 38500<\/td>Governance of IT<\/td><\/tr>
61<\/td>ISO\/IEC 27701<\/td>Privacy information management<\/td><\/tr>
62<\/td>ISO\/IEC 20000 family<\/td>IT service management<\/td><\/tr>
63<\/td>ISO\/IEC 38505 family<\/td>Governance of data<\/td><\/tr>
64<\/td>NIST SP 800-218 (SSDF)<\/td>Secure software development<\/td><\/tr>
65<\/td>OWASP SAMM<\/td>Software assurance maturity<\/td><\/tr>
66<\/td>BSIMM<\/td>Software security practices and measurement<\/td><\/tr>
67<\/td>OWASP ASVS<\/td>Application security verification requirements<\/td><\/tr>
68<\/td>OWASP MASVS<\/td>Mobile application security verification<\/td><\/tr>
69<\/td>SAFe<\/td>Enterprise Agile development and delivery<\/td><\/tr>
70<\/td>Scrum<\/td>Agile product development framework<\/td><\/tr>
71<\/td>Kanban Method<\/td>Workflow management and improvement<\/td><\/tr>
72<\/td>ISO\/IEC 38507<\/td>Governance implications of AI use by organizations<\/td><\/tr>
73<\/td>ISO\/IEC 23894<\/td>AI risk management<\/td><\/tr>
74<\/td>ISO\/IEC 27017<\/td>Cloud security controls<\/td><\/tr>
75<\/td>ISO\/IEC 27018<\/td>Protection of personal information in public clouds<\/td><\/tr>
76<\/td>ISO\/IEC 27799<\/td>Health informatics information security<\/td><\/tr>
77<\/td>ISO\/IEC 19770<\/td>IT asset management<\/td><\/tr>
78<\/td>ISO 10006<\/td>Quality management in projects<\/td><\/tr>
79<\/td>ISO 21502<\/td>Project, programme and portfolio management guidance<\/td><\/tr>
80<\/td>PRINCE2<\/td>Project management method<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

These additional entries expand the catalogue across quality, environmental management, occupational safety, software security, Agile delivery, AI governance, cloud security, and project management.<\/p>\n\n\n\n

Important qualification: This is a broad catalogue, not a claim that all 80 entries are maturity models. Some are standards, some are methods, some are security verification frameworks, and some are organizational assessment models.<\/p>\n\n\n\n

<\/p>\n","protected":false},"excerpt":{"rendered":"

The key is to document each framework accurately: not every standard has maturity levels, and we shouldn’t invent levels for frameworks that don’t define them. Here’s the… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[11138],"tags":[],"class_list":["post-79530","post","type-post","status-publish","format-standard","hentry","category-best-tools"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/79530","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=79530"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/79530\/revisions"}],"predecessor-version":[{"id":79531,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/79530\/revisions\/79531"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=79530"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=79530"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=79530"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}