The Self-assessment Guide is provided as a ‘stand-alone’ guide, which can be used by organisations to perfo

rigorous assessment of the capability of their IT processes. This may be a precursor to undertaking more rigorous evidenced-b
assessment. The approach is based on the COBIT PAM used in the COBIT 4.1 Assessment Programme, but does not require e
requirements in support of the self assessment, nor does it require use of the COBIT PAM; sufficient information from the PAM
full self-assessment template has been provided that simplifies the process without the need to reference the other two guide
COBIT Assessment Programme.

Instructions
1. It is recommended that the assessment be undertaken by a small team or reviewed by a team of IT management and/or ass
although independent assessors are not required for this.
1. Use the Process results tab (example in appendix A of the guide) to summarize your results of the assessments
2. If a more rigoruous assessment is required and/or evidentiary requirements to be produced then use the full assessor guide
templates at 3. and 4. of the toolkit
3. You are required to start at level 1 because that is where the specfic questions are asked about the process ouctomes and p
be achieved.
4. At Level 1 For each process be assessed ask if the process is achieveing its outcomes, answer yes or no; include any relevan
comments to support your conclusion.
5. For Level 1 you can RATE each of the outcomes but the assessment approach requires an overall assessment rating at the p
attribute level PA1.1

6. At higher levels you are no longer looking at specific process outcomes but at overall generic goals shown for each of the lev

7. To PASS a particular level the process must be rated Largely or Fully, to move onto the next level all attributes must be rated
for example if PA2.1 is Largely and PA2.2 Fully, you are deemed to be at Level 2 but the overall Level 2 rating must be a Fully t
to assess at higher levels.

8. Use this process as a 'pre-cursor' to a more detailed assessment and not as the definitive assessment of your IT processes.
 PROCESS ASSESSMENT RESULTS

Process Name To be Level 0 Level 1 Level 2 Level 3 Level 4

assessed

Plan and Organise

PO1 Define a strategic IT plan. F L
PO2 Define the information architecture.
PO3 Determine technological direction.
PO4 Define the IT processes, organisation and
relationships.
PO5 Manage the IT investment.
PO6 Communicate management aims and direction.

PO7 Manage IT human resources.

PO8 Manage quality.
PO9 Assess and manage IT risks.
PO10 Manage projects.

Acquire and Implement

AI1 Identify automated solutions.
AI2 Acquire and maintain application software.

AI3 Acquire and maintain technology

infrastructure.
AI4 Enable operation and use.
AI5 Procure IT resources.
AI6 Manage changes.
AI7 Install and accredit solutions and changes.

Deliver and Support

DS1 Define and manage service levels.
DS2 Manage third-party services. L
DS2 Manage performance and capacity.
DS4 Ensure continuous service.
DS5 Ensure systems security.
DS6 Identify and allocate costs.
DS7 Educate and train users.
DS8 Manage service desk and incidents.
DS9 Manage the configuration.
DS10 Manage problems.
DS11 Manage data.
DS12 Manage the physical environment.
DS13 Manage operations.

Monitor and Evaluate

ME1 Monitor and evaluate IT performance.
ME2 Monitor and evaluate internal control.
ME3 Ensure compliance with external
requirements.
ME4 Provide IT governance.
Level 5
N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

PO1 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

PO1 Define a strategic IT plan.

Purpose Satisfy the business requirement of sustaining or extending the business strategy and governance requirements while being transparent
about benefits, costs and risks

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of any
Incomplete fails to achieve its process purpose. achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

PO1-O1 Value management processes, including

business cases and benefits realisation, are
established.
PO1-O2 Business and IT are involved in strategic
planning.

PO1-O3 Current IT capabilities are defined.

PO1-O4 An IT strategic plan is prepared that

defines IT goals and priorities based on the
business objectives.
PO1-O5 IT tactical plans are prepared.

PO1- O6 Project and service portfolios are

prepared and managed.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this attribute:
measure of the extent to which the
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned and
monitored.
c)        Performance of the process is adjusted to
meet plans.
d)       Responsibilities and authorities for
performing the process are defined, assigned
and communicated.

e)       Resources and information necessary for

performing the process are identified, made
available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this attribute:

A measure of the extent to which
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of the
The work products (or outputs from process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in accordance

with planned arrangements and adjusted as
necessary to meet requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this attribute:

Established measure of the extent to which a
standard process is maintained to
support the deployment of the a)       A standard process, including appropriate
defined process. tailoring guidelines, is defined that describes
the fundamental elements that must be
incorporated into a defined process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part of
the standard process.

d)       Required infrastructure and work

environment for performing a process are
identified as part of the standard process.
 e)       Suitable methods for monitoring the
effectiveness and suitability of the process are
determined.

PA 3.2 Process Deployment - A As a result of full achievement of this attribute:

measure of the extent to which the
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based upon
achieve its process outcomes. an appropriately selected and/or tailored
standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined process

are competent on the basis of appropriate
education, training, and experience.

d)       Required resources and information

necessary for performing the defined process
are made available, allocated and used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the process,
and to evaluate where continuous
improvement of the process can be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this attribute:

Predictable measure of the extent to which
measurement results are used to
ensure that performance of the a)       Process information needs in support of
process supports the achievement of relevant defined business goals are established.
relevant process performance
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of measurement

are identified and defined in line with process
measurement objectives and quantitative
objectives for process performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor the
extent to which the quantitative objectives for
process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this attribute:

of the extent to which the process is
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are established

for normal process performance.

c) Measurement data are analysed for special

causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to which
changes to the process are identified As a result of full achievement of this attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the relevant
investigations of innovative business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and innovation.

d) Improvement opportunities derived from

new technologies and process concepts are
identified.
e) An implementation strategy is established to
achieve the process improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which
changes to the definition, As a result of full achievement of this attribute:
management and performance of a)   Impact of all proposed changes is assessed
the process result in effective impact against the objectives of the defined process
that achieves the relevant process and standard process.
improvement objectives.
b)   Implementation of all agreed changes is
managed to ensure that any disruption to the
process performance is understood and acted
upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the defined
product requirements and process objectives to
determine whether results are due to common
or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

PO2 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

PO2 Define the information architeture.

Purpose Satisfy the business requirement of being agile in responding to requirements; provide reliable, consistent information, and seamlessly integrate applications into
business processes.
about benefits, costs and risks
Assess whether the following Criteria Are Partially Largely Fully
outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

PO2-O1 There is an effective information

architecture and data model.

PO2-O2 A data dictionary is maintained to

enable the sharing of data elements amongst
applications and systems, and to promote a
common ouse of data throughout all IT
applications.
PO2-O3 A data classification scheme is
maintained.

PO2-O4 Processes are in place to ensure the

integrity and consistnecy of all data stored in
electronic form.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.
 PA 3.2 Process Deployment - A As a result of full achievement of this
measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to which As a result of full achievement of this
attribute:
changes to the process are identified
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

PO3 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

PO3 Determine technological direction.

Purpose Satisfy the business requirement of having stable, cost-effective, integrated and standard application systems, resources and capabilities
that meet current and future business requirements.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

PO3-O1 A technology infrastructure plan is

developed and maintained based on an
analysis of existing and emerging
technologies and in accordance with the IT
strategic and tactical plans.

PO3-O2 An IT architecture board (or

equivalent) exists to provide architecture
guidelines and advice on their application, and
to verify compliance.

Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this

measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to
achieve its process outcomes.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A As a result of full achievement of this

Optimizing. measure of the extent to which
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

PO4 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

PO4 Define the IT processess, organisation and relationships.

Purpose Satisfy the business requirement of being agile in responding to the business strategy while complying with governance requirements and providing defined and
competent points of contact.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

PO4-O1 An IT process framework is defined

to include an IT process structure and
relationships, ownership, maturity,
performance measurement, and
improvement.

PO4-O2 The appropriate organisational

bodies and structure are established to advise
on strategic direction and review major
investments on behalf of the board.

PO4-O3 Roles, responsibilities and reporting

lines are defined and integrated into business
and decision processes. This includes
responsibilities for quality assurance, risk
management and data ownership.

PO4-O4 Implementation of adequate

supervisory practices includes separation of
duties in the IT function to ensure that roles
and responsibilities are properly exercised and
to assess whether all personnel have sufficient
authority and resources.

PO4-O5 Staffing requirements are evaluated

on a regular basis or upon major changes to
the business, operational or IT environments
to ensure that the IT function has sufficient
resources to adequately and appropriately
support the business goals and objectives.

PO4-O6 Appropriate policies and procedures

exist for contracted staff.

PO4-O7 An established and maintained

optimal co-ordination, communication and
liaison structure exists between the IT
function and various other internal or external
interests.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.
 PA 2.2 Work Product Management -
A measure of the extent to which
the work products produced by the
process are appropriately managed.
The work products (or outputs from
the process) are defined and
controlled.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to which As a result of full achievement of this
attribute:
changes to the process are identified
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
Optimizing. measure of the extent to which
changes to the process are identified
from analysis of common causes of
variation in performance, and from
investigations of innovative
approaches to the definition and
deployment of the process.

c) Appropriate data are analysed to identify

opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

PO5 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

PO5 Manage the IT investment.

Purpose Satisfy the business requirement of continuously and demonstrably improving IT’s cost-efficiency and its contribution to business profitability with integrated and
standardised services that satisfy end-user expectations.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

PO5-O1 Budgets for IT-enabled investments

are forecasted, allocated and managed.

PO5-O2 Formal investment criteria (return on

investment [ROI], payback period, net present
value [NPV]) are defined.
PO5-O3 Business value is measured and
assessed against forecast.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to
achieve its process outcomes.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A As a result of full achievement of this

Optimizing. measure of the extent to which
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

PO6 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

PO6 Communicate management aims and direction.

Purpose
Satisfy the business requirement of supplying accurate and timely control over current and future IT services, associated risks and responsibilities.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

PO6-O1 An IT control framework is

established.
PO6-O2 IT policies are defined.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.
 standard process is effectively
deployed as a defined process to
achieve its process outcomes.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A As a result of full achievement of this

Optimizing. measure of the extent to which
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

PO7 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

PO7 Manage IT human resources..

Purpose Satisfy the business requirement of acquiring competent and motivated people to create and deliver IT services.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

PO7-O1 Recruitment and retention policies

and processes ensure that skills are available
to achieve organisational goals.

PO7-O2 Training exists to ensure that IT

employees maintain their knowledge, skills
and abilities at the level required to achieve
organisational goals.

PO7-O3 Risks of overdependence on key

resources are mitigated.
PO7-O4 Appropriate personnel clearance
procedures are in place.
PO7-O5 Staff performance is regularly
evaluated and reviewed.

PO7-O6 Risks associated with job changes and

terminations are mitigated.

Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this

measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.
 d)       Required infrastructure and work
environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A As a result of full achievement of this

Optimizing. measure of the extent to which
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.
the process result in effective impact
that achieves the relevant process
improvement objectives.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

PO8 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

PO8 Manage quality.

Purpose Satisfy the business requirement of ensuring continuous and measurable improvement in the quality of IT services delivered.

Assess whether the following Criteria Criteria Are Comment Partially Largely Fully
outcomes are achieved. Met Y/N Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

PO8-O1 A quality management system (QMS)

is developed and maintained, with the
purpose of supporting continuous
improvement.

PO8-O2 Standards are maintained for all

quality, development and acquisition
activities.

PO8-O3 Internal and external performance is

monitored and reviewed against the defined
quality standards and practices.

Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this

measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to
achieve its process outcomes.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A As a result of full achievement of this

Optimizing. measure of the extent to which
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

PO9 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

PO9 Assess and manage IT risks.

Purpose
Satisfy the business requirement of analysing, communicating and managing IT risks and their potential impact on business processes and goals.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

PO9-O1 An IT risk management framework is

established that is aligned to the
organisation’s (enterprise’s) risk
management framework.
PO9-O2 Risk remediation action plans are
defined and communicated.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to
achieve its process outcomes.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to which As a result of full achievement of this
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

PO10 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

PO10 Manage projects.

Purpose
Satisfy the business requirement of ensuring the delivery of project results within agreed-upon time frames, budget and quality.

Assess whether the following Criteria Criteria Are Comment Partially Largely Fully
outcomes are achieved. Met Y/N Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

PO10-O1a A programme management

framework is defined.
PO10-O1b A programme management
framework is followed.
PO10-O1c Contributions of projects within the
programme are managed to expected
outcomes.

PO10-O1d O1d Activities, interdependencies,

resource requirements and conflicts of
multiple projects are managed and resolved.

PO10-O2a A project management

framework is defined.

PO10-O2b Projects follow a defined project

management framework/process that
requires appropriate approvals, planning, risk
management, quality management and
monitoring.

PO10-O3 Project planning is performed for

each project and is detailed in the project
portfolio.

PO10-O4 There is commitment to, and

involvement of, business and end users in
projects.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.
Level 3 PA 3.1 Process Definition - A
Established measure of the extent to which a
standard process is maintained to
support the deployment of the
defined process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to which As a result of full achievement of this
attribute:
changes to the process are identified
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of
the process result in effective impact
that achieves the relevant process
improvement objectives.
PA 5.2 Process optimisation - A
measure of the extent to which
changes to the definition,
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

AI1 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

AI1 Identify automated solutions.

Purpose Satisfy the business requirement of sustaining or extending the business strategy and governance requirements while being transparent
about benefits, costs and risks

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

AI1-O1 Business and technical requirements

are defined and maintained.

AI1-O2 Risk are identified and analysed as

part of requirements development.

AI1-O3 Business requirement feasibility

studies are prepared.

AI1-O4 Approved (or rejected) requirements

and feasibility study results are prepared.

Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this

measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to
achieve its process outcomes.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A As a result of full achievement of this

Optimizing. measure of the extent to which
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

AI2 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

AI2 Acquire and maintain application software.

Purpose Satisfy the business requirement of aligning available applications with business and security requirements, and doing so in a timely manner and at a reasonable
cost.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

AI2-O1 Design specifications are prepared

based on business requirements and managed
for new systems or major changes.

AI2-O2 Application control, security,

availability and auditability controls are
included in the design, development and
implementation.

AI2-O3 The application software is developed

and/or configured and maintained according
to design specifications and development and
documentation standards.

AI2-O4 Development and maintenance are

subject to the requirements of a quality
assurance (QA) plan.

AI2-O5 Software requirements are subject to

requirements management.

AI2-O6 A strategy for application software is in

place.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.
 d)       Required infrastructure and work
environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A As a result of full achievement of this

Optimizing. measure of the extent to which
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.
the process result in effective impact
that achieves the relevant process
improvement objectives.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

AI3 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

AI3 Acquire and maintain technology infrastructure.

Purpose
Satisfy the business requirement of acquiring and maintaining an integrated and standardised IT infrastructure.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

AI3-O1 A technology acquisition plan is

produced that aligns to the technology
infrastructure plan.

AI3-O2 Internal control, security and

auditability measures are implemented for
infrastructure components.

AI3-O3 Infrastructure maintenance is

planned.
AI3-O4 Technology infrastructure changes are
tested.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to
achieve its process outcomes.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A As a result of full achievement of this

Optimizing. measure of the extent to which
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

AI4 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

AI4 Enable operation and use.

Purpose Satisfy the business requirement of ensuring stakeholder satisfaction with service offerings and service levels and seamlessly integrating the use of applications
and technology solutions throughout the business.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

AI4-O1 Plans are produced for knowledge

transfer during the implementation of an
application system or infrastructure change.

AI4-O2 Knowledge is communicated and

users, business management, support staff
and operational staff are trained.

Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this

measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to
achieve its process outcomes.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to which As a result of full achievement of this
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

AI5 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

AI5 Procure IT resources.

Purpose Satisfy the business requirement of improving IT’s adherence to acquisition processes to enhance effectiveness, cost-efficiency and contribution to business
profitability.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

AI5-O1 Procurement procedures and

standards are defined and followed.

AI5-O2 Procedures exist that ensure that legal

and contractual arrangements are addressed
when establishing, modifying and terminating
contracts for all suppliers.

AI5-O3 Requested hardware, software and

services are procured in line with defined
procedures.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to
achieve its process outcomes.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A As a result of full achievement of this

Optimizing. measure of the extent to which
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

AI6 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

AI6 Manage changes.

Purpose
Satisfy the business requirement of managing IT changes in alignment with the business strategy to reduce solution and service delivery defects and rework.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

AI6-O1 Change standards and associated

procedures, including those for emergency
changes, are defined and communicated.

AI6-O2 Changes are assessed, prioritised and

authorised.

AI6-O3 Change status is tracked and reported.

Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to
achieve its process outcomes.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A As a result of full achievement of this

Optimizing. measure of the extent to which
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

AI7 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

AI7 Install and accredit solutions and changes.

Purpose
Satisfy the business requirement of implementing new or changed systems that function without major problems after installation.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

AI7-O1 A test strategy/plan based on

organisational standards for testing of the
system and data conversion is prepared and
followed.

AI7-O2 Release planning, including planned

approval and fallback mechanisms is
undertaken.

AI7-O3 An appropriate environment for

testing, including training, is established.

AI7-O4 Test results are evaluated and

approved by business management prior to
approval of release to production.

Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this

measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.
 PA 3.2 Process Deployment - A As a result of full achievement of this
measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to which As a result of full achievement of this
attribute:
changes to the process are identified
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

DS1 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

DS1 Define and manage service levels.

Purpose
Satisfy the business requirement of ensuring the alignment of key IT services with the business needs.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

DS1-O1 A service management framework is

in place to define the organisational structure
for service level management, covering the
base definitions of services, roles, tasks and
responsibilities of internal and external service
providers and customers.

DS1-O2 Internal and external SLAs are

formalised in line with customer requirements
and delivery capabilities.

DS1-O3 OLAs are developed to specify the

technical processes required to support SLAs.

DS1-O4 Processes are in place to monitor

(and periodically review) SLAs and
achievements.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.
 d)       Required infrastructure and work
environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A As a result of full achievement of this

Optimizing. measure of the extent to which
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.
the process result in effective impact
that achieves the relevant process
improvement objectives.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

DS2 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

DS2 Manage third-party seervices.

Purpose
Satisfy the business requirement of providing satisfactory third-party services while being transparent about benefits, costs and risks.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

DS2-O1 Supplier services are identified and

relationships managed.

DS2-O2 Supplier risk is identified and

mitigated.
DS2-O3 Supplier performance is monitored
and measured.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to
achieve its process outcomes.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to which As a result of full achievement of this
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

DS3 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

DS3 Manage performance and capacity.

Purpose
Satisfy the business requirement of optimising the performance of IT infrastructure, resources and capabilities in response to business needs.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

DS3-O1 Current and future system capacity

and availability are planned and provided.

DS3-O2 System performance is monitored and

reported.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to
achieve its process outcomes.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to which As a result of full achievement of this
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

DS4 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

DS4 Ensure continuous service.

Purpose
Satisfy the business requirement of ensuring minimal business impact in the event of an IT service interruption.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

DS4-O1 An IT continuity framework and plan

are developed and maintained (improved).

DS4-O2 Training on and testing of IT

contingency plans occur.
DS4-O3 Contingency plans and data are stored
at offsite locations.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to
achieve its process outcomes.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to which As a result of full achievement of this
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

DS5 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

DS5 Ensure systems security.

Purpose Satisfy the business requirement of maintaining the confidentiality, integrity and availability of information and the processing infrastructure aligned to business
needs and minimising the impact of security vulnerabilities.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

DS5-O1 A security plan is developed and

approved.

DS5-O2 User identities and authorisations are

managed in a standardised manner.

DS5-O3 Security is monitored and tested.

DS5-O4 Techniques are in place to ensure that

networks and information are secure.

Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this

measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to
achieve its process outcomes.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A As a result of full achievement of this

Optimizing. measure of the extent to which
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

DS6 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

DS6 Identify and allocate costs.

Purpose
Satisfy the business requirement of ensuring transparency and understanding of IT costs and improving cost-efficiency through well-informed use of IT services.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

DS6-O1 A cost model is developed and

maintained based on the service provided and
the business processes supported.

DS6_O2 Charges are implemented as per the

agreed-upon policy.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to
achieve its process outcomes.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to which As a result of full achievement of this
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

DS7 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

DS7 Educate and train users.

Purpose Satisfy the business requirement of effectively and efficiently using applications and technology solutions and ensuring user compliance with policies and
procedures.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

DS7-O1 A training curriculum is established

based on identified needs.

DS7-O2 Training is delivered and evaluated to

meet identified needs.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to
achieve its process outcomes.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to which As a result of full achievement of this
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
DS8 Manage service desk and incidents.
Purpose Satisfy the business requirement of enabling effective use of IT systems by ensuring resolution and analysis of end-user queries, questions and incidents

Assess whether the following Criteria Are Not Partially Largely Fully
outcomes are achieved. Criteria Met Y/N Comment
achieved Achieved Achieved Achieved
(0-15%) (15% -50%) (50% - 85%) (85-100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of any achievement of the process purpose.
Incomplete fails to achieve its process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being achieved: Overall rating for the process
Performed achieves its process purpose.
DS8-O1 A service desk is installed and operating, with logging and tracking of calls, incidents,
service requests and information needs. Y
DS8_O2 Trends are monitored and reported. Y
DS8-O3 Clear escalation criteria and procedures are defined.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this attribute:
measure of the extent to which the
performance of the process is a)       Objectives for the performance of the process are identified.
managed. b)       Performance of the process is planned and monitored.
c)        Performance of the process is adjusted to meet plans.
d)       Responsibilities and authorities for performing the process are defined, assigned and
communicated.
e)       Resources and information necessary for performing the process are identified, made
available, allocated and used.
f)        Interfaces  between  the  involved  parties  are  managed  to  ensure  both  effective 
communication  and  also clear assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this attribute:

A measure of the extent to which
the work products produced by the a)       Requirements for the work products of the process are defined.
process are appropriately managed. b)       Requirements for documentation and control of the work products are defined.
The work products (or outputs from
the process) are defined and
controlled. c)        Work products are appropriately identified, documented, and controlled.

d)       Work products are reviewed in accordance with planned arrangements and adjusted
as necessary to meet requirements.
Level 3 PA 3.1 Process Definition - A As a result of full achievement of this attribute:
Established measure of the extent to which a
standard process is maintained to a)       A standard process, including appropriate tailoring guidelines, is defined that
support the deployment of the describes the fundamental elements that must be incorporated into a defined process.
defined process.
b)       The sequence and interaction of the standard process with other processes is
determined.
c)        Required competencies and roles for performing a process are identified as part of
the standard process.
d)       Required infrastructure and work environment for performing a process are
identified as part of the standard process.
e)       Suitable methods for monitoring the effectiveness and suitability of the process are
determined.
PA 3.2 Process Deployment - A As a result of full achievement of this attribute:
measure of the extent to which the
standard process is effectively a)       A defined process is deployed based upon an appropriately selected and/or tailored
deployed as a defined process to standard process.
achieve its process outcomes. b)       Required roles, responsibilities and authorities for performing the defined
process are assigned and communicated.
c)        Personnel performing the defined process are competent on the basis of appropriate
education, training, and experience.
d)       Required resources and information necessary for performing the defined
process are made available, allocated and used.
e)       Required infrastructure and work environment for performing the defined
process are made available, managed and maintained.
f)        Appropriate data are collected and analysed as a basis for understanding the
behaviour of, and to demonstrate the suitability and effectiveness of the process,
and to evaluate where continuous improvement of the process can be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this attribute:

Predictable measure of the extent to which
measurement results are used to a)       Process information needs in support of relevant defined business goals are
ensure that performance of the established.
process supports the achievement of b)       Process measurement objectives are derived from process information needs.
relevant process performance
objectives in support of defined
business goals. c)        Quantitative objectives for process performance in support of relevant business goals
are established.
d)       Measures and frequency of measurement are identified and defined in line with
process measurement objectives and quantitative objectives for process performance.

e)       Results of measurement are collected, analysed and reported in order to monitor the
extent to which the quantitative objectives for process performance are met.

f) Measurement results are used to characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this attribute:
of the extent to which the process is
quantitatively managed to produce a a) Analysis and control techniques are determined and applied where applicable.
process that is stable, capable and
predictable within defined limits. b) Control limits of variation are established for normal process performance.

c) Measurement data are analysed for special causes of variation.

d) Corrective actions are taken to address special causes of variation.

e) Control limits are re-established (as necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A As a result of full achievement of this attribute:

Optimizing. measure of the extent to which
changes to the process are identified a) Pprocess improvement objectives for the process are defined that support the relevant
from analysis of common causes of business goals.
variation in performance, and from b) Appropriate data are analysed to identify common causes of variations in process
investigations of innovative performance.
approaches to the definition and
deployment of the process. c) Appropriate data are analysed to identify opportunities for best practice and
innovation.
d) Improvement opportunities derived from new technologies and process concepts are
identified.
e) An implementation strategy is established to achieve the process improvement
objectives.
PA 5.2 Process optimisation - A As a result of full achievement of this attribute:
measure of the extent to which
changes to the definition, a)   Impact of all proposed changes is assessed against the objectives of the defined process
management and performance of and standard process.
the process result in effective impact b)   Implementation of all agreed changes is managed to ensure that any disruption to the
that achieves the relevant process process performance is understood and acted upon.
improvement objectives.
c)   Based on actual performance, effectiveness of process change is evaluated against the defined
product requirements and process objectives to determine whether results are due to
common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

DS9 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

DS9 Manage the configurations.

Purpose
Satisfy the business requirement of optimising the IT infrastructure, resources and capabilities; and accounting for IT assets.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

DS9-O1 A central repository of all

configuration items is established, with
procedures to support management and
logging of changes.

DS9-O2 Integrity of configuration data is

periodically reviewed.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to
achieve its process outcomes.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to which As a result of full achievement of this
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

DS10 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

DS19 Manage problems.

Purpose Satisfy the business requirement of ensuring end users’ satisfaction with service offerings and service levels by reducing solution and service delivery defects and
rework.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

DS10-O1 A service desk is installed and

operating with logging and tracking of calls,
incidents, service requests and information
needs.

DS10-O2 Trends are monitored and reported.

Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this

measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to
achieve its process outcomes.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to which As a result of full achievement of this
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

DS11 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

DS11 Manage data.

Purpose
Satisfy the business requirement of optimising the use of information and ensuring that information is available as required.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

DS11-O1 Policies and procedures exist for

data management that are based on business
requirements.
DS11-O2 Onsite and offsite data storage is
managed.
DS11-O3 Data and equipment are disposed of
securely.

DS11-O4 Data are backed up and restoration

is tested.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to
achieve its process outcomes.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A As a result of full achievement of this

Optimizing. measure of the extent to which
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

DS12 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

DS12 Manage the physical environment.

Purpose Satisfy the business requirement of managing the physical environment to protect computer accesses and business data to minimise the risk of business
disruption.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

DS12-O1 Facilities are selected and managed.

DS12-O2 Physical security measures are

implemented.
DS12-O3 Facilities are protected against
environmental factors.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to
achieve its process outcomes.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to which As a result of full achievement of this
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

DS13 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

DS13 Manage operations.

Purpose Satisfy the business requirement of maintaining the management of operations to ensure that operational service levels can be achieved and IT infrastructure can
resist and recover from errors and failures.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

DS13-O1 The IT environment is operated in

line with agreed-upon service levels and
defined instructions.

DS13-O2 The IT infrastructure is subject to

appropriate preventive maintenance.

Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this

measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to
achieve its process outcomes.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to which As a result of full achievement of this
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

ME1 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

ME1 Monitor and evaluate IT performance.

Purpose Satisfy the business requirement of transparency and understanding of IT cost, benefits, strategy, policies and service levels in accordance with governance
requirements.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

ME1-O1 Processes exist to collect, collate and

translate process performance reports into
management reports for operational,
executive and board reporting.

ME1-O2 Performance is verified against

agreed-upon targets and any necessary
remedial action is performed.

Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this

measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to
achieve its process outcomes.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A As a result of full achievement of this

Optimizing. measure of the extent to which
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

ME2 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

ME2 Monitor and evaluate internal control.

Purpose
Satisfy the business requirement of protecting the achievement of IT objectives while complying with internal controls.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

ME2-O1 A system of internal controls is

embedded in the IT process framework.

ME2-O2 Monitoring and reporting on the

effectiveness of the internal controls over IT
occur.
ME2-O3 Control exceptions are reported to
management for action.
ME2-O4 Monitoring and reporting on the
effectiveness of IT internal controls at third-
party suppliers occur.
Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this
measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to
achieve its process outcomes.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A As a result of full achievement of this

Optimizing. measure of the extent to which
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

ME3 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

ME3 Ensure compliance with external requirementsl.

Purpose
Satisfy the business requirement of ensuring compliance with laws, regulations and contractual requirements.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

ME3-O1 Legal, regulatory and contractual

requirements related to IT have been
identified and appropriate policies are
communicated.

ME3-O2 Compliance with legal, regulatory and

contractual requirements is monitored and
reported.

Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this

measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.
 PA 3.2 Process Deployment - A
measure of the extent to which the
standard process is effectively
deployed as a defined process to
achieve its process outcomes.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A

Optimizing. measure of the extent to which As a result of full achievement of this
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.

PA 5.2 Process optimisation - A

measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.
 Self-assessmentTemplate (Appendix B of the Self-assessment Guide)

Process Name Level 0 Level 1 Level 2 Level 3 Level 4

ME4 PA 1.1 PA 2.1 PA 2.2 PA 3.1 PA 3.2 PA 4.1 PA 4.2

Rating by
Criteria
Capability
Level Achieved

N- 0%-15% P- 15%-50% L- 50%-85% F- 85%-100%

N – Not Achieved
P – Partially Achieved
L – Largely Achieved
F- Fully Achieved

ME4 Provide IT governance.

Purpose
Satisfy the business requirement of integrating IT governance with enterprise governance and complying with laws, regulations and contracts.

Assess whether the following Criteria Are Partially Largely Fully

outcomes are achieved. Criteria Met Y/N Comment
Not achieved Achieved Achieved Achieved (85-
(0-15%) (15% -50%) (50% - 85%) 100%)
Level 0 The process is not implemented, or At this level, there is little or no evidence of
Incomplete fails to achieve its process purpose. any achievement of the process purpose.

Level 1  PA 1.1 The implemented process The following process outcomes are being Overall rating for the process
Performed achieves its process purpose. achieved:

ME4-O1 There is an IT governance framework

integrated into enterprise governance that
enables the board and executive to have
appropriate oversight and direction over the
achievement of strategic alignment, value
delivery, resource management and risk
management.

ME4-O2 Business and IT are involved together

as part of governance bodies such as an IT
strategy committee in strategic decision
making and IT benefit optimisation.

ME4-O3 There is a disciplined approach to

portfolio, programme and project
management, with business taking ownership
of all IT-enabled investments and IT ensuring
optimisation of the costs of delivering IT
capabilities and services.

ME4-O4 There is oversight of investment in

and use and allocation of IT resources to
ensure appropriate resourcing and alignment
with current and future strategic objectives
and business imperatives.

ME4-O5 There is reasonable assurance that IT

risk management practices are appropriate
and do not exceed the board’s risk appetite.

Level 2 Managed PA 2.1 Performance Management - A As a result of full achievement of this

measure of the extent to which the attribute:
performance of the process is
managed. a)       Objectives for the performance of the
process are identified.
b)       Performance of the process is planned
and monitored.
c)        Performance of the process is adjusted
to meet plans.
d)       Responsibilities and authorities for
performing the process are defined,
assigned and communicated.

e)       Resources and information necessary

for performing the process are identified,
made available, allocated and used.

f)        Interfaces  between  the  involved 

parties  are  managed  to  ensure  both 
effective  communication  and  also clear
assignment of responsibility.

PA 2.2 Work Product Management - As a result of full achievement of this

A measure of the extent to which attribute:
the work products produced by the
process are appropriately managed. a)       Requirements for the work products of
The work products (or outputs from the process are defined.
the process) are defined and
controlled. b)       Requirements for documentation and
control of the work products are defined.

c)        Work products are appropriately

identified, documented, and controlled.

d)       Work products are reviewed in

accordance with planned arrangements and
adjusted as necessary to meet
requirements.

Level 3 PA 3.1 Process Definition - A As a result of full achievement of this

Established measure of the extent to which a attribute:
standard process is maintained to
support the deployment of the
defined process.
Level 3 PA 3.1 Process Definition - A
Established measure of the extent to which a
standard process is maintained to
support the deployment of the a)       A standard process, including
defined process. appropriate tailoring guidelines, is defined
that describes the fundamental elements
that must be incorporated into a defined
process.

b)       The sequence and interaction of the

standard process with other processes is
determined.
c)        Required competencies and roles for
performing a process are identified as part
of the standard process.

d)       Required infrastructure and work

environment for performing a process
are identified as part of the standard
process.

e)       Suitable methods for monitoring the

effectiveness and suitability of the process
are determined.

PA 3.2 Process Deployment - A As a result of full achievement of this

measure of the extent to which the attribute:
standard process is effectively
deployed as a defined process to a)       A defined process is deployed based
achieve its process outcomes. upon an appropriately selected and/or
tailored standard process.

b)       Required roles, responsibilities and

authorities for performing the defined
process are assigned and communicated.

c)        Personnel performing the defined

process are competent on the basis of
appropriate education, training, and
experience.

d)       Required resources and information

necessary for performing the defined
process are made available, allocated and
used.

e)       Required infrastructure and work

environment for performing the defined
process are made available, managed and
maintained.

f)        Appropriate data are collected and

analysed as a basis for understanding the
behaviour of, and to demonstrate the
suitability and effectiveness of the
process, and to evaluate where
continuous improvement of the process can
be made.

Level 4 PA 4.1 Process Measurement - A As a result of full achievement of this

Predictable measure of the extent to which attribute:
measurement results are used to
ensure that performance of the a)       Process information needs in support
process supports the achievement of of relevant defined business goals are
relevant process performance established.
objectives in support of defined
business goals. b)       Process measurement objectives are
derived from process information needs.

c)        Quantitative objectives for process

performance in support of relevant business
goals are established.

d)       Measures and frequency of

measurement are identified and defined in
line with process measurement objectives
and quantitative objectives for process
performance.

e)       Results of measurement are collected,

analysed and reported in order to monitor
the extent to which the quantitative
objectives for process performance are met.

f) Measurement results are used to

characterise process performance.

PA 4.2 Process Control - A measure As a result of full achievement of this

of the extent to which the process is attribute:
quantitatively managed to produce a
process that is stable, capable and a) Analysis and control techniques are
predictable within defined limits. determined and applied where applicable.

b) Control limits of variation are

established for normal process
performance.
c) Measurement data are analysed for
special causes of variation.
d) Corrective actions are taken to address
special causes of variation.
e) Control limits are re-established (as
necessary) following corrective action.

Level 5 PA 5.1 Process innovation - A As a result of full achievement of this

Optimizing. measure of the extent to which
changes to the process are identified attribute:
from analysis of common causes of a) Pprocess improvement objectives for the
variation in performance, and from process are defined that support the
investigations of innovative relevant business goals.
approaches to the definition and
deployment of the process.
b) Appropriate data are analysed to identify
common causes of variations in process
performance.
c) Appropriate data are analysed to identify
opportunities for best practice and
innovation.
d) Improvement opportunities derived
from new technologies and process
concepts are identified.
e) An implementation strategy is
established to achieve the process
improvement objectives.
PA 5.2 Process optimisation - A
measure of the extent to which As a result of full achievement of this
changes to the definition, attribute:
management and performance of a)   Impact of all proposed changes is
the process result in effective impact assessed against the objectives of the
that achieves the relevant process defined process and standard process.
improvement objectives.

b)   Implementation of all agreed changes is

managed to ensure that any disruption to
the process performance is understood and
acted upon.

c)   Based on actual performance, effectiveness of

process change is evaluated against the
defined product requirements and process
objectives to determine whether results are
due to common or special causes.