A BCM maturity assessment measures capability, not document volume. Its purpose is to identify how reliably the organisation can govern, design, exercise and improve continuity across critical services. A credible maturity model therefore requires observable evidence and defined exit criteria for each level.
Five practical maturity levels
| Level | Characteristics | Evidence expected |
|---|---|---|
| 1 — Initial | Reactive, person-dependent arrangements | Isolated plans and incident experience |
| 2 — Repeatable | Common templates and assigned owners | Basic BIA, plans and exercise calendar |
| 3 — Defined | Enterprise methodology and governance | Approved policy, lifecycle, roles and quality controls |
| 4 — Measured | Risk-based assurance and performance management | Metrics, dependency testing, findings and management review |
| 5 — Adaptive | Continuity integrated with strategic and operational change | Scenario analytics, lessons integration and resilience decisions |
Assess dimensions separately
Do not assign one maturity score from a questionnaire average. Score governance, BIA, strategy, plans, exercising, supplier continuity, technology recovery, competence, metrics and continual improvement separately. A level-four exercise programme cannot compensate for a level-one dependency-management process.
Evidence-based scoring
For every claimed capability, sample records. If a team says BIAs are reviewed annually, test whether priority services actually have current approved BIAs and whether changes in suppliers, applications and recovery objectives are reflected. Interviews establish intent; evidence establishes maturity.
Prevent maturity stagnation
Programmes often stall because the target is “reach level 4” rather than remove specific capability gaps. Convert findings into measurable improvements such as validating recovery of the top ten shared dependencies, reducing overdue actions, or proving recovery within RTO for tier-one services.
Worked assessment
An organisation has a mature policy, 98% plan coverage and annual tabletop exercises. However, BIAs are three years old and technology recovery tests do not trace applications back to critical services. Governance may score level 3, while BIA and dependency assurance remain level 2. The enterprise maturity should not be presented as level 3.8 simply by averaging scores; executives need to see the limiting capabilities.
Assessment checklist
- Define maturity criteria before interviews begin.
- Require objective evidence for each rating.
- Sample multiple business units and criticality tiers.
- Record confidence and evidence gaps separately from maturity.
- Identify limiting dependencies and systemic findings.
- Agree a target maturity based on risk and business need.
- Reassess after corrective actions have evidence, not merely after due dates.
FAQ
What maturity level should an organisation target?
The appropriate target depends on criticality, regulation, complexity and risk appetite. Not every process needs the highest level; priority services and systemic dependencies usually deserve stronger assurance.
Can maturity be benchmarked?
Yes, but only when definitions and evidence standards are comparable. Internal trend and closure of material capability gaps are often more actionable than an external percentile.
Use maturity results to sequence investment
Maturity scoring is most valuable when it changes priorities. If supplier continuity is weak but affects only low-impact services, it may rank below an untested shared identity platform that supports every critical service. Combine maturity with consequence so that the roadmap targets the gaps that can create the largest disruption.
For each low-rated dimension, define the next observable capability rather than a vague ambition. “Improve exercising” can become “execute two end-to-end scenarios covering the identity platform, primary data centre and top outsourced service, with measured recovery times and closure of critical findings.” That statement can be funded, scheduled and verified.
Rating calibration workshop
Before finalizing scores, bring together BCM, technology, facilities, procurement, risk and selected business owners. Present the evidence for each proposed level and challenge inconsistent interpretations. If one assessor treats an approved procedure as level 3 while another requires operating evidence, the model will not be comparable across functions. Calibration should establish what evidence is sufficient for each level.
Keep a confidence rating beside the maturity score. A level 3 supported by multiple tests, approved records and trend data is different from a level 3 based mainly on interviews. Low-confidence ratings should trigger evidence collection rather than be presented as established capability.
Board-level presentation
Executives normally need the limiting capabilities, not a dense heat map. Show the few dimensions that constrain critical-service resilience, the consequence if they fail, the agreed target state and the decisions required. This keeps the maturity model connected to risk reduction instead of becoming an annual scoring exercise.
Avoid false precision
Do not present a maturity result such as 3.74 unless the underlying model genuinely supports that precision. Whole levels or clearly defined half-steps are usually easier to defend. More important than the decimal is the evidence, the limiting capability and the action required to move to the next state.
Score capability only when evidence supports the level
A maturity model is most useful when it describes observable capability rather than vague labels such as “managed” or “optimized”. Define evidence for each level across governance, BIA, strategy, plans, exercising, technology recovery, supplier continuity, crisis management, maintenance and assurance. A higher score should require proof that practices are repeatable, owned, measured and validated, not simply that documents exist.
Use different evidence types to avoid self-assessment bias. Policy approval shows governance intent; completed BIAs show process execution; exercise results show whether plans can be used; recovery tests show technical capability; overdue actions reveal maintenance weakness; incident records show how the framework performs under real pressure. A mature program can still have gaps, but those gaps are visible, risk-assessed and actively governed.
Turn the assessment into an improvement sequence
- Identify the few capability weaknesses that create the largest continuity exposure rather than trying to raise every domain at once.
- Separate foundational dependencies from advanced improvements. For example, reliable ownership and scope should precede sophisticated analytics.
- Define a target state appropriate to the organization’s risk and complexity; the maximum maturity score is not automatically the right objective.
- Assign each improvement an owner, evidence of completion and a validation method.
- Repeat the assessment using the same criteria and keep supporting evidence so movement in scores can be explained.
Management reporting should show both the maturity rating and the operational meaning behind it. “Exercise maturity 2.5” is weak information by itself; “critical plans are exercised, but supplier participation and evidence of recovery-time achievement are inconsistent” gives decision-makers something they can act on.
Worked example: scoring maturity with evidence
An organization should not receive a high exercise maturity score merely because it runs many exercises. A stronger assessment samples objectives, scenarios, attendance, timed evidence, observations, corrective actions and closure records across several business units. If exercises are frequent but findings remain open and scenarios never test priority dependencies, maturity is limited. Scoring criteria should therefore describe observable practices and evidence at each level, and assessors should record both the score and the evidence that justified it. This makes year-on-year improvement measurable and reduces subjective scoring.