CMMI readiness and gap assessment: what it measures and how to run one.
An appraisal is a bad place to learn that your process description documents a workflow nobody actually follows. A CMMI gap assessment exists to make sure that discovery happens months earlier, in a room you control, with time left to fix what it finds. It is a structured, evidence-based comparison between the processes your organization genuinely runs and the practices the model expects at the maturity state you are pursuing.
Appraisals produce judgments, and judgments produce findings. A gap assessment produces a prioritized list of weaknesses while remediation is still cheap.
Two words matter most: practices and evidence. A gap assessment tests whether process descriptions, work products, project records, and interview responses agree with one another. When they disagree, the assessment records a gap, even if the paperwork looks complete.
- 01A gap assessment is a diagnostic exercise, not a pass-or-fail verdict — it compares current practice against the framework requirements at your target level.
- 02Benchmark before the appraisal: findings surfaced early can be fixed, retested, and evidenced with a track record rather than a promise.
- 03Score gaps with a consistent severity scheme (critical, major, minor, observation) and never downgrade a finding because the fix is awkward.
- 04Institutionalize rather than document: closing a gap requires a defined practice, people who follow it without being reminded, and records that prove they did.
- 05Re-test critical and major gaps before the appraisal window — the re-test itself generates evidence of a functioning correction loop.
What a CMMI gap assessment actually measures
Capability Maturity Model Integration, commonly shortened to CMMI, offers a systematic method for assessing and improving organizational processes. A gap analysis applies that method as a diagnostic exercise. It compares your current state and practices against the requirements of the framework at a target level, rather than issuing a pass or fail verdict.
Two words matter most in that definition: practices and evidence. A gap assessment is not a documentation review with a nicer name. It tests whether process descriptions, work products, project records, and interview responses agree with one another. When they disagree, the assessment records a gap, even if the paperwork looks complete. This is the same logic that underpins gap work in other frameworks, where the point is identifying discrepancies between what exists today and what the requirement set demands.
Why benchmark before the appraisal
Skipping the benchmark shifts all correction work to the worst possible moment. Consider what a gap assessment delivers that an appraisal cannot:
- Remediation time. Findings surfaced before an appraisal can be fixed, retested, and evidenced with a track record rather than a promise.
- Scope clarity. Disagreements about which organizational units, sites, and process areas are in play get resolved before an appraisal team forms its own view.
- Evidence inventory. You learn which practices are implemented but undocumented, and which are documented but never performed.
- A defensible business case. Sponsors fund remediation more readily when the request is tied to rated gaps instead of general concern.
The last point is often decisive. Internal quality teams frequently sense where the weaknesses are but cannot quantify them. A rated gap register converts that instinct into something a program manager or capital project sponsor can act on.
How to scope the assessment
Define the organizational unit and process areas in scope
Start with the entity being appraised, not the whole company. A single division, a program, or a defined set of projects may be the real subject. Document which process areas are included, which are excluded, and why. Write this down before fieldwork begins, because scope debates during an assessment are usually really about anxiety over a known weak area.
Agree on the target state before anyone is assessed
The target maturity state drives every rating that follows. Confirm it against the official CMMI Institute material for the certification program you intend to pursue, since the institute maintains several certification tracks at different levels and the requirements are not interchangeable. Do not let an internal assumption about the target set the tone for the assessment.
Decide who conducts the assessment
Internal assessments are cheaper and faster, but familiarity breeds blind spots. Teams tend to sample the projects they trust and interpret ambiguous practices in their own favor. An independent assessor brings pattern recognition across organizations and no stake in the answer. Many organizations run a light internal pass first, then commission an independent review of the areas where internal confidence was lowest.
The gap assessment workflow, step by step
What evidence to collect
Evidence requests should be issued before interviews, not assembled during them. The table below shows the categories that typically carry weight in a CMMI readiness review.
| Evidence category | What to gather | Why it matters |
|---|---|---|
| Process definitions | Policies, procedures, templates, tailoring rules | Shows intent and the expected way of working |
| Work products | Plans, estimates, reviews, checklists, decision records | Demonstrates that defined steps produced outputs |
| Performance records | Status reports, metrics, meeting minutes, issue logs | Provides a timeline of actual practice |
| Competence records | Training completion, role assignments, qualification records | Supports claims that people are prepared for their roles |
| Verification records | Peer reviews, audit results, corrective actions, closure evidence | Shows the organization checks its own work |
For capital projects and fabrication programs, add vendor and subcontractor oversight records to this list. Distributed delivery is where process claims most often outrun process evidence, and an assessor will probe that seam first.
Scoring gaps so they can be acted on
A gap register that lists forty items with no ranking is a complaint, not a plan. Use a simple, consistent severity scheme and defend it during the readout.
| Severity | Definition | Typical response |
|---|---|---|
| Critical | Practice is absent or contradicted by observed behavior in the assessed scope | Design and implement before the appraisal window opens |
| Major | Practice exists but is inconsistent, poorly evidenced, or limited to a few projects | Standardize and institutionalize across the scope |
| Minor | Practice is sound but documentation, records, or tailoring notes need tightening | Correct through routine process maintenance |
| Observation | Not a gap, but a risk worth monitoring | Track and revisit at the next internal review |
Resist the urge to downgrade findings because a fix is awkward. The severity rating should reflect the model, not the difficulty of the remedy. If a fix genuinely cannot land before the appraisal window, that is a scheduling decision, not a rating decision.
Common failure points in CMMI gap assessments
- Treating documented process as implemented process, which hides the gaps that matter most.
- Sampling only high-performing projects, producing a flattering and useless result.
- Assessing against an assumed target state rather than the confirmed requirement set for the intended certification.
- Leaving remediation ownership unassigned, so the register becomes an archive.
- Stopping at the readout instead of scheduling a re-test of critical and major gaps.
Turning findings into an appraisal-ready roadmap
Sequence remediation by dependency
Some gaps cannot close until others do. A measurement practice is meaningless if the underlying work planning is inconsistent, and a corrective action process cannot function without a reliable issue log. Map dependencies first, then sequence the work so each fix rests on something already stable.
Institutionalize rather than document
Closing a gap requires three things: a defined practice, people who follow it without being reminded, and records that prove they did. The middle item takes the longest. Build in training, tailoring guidance, and a short internal review cycle so that new practice becomes routine before an appraisal team observes it.
Re-test before the appraisal window
A second, narrower pass over the critical and major items confirms that remediation worked and generates evidence of a functioning correction loop. That evidence is itself valuable, because it demonstrates the organization monitors and improves its own processes.
Where independent review adds value
Organizations with mature quality functions often run their own gap assessments competently. The risk is not competence, it is proximity. An independent reviewer with no reporting line to the projects being sampled can ask harder questions, sample less convenient work, and rate findings without negotiating internally. For programs where the appraisal outcome affects contracts, client confidence, or capital approvals, that independence is usually worth the disruption.
Jags Assurance works with project owners, EPC programs, and regulated manufacturers on quality management systems and certification readiness, applying the same evidence-first discipline to internal audits and pre-appraisal reviews. The goal is not a clean report. It is a defensible one.
Preparing for a CMMI appraisal?
We run readiness and gap assessments for software, engineering and project-driven organizations as an official ISACA CMMI Partner.
- CMMI Institute — Resource Center ↗CMMI Institute
Questions we get on this topic
Is a CMMI gap assessment the same as an appraisal?
No. An appraisal is a formal evaluation conducted under the CMMI Institute certification programs and results in an official outcome. A gap assessment is an internal or independently commissioned diagnostic that compares current practice to the target requirements so you can close weaknesses before an appraisal team reviews them.
How long does a gap assessment take?
Duration depends on the number of process areas, sites, and projects in scope, plus how easily evidence can be produced. Rather than quote a fixed timeline, scope the assessment first and build the schedule from the confirmed scope. Organizations with dispersed project portfolios should plan for a longer evidence collection phase.
Can we conduct the gap assessment internally?
Yes, and many organizations do. Internal teams know the processes and can move quickly. Be aware of the bias risk: internal assessors tend to sample familiar projects and interpret ambiguous requirements favorably. If the appraisal outcome carries commercial weight, have an independent reviewer verify the critical findings.
How do we confirm the correct target maturity state?
Verify it directly with CMMI Institute resources and the specific certification program you intend to pursue, because the institute offers several certification tracks at different levels. Internal assumptions about the target state are a common source of wasted remediation effort, so confirm the requirement set before any mapping begins.
What should the final deliverable include?
A usable gap assessment ends with a rated gap register, a mapping of current practice to requirements, a remediation roadmap with named owners and sequencing, and a defined re-test point for critical items. A slide deck of themes without a register is not a benchmark you can manage against.
Quality briefs, straight to your inbox
Field-tested guidance on inspection, audits and project quality systems — one issue on the first Tuesday of each month, written for people who have to make them work.
See past issues →- Project Quality Management System: Controls That Hold Under PressureQuality planning, ITPs, evidence chains, nonconformance closure, audits, and turnover — the connected controls that make a project quality system defensible.
- ISO 9001 readiness in 90 days: a phased plan for multi-site organisationsA pragmatic 90-day sequence for gap analysis, remediation and Stage 1 preparation.
- Independent Quality Assurance Consulting: What It Means for Capital ProjectsWhy independent QA consulting is about owner-side evidence, not just advice — from contract requirements and supplier audits to verified closure and turnover.