Information Security Management Metrics

201

Appendix F: Capability

Maturity Model

Level 1—Initial

At maturity level 1, processes are usually ad hoc and the organization usually does

not provide a stable environment. Success in these organizations depends on the

competence and heroics of the people in the organization and not on the use of

proven processes. In spite of this ad hoc, chaotic environment, maturity level 1

organizations often produce products and services that work; however, they fre-

quently exceed the budget and schedule of their projects. Maturity level 1 organi-

zations are characterized by a tendency to over commit, abandon processes in the

time of crisis, and not be able ...