Management monitors compliance and measures process effectiveness using key performance indicators (KPIs). Processes are regularly audited. Corrective actions are taken based on data. The focus is on control and predictability.

The organization has no basic IT processes in place. Management has not even recognized that an issue or process needs to be addressed. Complete chaos or complete lack of control.

Basic processes are established, but they are not formally documented or enforced. Different people or departments may follow different methods. There is some consistency, but mainly due to informal training or habit. No formal communication or training exists.