CMMI Maturity Levels on Controls

Controls used to be implemented or not. A checkbox. Useful for a compliance binary, useless for tracking where a control actually is.

That boolean is gone. Controls now use a CMMI maturity level. You can tell the difference between a control that someone documented last week and one that's been running and measured for a year. Auditors see it, your team sees it, and you stop pretending ad hoc work counts as mature.