Which statement is true about commonly used governance maturity models?

• A. PCI-DSS.
• B. ITIL alone.
• C. COBIT, CMMI, or custom.
• D. ISO 9001 only.

Answer: (C)

Governance maturity models are frameworks used to assess and improve how an organization governs its processes and controls, often by outlining maturity levels and a path for enhancement. Among the commonly used options, COBIT and CMMI stand out: COBIT provides a comprehensive governance and management framework for enterprise IT, aligning business goals with IT governance objectives, while CMMI focuses on process maturity and capability improvement, helping organizations mature governance-related processes. Many organizations also tailor their approach with a custom model that combines practices from multiple standards to fit their specific governance needs and risk landscape.

Standard security or quality frameworks like PCI-DSS, ITIL, or ISO 9001 are not governance maturity models in the same sense. PCI-DSS targets payment card security requirements, not overall governance maturity. ITIL concentrates on IT service management practices rather than a maturity framework for governance itself. ISO 9001 focuses on quality management systems, not specifically on governing organizational processes at a maturity level. This is why the statement that commonly used governance maturity models include COBIT, CMMI, or custom is the best fit.