CMMI maturity levels on controls

Controls used to be implemented or not.A check box.Useful for a compliance binary, unnecessary to track where a control is actually located.

Controls now use a CMMI maturity level. You can tell the difference between a control that someone documented last week and one that worked and was measured for a year. Auditors see it, your team sees it and you no longer pretend that ad-hoc work counts as mature.