What the maturity assessment asks

The ITAM maturity assessment scores how your organization manages software assets, and where that practice should improve next. The result is a domain profile you can take to a sponsor.

It has 116 questions. This page lists 44 of them, so you know what you will be asked before you start. The questions follow common ITAM frameworks, including ISO/IEC 19770.

Assesses the existence and alignment of formal ITAM strategies and operational plans.

• Do you have a strategic ITAM plan?
• Is your plan aligned with IT and business objectives?
• Does your strategy include:
  • Stakeholder engagement
  • KPIs and performance targets
  • Technology roadmap
• Does your operational plan cover:
  • Lifecycle stages (procurement, deployment, disposal)
  • Continuity planning

Focuses on leadership involvement, sponsorship, and ITAM accountability.

• Do you have an executive ITAM sponsor?
• How engaged is the sponsor (passive → accountable)?
• Does the sponsor:
  • Attend reviews
  • Allocate funding
  • Drive cross-functional alignment

Evaluates documentation and enforcement of ITAM policies.

• Do you have a formal ITAM policy?
• Is the policy:
  • Standalone or embedded in wider governance?
  • Communicated and reviewed regularly?
• Does it include:
  • Licensing obligations
  • Acceptable use criteria
  • Asset types and ownership

Reviews the breadth of the ITAM system across asset types and locations.

• Is your ITAM scope clearly defined?
• Does it cover:
  • End-user devices
  • Data center and cloud infrastructure
  • BYOD and SaaS applications
• Is it reviewed and updated regularly?

Assesses ITAM-specific risk identification and mitigation practices.

• Do you have a risk management framework?
• Is it aligned with enterprise risk management?
• Does it address:
  • Software audits
  • Licensing gaps
  • Risk owners and escalation processes

Looks at the capability and awareness of stakeholders involved in ITAM.

• Do you have an ITAM training plan?
• Is training:
  • Role-specific and continuous?
  • Based on frameworks (e.g., SFIA)?
• Does it cover:
  • Vendor licensing models
  • Induction and refresher training

Reviews data governance and documentation controls.

• Do you maintain an information management plan?
• Is it:
  • Version-controlled?
  • Linked to audit trails and ownership?
  • Secure and accessible?

Evaluates process reliability and data validation practices.

• Do you have a QA framework for ITAM?
• Do you verify:
  • Inventory accuracy vs. CMDB
  • License entitlements vs. usage
• Are these checks periodic or continuous?

Focuses on managing vendors, license agreements, and renewals.

• Do you track software contracts and entitlements?
• Do you review:
  • Compliance clauses
  • True-up provisions
  • Renewal milestones

Examines how modern environments are governed under ITAM.

• Is there a BYOD management policy?
• Do you monitor:
  • SaaS consumption
  • Cloud asset deployment
  • Shadow IT exposure?

Assesses how insights are used to drive decisions.

• Do you report regularly on ITAM performance?
• Do reports include:
  • Risk and non-compliance summaries
  • Financial optimization opportunities
• Are reports used to inform business cases or process improvements?

• Format: Multiple-choice questions with maturity scaling
• Outcome: Domain-level maturity profile with tailored recommendations
• Intended Audience: ITAM managers, governance leads, procurement teams, compliance officers