Why measure ITAM maturity

Cost savings are easy to point at in the first years of an ITAM program. They get harder once the obvious waste is gone. A maturity score is the other way to show whether the process is getting stronger, and where it is still thin.

The assessment groups questions against the reasons an organization runs ITAM, so you can see which processes support the goal you actually have. Compare the score with that goal and the weak process is the one to fix next.

An ISO readiness add-on compares the same system with ISO 19770-1, the international standard for IT asset management. It shows where more work would be needed before a certification effort. It does not certify you. The ITAM Forum, which helped set up that program, describes the certification as a way to:

• Show internal stakeholders that an effective ITAM system is in place, because an outside party certified it.
• Show regulators, customers and shareholders the same thing.
• Find licensing and security risks before they become issues. Weak ITAM is a financial, reputational and operational risk.
• Make it easier to hire ITAM staff, and to show a vendor that the estate is controlled.

Benchmarking against other organizations, by industry and size, is not in the assessment yet.

One goal the questions are built for is demonstrating regulatory compliance. Finance and health care are often audited for information security and operational resilience, by a regulator or by a customer under a know-your-supplier check. A process you have written down, and that you measure, is easier to show. Connecting the goal to the process that supports it is also how you justify the next improvement.

The questions themselves are on What the maturity assessment asks. How to answer them is on Take the ITAM maturity assessment.