SOC-CMM Explained: 5 Domains, Scoring, vs CMMI
TL;DR · the short version
SOC-CMM and CMMI both measure maturity, but they are built for different jobs. SOC-CMM (by Rob van Os) is purpose-built for a security operations centre: it scores five domains — Business, People, Process, Technology and Services — on both maturity and capability, and ships as a free self-assessment spreadsheet. CMMI (Capability Maturity Model Integration) is a general process-improvement framework with five levels (Initial → Managed → Defined → Quantitatively Managed → Optimizing) used across engineering and IT, not SOC-specific. For assessing and improving an actual SOC, SOC-CMM fits directly; CMMI is better when you need one maturity language across many functions or a formal appraisal. Most teams get more from SOC-CMM, and from re-running it to show a trend rather than chasing a single number.
SOC-CMM and CMMI both measure "maturity," but they answer different questions. SOC-CMM is purpose-built for a security operations centre; CMMI is a general process-improvement framework used across engineering and IT. If you want to assess and improve an actual SOC, the short answer is use SOC-CMM — here is why, and when CMMI earns its place.
SOC-CMM: built for the SOC
SOC-CMM, created by Rob van Os, is a free self-assessment that scores a SOC across five domains — Business, People, Process, Technology and Services. Crucially it rates each on two axes: maturity (how formal and managed something is) and capability (how well it actually performs). That split is the whole point — it's why a SOC can look "mature on paper" (documented process, named owners) while scoring low on capability (the detections don't fire, the hunts don't happen). You answer the questions, and it produces per-domain scores you can re-run and trend.
CMMI: a general maturity language
CMMI (Capability Maturity Model Integration) describes process discipline on five levels: 1 Initial, 2 Managed, 3 Defined, 4 Quantitatively Managed, 5 Optimizing. It's used across software and engineering, often with formal appraisals. It gives an organisation one shared way to talk about maturity — but it says nothing SOC-specific. A "Level 3" tells you a process is standardised org-wide; it does not tell you whether your threat hunting or incident response is any good.
Which one fits your security operations?
- Assessing/improving a SOC → SOC-CMM. It maps directly to what a SOC runs, it's free, and the maturity-vs-capability split surfaces the gaps that matter.
- One maturity language across many functions, or a required appraisal → CMMI. If leadership or a customer wants everything reported on a single CMMI scale, or a contract demands an appraised level, that's CMMI's job.
- Both. Plenty of teams assess the SOC with SOC-CMM and report it upward in CMMI-style level language. They're not mutually exclusive.
The mistake to avoid
Treating either as a one-time score. A single maturity number is a vanity metric; the value is the trend — re-assess on a cadence, show movement per domain, and tie each gap to a funded action. That's what turns a maturity model from a slide into a roadmap.
Want the numbers now? Run a SOC-CMM-style self-assessment across the five domains with the SOC maturity assessment, and see the broader picture in SOC maturity models explained and SOC best practices.
Frequently asked questions
What is the difference between SOC-CMM and CMMI?
SOC-CMM is a maturity model built specifically for security operations centres — it assesses five SOC domains (Business, People, Process, Technology, Services) on both maturity and capability. CMMI (Capability Maturity Model Integration) is a general-purpose process-maturity framework with five levels used across software, engineering and IT. SOC-CMM tells you how developed your SOC is in SOC terms; CMMI gives you a common maturity language across an organisation but is not SOC-specific.
Which maturity model should I use for my SOC?
For assessing and improving an actual SOC, use SOC-CMM — it maps directly to the functions a SOC runs and comes as a free self-assessment. Reach for CMMI (or alongside it) when you need one maturity scale across many functions, or when a formal, appraised CMMI level is a contractual or customer requirement. The two are not mutually exclusive: many teams assess the SOC with SOC-CMM and report it up in CMMI-style level language.
Is SOC-CMM free?
Yes. SOC-CMM (created by Rob van Os) is published as a free self-assessment spreadsheet with its scoring model. You answer the questions per domain and it produces maturity and capability scores you can track over time. PlayCISO also offers an interactive SOC maturity self-assessment if you prefer to run it in the browser and keep a trend.
What does SOC-CMM actually measure?
Five domains: Business (alignment, mandate, governance), People (staffing, skills, training), Process (how work is run and documented), Technology (the tooling and its coverage), and Services (the capabilities the SOC delivers, e.g. monitoring, incident response, threat hunting). Each is scored for maturity (how formal/managed it is) and capability (how well it actually performs), which is why a SOC can be "mature on paper" yet low-capability in practice.
What are the CMMI maturity levels?
Five: 1 Initial (ad hoc, unpredictable), 2 Managed (reactive, project-level process), 3 Defined (proactive, organisation-wide standards), 4 Quantitatively Managed (measured and controlled with data), and 5 Optimizing (continuous improvement). They describe how disciplined and measured a process is in general — not security-operations specifics.