Assessments & Documents
The team at ITSGovernance believes that no company should be restrained from reaching their best. As industry professionals, consultants and advisors we have built and used many assessment tools and frameworks.
We believe in democratizing technology governance, and placing the capability back into the hands of the leaders and teams responsible for them.
We have moved the free and paid Assessment Tools and Documents Download section to our new web portal. Please register today and stay safe.
Go To ITSGovernance Portal
Some of the Assessment Models
and Documents we have in the Portal
Explore our library of free and paid assessment tools and document downloads, covering global standards, governance practices, and emerging topics.
| Assessment Framework / File Name | Core Focus & Description | Total Questions | Structural Domains |
|---|---|---|---|
| AI Governance Maturity Assessment | A 91-question diagnostic across 12 domains that follows AI governance from the board mandate and AI policy through context and obligations, people and culture, risk and impact, data, model development, fairness, security and release readiness, operations, agentic AI, third parties and assurance. Written for the Chief AI Officer or AI governance lead who needs to answer: is our AI, including the agents acting for us, controlled, accountable and lawful across its whole lifecycle? | 91 | 12 Capability Domains |
| AI Nativeness Assessment | A 16-question diagnostic across 4 domains that evaluates how deeply AI is woven into an organization's operating model, not as a bolt-on tool but as native infrastructure. Written for the CTO, Chief AI Officer, or VP of Engineering who needs to answer: is AI truly integrated into how this organization works, or is it a browser tab that people occasionally open? | 16 | 4 Capability Domains |
| AI Pipeline and MLOps Maturity Assessment | A 65-question diagnostic across 9 domains that evaluates the engineering system that builds, releases and runs ML and GenAI models: platform, ML security, data and labels, evaluation and validation, LLMOps, release, observability, serving and improvement. Written for the head of ML platform or AI engineering who needs to answer: can we ship and run models and GenAI applications reliably, reproducibly and safely, or does each one depend on the people who built it? | 65 | 9 Capability Domains |
| AI Spend Management Maturity Assessment | A 68-question diagnostic across 9 domains that follows AI cost from governance and the operating model through usage metering, budgeting and allocation, AI service cost models, model selection and placement, token and inference efficiency, compute cost, vendor, licensing and product economics, and AI FinOps performance. Written for the CFO, CTO and head of AI FinOps who need to answer: do we know what each AI service, agent and model costs us and what value it produces, or are we paying invoices without control? | 68 | 9 Capability Domains |
| AI Use Case Lifecycle Management Maturity Assessment | A 69-question diagnostic across 11 domains that tests how AI use cases are captured, scored, risk-assessed, piloted, funded, delivered, operated, valued and retired. Written for the Chief AI Officer, CIO or AI Portfolio Lead who needs to answer: can we reliably turn AI ideas, including agents and AI switched on inside vendor software, into safe, funded, working systems that deliver measurable value, and stop the ones that will not? | 69 | 11 Capability Domains |
| API and Integration Lifecycle Maturity Assessment | A 56-question diagnostic across 9 domains that evaluates how APIs, events and integration flows are governed, designed, secured, run and retired, including AI agents and MCP servers as API consumers. Written for the head of API and integration platform who needs to answer: are our APIs and integrations known, safe, reliable and worth what they cost? | 56 | 9 Capability Domains |
| Change Management Maturity Assessment | A 63-question diagnostic across 8 domains that follows an IT change from governance, roles and enablement through request intake and classification, impact and risk assessment, planning, testing and back-out design, scheduling and authorization, implementation and verification, monitoring and control, and post-implementation review, measurement and learning. Written for the change manager or head of IT service management who needs to answer: does our change process protect service stability while letting the right changes through quickly, or is it a rubber stamp or a bottleneck? | 63 | 8 Capability Domains |
| Configuration Management Maturity Assessment | A 65-question diagnostic across 10 domains that follows configuration management from policy and data model design through identification, control, baselines, discovery, status accounting, verification and audit, to use by other practices and measured value. Written for the Configuration Manager who needs to answer: can we trust our configuration data, and is it actually used to make faster, safer decisions? | 65 | 10 Capability Domains |
| Data Classification and Handling Maturity Assessment | A 53-question diagnostic across 6 domains that evaluates whether the organization knows where its sensitive data is and whether each label drives how that data is protected, shared and used by AI: governance and taxonomy, discovery and inventory, labeling, handling and protection by level, cloud, SaaS and AI platforms, and reclassification and monitoring. Written for the CISO or head of information governance who needs to answer: do we know where our sensitive data is, and does its label drive how it is protected, shared and used by AI? | 53 | 6 Capability Domains |
| Data Engineering, Platforms and Observability Maturity Assessment | A 49-question diagnostic across 8 domains that evaluates how data pipelines and data platforms are built, tested, run, secured, costed and improved, including the data they supply to AI. Written for the head of data engineering or data platforms who needs to answer: do our data pipelines and platforms deliver correct data on time, and do we know quickly when they do not? | 49 | 8 Capability Domains |
| Data Governance and Management Maturity Assessment | A 61-question diagnostic across 9 domains that evaluates whether data is run as a governed enterprise asset: board accountability, strategy and policy, the operating model, ownership and AI-assisted stewardship, standards, obligations and data location, literacy, the data landscape, risk and ethics, data for AI, value, and assurance. Written for the Chief Data Officer or head of data governance who needs to answer: is our data governed with a clear mandate, accountable owners, enforced rules and measured value? | 61 | 9 Capability Domains |
| Data Products and Data Sharing Maturity Assessment | A 41-question diagnostic across 7 domains that evaluates whether data is run as products people can find, trust and use, and whether it is shared inside and outside the organization safely and on clear terms: sharing strategy, policy and approvals, data product management, data contracts, internal sharing and interoperability, external sharing, data ecosystems and data acquisition, privacy-preserving and controlled sharing, and value and improvement. Written for the chief data officer or head of data platforms who needs to answer: can people inside and outside the organization find, trust and use our data as products, shared safely and on clear terms? | 41 | 7 Capability Domains |
| DevOps Engineering Maturity Assessment | A 43-question diagnostic across 8 domains that evaluates how software is built, tested and released: engineering strategy and developer experience, source control and review, continuous integration, testing, deployment, environments and platform, AI in engineering, and delivery performance. Written for the engineering leader who needs to answer: can we deliver changes quickly, safely and repeatably? | 43 | 8 Capability Domains |
| DevSecOps Maturity Assessment | A 49-question diagnostic across 8 domains that evaluates how deeply security is built into software delivery, from strategy and secure design through pipelines, supply chain, AI and automation, application remediation, runtime and governance. Written for the engineering or security leader who needs to answer: is security built into our pipeline, or still a gate teams route around? | 49 | 8 Capability Domains |
| Digital Transformation Maturity Assessment | A 62-question diagnostic across 9 domains that evaluates whether the organization is changing how it creates value with technology, with a clear ambition, a target operating model, orchestrated change, capacity to absorb it and proven outcomes, or only running digital projects. Written for the CEO, the chief transformation or digital officer and the transformation office. | 62 | 9 Capability Domains |
| Incident Management Maturity Assessment | A 67-question diagnostic across 11 domains that follows an incident from detection and logging through classification, diagnosis, assignment, resolution, closure, major and security incidents, tracking and escalation, people and tools, and measurement. Written for the incident manager who needs to answer: do we restore service fast, keep people informed, learn from what breaks and can we prove it? | 67 | 11 Capability Domains |
| Intelligent Automation Center of Excellence Maturity Assessment | A 55-question diagnostic across 9 domains that evaluates whether an organization runs automation as one governed capability across workflow and low-code, robotic process automation, intelligent document processing and AI agents doing process work. Written for the head of the automation CoE and the executive sponsor who need to answer: is our automation estate a controlled, valuable capability, or a growing set of fragile bots, flows and agents that only a few people understand? | 55 | 9 Capability Domains |
| IT Asset Management Maturity Assessment | A 70-question diagnostic across 11 domains that follows the asset lifecycle from strategy and people through acquisition, inventory, licensing, hardware, cloud and AI assets, contracts and cost, integration, compliance, disposal and improvement. Written for the ITAM Manager, IT Director or CFO who needs to answer: do we know what IT assets we own and use, are we license-compliant, and are we getting full value from every asset? | 70 | 11 Capability Domains |
| IT Budget and Financial Management Maturity Assessment | A 55-question diagnostic across 8 domains that evaluates how well the organization governs, plans, costs, budgets, tracks, allocates, optimizes and reports its IT spend, including cloud, AI and business-led technology spend. Written for the CIO and head of IT finance who need to answer: do we know what IT really costs and why, is the budget built on sound assumptions and approved in time, and can we see and correct overspend before it happens? | 55 | 8 Capability Domains |
| IT Compliance and Control Assurance Maturity Assessment | A 57-question diagnostic across 8 domains that evaluates whether the organization knows every technology obligation, has controls mapped to it and can prove those controls work before an auditor or regulator asks. Written for the head of IT compliance, the CIO and the audit committee who need to answer: are we compliant, and can we show it? | 57 | 8 Capability Domains |
| IT Demand Management Maturity Assessment | A 53-question diagnostic across 8 domains that follows a technology request from the BRM request funnel to measured benefit: governance and process, people and enablement, intake, triage, sizing and value, decisions and handover, automation and integration, and analytics. Written for the head of IT demand management or IT portfolio manager who needs to answer: does every request reach IT through one channel, get checked against what already exists, receive a fair and fast decision based on value, and deliver the benefit it promised? | 53 | 8 Capability Domains |
| IT FinOps and Cloud Financial Management Maturity Assessment | A 51-question diagnostic across 7 domains that evaluates whether technology spend across cloud, SaaS, data platforms, data centers and AI is visible, owned, forecast, optimized and tied to business value. Written for the FinOps Lead or CFO who needs to answer: does every technology dollar have an owner, a forecast and a reason, and are the people and the automation spending it working within clear limits? | 51 | 7 Capability Domains |
| IT Performance Management Maturity Assessment | A 51-question diagnostic across 8 domains that follows IT measurement from strategy and KPI design through data, dashboards, reviews and improvement. Written for the CIO or IT Performance Manager who needs to answer: do our IT measures tell us the truth about performance, and do they actually change decisions? It covers enterprise IT KPIs and scorecards; system performance is covered by Capacity Performance Management. | 51 | 8 Capability Domains |
| Master Data and Data Quality Management Maturity Assessment | A 53-question diagnostic across 8 domains that evaluates whether the organization has one trusted version of its critical master data and can prove its quality: program and stewardship, standards and models, architecture and integration, quality measurement, entry and change controls, matching and golden records, protection hand-offs, and issue resolution. Written for the head of master data or data quality who needs to answer: do we have one trusted version of our critical data, and can we prove its quality? | 53 | 8 Capability Domains |
| Metadata, Catalog and Lineage Maturity Assessment | A 44-question diagnostic across 7 domains that evaluates whether people and machines can find the organization's data, understand what it means and see where it came from: metadata standards, the business glossary, catalog coverage and curation, lineage and impact analysis, operational metadata, discovery and adoption, and AI and active metadata. Written for the head of data governance or data architecture who needs to answer: can people and machines find our data, trust what it means and see where it came from? | 44 | 7 Capability Domains |
| My Job: Survival & Sanity Maturity Assessment | A 15-question lighthearted diagnostic across 5 domains that applies enterprise-grade scoring to your daily work life. Written for anyone who needs to answer: is my job description fiction, are my tools fighting me, and is lunch a myth? | 15 | 5 Capability Domains |
| Post-Incident Review and RCA Quality Maturity Assessment | A 47-question diagnostic across 7 domains that tests whether post-incident reviews find the real, systemic causes of failure, turn them into changes that stick, meet external reporting duties and stop the same incidents from coming back. Written for the Head of Service Operations, Problem Manager or SRE Lead who needs to answer: do our reviews tell the truth, reach the causes that matter, and make the next incident less likely? | 47 | 7 Capability Domains |
| Problem and Root Cause Management Maturity Assessment | A 59-question diagnostic across 9 domains that follows problem management from policy and problem detection through root cause analysis, known errors, permanent fixes, proactive prevention and proof of incident reduction, including AI-enabled services, AI-assisted analysis and automated fixes. Written for the Problem Manager who needs to answer: are we finding real root causes, arming incident staff with workarounds, and proving that fixed problems stay fixed? | 59 | 9 Capability Domains |
| Project Management Maturity Assessment | A 69-question diagnostic across 10 domains that evaluates how work is classified, and how projects and programs are governed, planned, controlled, resourced, contracted, assured, closed and overseen as a portfolio, including operationally funded projects run on a light track and the use of AI in project work. Written for the Head of PMO or Portfolio Director who needs to answer: is all project-sized work visible, do our projects deliver what was promised on time and on budget, and can we prove the benefits arrived? | 69 | 10 Capability Domains |
| Service Availability Management Maturity Assessment | A 59-question diagnostic across 9 domains that tests whether availability targets come from business need and obligations, services are designed, monitored end to end, tested, maintained and supported to meet them, and delivered availability is measured, reported and improved. Written for the Head of IT Operations, Availability Manager or Head of Infrastructure who needs to answer: do we know how available each critical service must be and what an outage costs, is every service built and run to meet that target, and can we prove the availability users actually experience? | 59 | 9 Capability Domains |
| Service Desk Maturity Assessment | An 85-question diagnostic across 11 domains that follows the employee IT service desk from its mandate and channels through people, tools, requests, ticket handling, knowledge use and escalation, to desk security, self-service, automation and artificial intelligence (AI), measurement and improvement. Written for the Service Desk Manager or Head of IT Support who needs to answer: do employees get fast, consistent and safe help, and can we prove it? | 85 | 11 Capability Domains |
| Service Level Agreements and Performance Maturity Assessment | A 67-question diagnostic across 9 domains that follows the service level lifecycle from mandate and agreement standards through targets, underpinning commitments, measurement, breaches, reporting, customer experience and review, including commitments for artificial intelligence (AI) services, machine consumers, AI model providers and AI agents. Written for the service level management process owner who needs to answer: are our service level commitments agreed, achievable, measured honestly and improving the service customers experience, whether a person or an agent delivers it? | 67 | 9 Capability Domains |
| Service Management System Maturity Assessment | A 58-question diagnostic across 8 domains for the owner of the service management system (SMS). It answers two questions: is our service management system, as a whole, governed, planned, evaluated and improved, and which practices need a deep dive next? The result therefore has two parts, read separately. Part one is the SMS result from Domains 1 to 7 (40 questions): context and scope, leadership, policy and roles, planning, support, service portfolio and planning, performance evaluation, and nonconformity and improvement, tested at system level. Part two is the Practice Health Snapshot, questions 8.1 to 8.18: one self-evaluation per service management practice, reported as a separate practice profile that names the deep-dive model and the questions to run next for each weak practice. | 58 | 8 Capability Domains |
| Service Transition, Release and Deployment Maturity Assessment | A 47-question diagnostic across 8 domains that evaluates how new, changed and retired services are designed, planned, released, accepted, deployed and handed over to operations, including AI models, prompts and agents. Written for the head of service transition or release management who needs to answer: do our releases reach users ready to be run and supported, and do we know when they are not? | 47 | 8 Capability Domains |
| Shadow AI and AI Sprawl Governance Maturity Assessment | A 25-question diagnostic across 5 domains that tests whether an organization can govern the AI tools its people actually use: acceptable use policy, discovery and visibility, data leakage protection, procurement and vendor risk, and spend, value and enablement. Written for the CIO, CISO or IT governance lead who needs to answer: do we know which AI tools our people use, and are we governing them or flying blind? | 25 | 5 Capability Domains |
| Site Reliability Engineering and Observability Maturity Assessment | A 51-question diagnostic across 8 domains that evaluates whether an organization runs its production services to agreed, user-centered reliability targets, sees inside them when they fail, changes them safely, recovers fast and learns, including services built on AI models and agents. | 51 | 8 Capability Domains |
| Software Asset and License Management Maturity Assessment | A 65-question diagnostic across 10 domains that goes deeper than IT Asset Management on software: governance, data and counting, entitlements, license positions by vendor, purchasing controls, SaaS, open source, audit defense, optimization and measurement. Written for the software asset manager who needs to answer: are we licensed correctly for every piece of software we use, can we prove it in an audit, and are we paying only for what we need? | 65 | 10 Capability Domains |
| Technology Governance and Strategy Maturity Assessment | A 52-question diagnostic across 8 domains that evaluates whether technology is governed and directed by the governing body: its mandate and decision rights, policy, strategy, investment direction, oversight of risk, compliance, assurance and AI, reporting, and how governance itself is reviewed. Written for the board, its technology committee and the CIO who need to answer: does the governing body really direct and oversee technology, or does it only receive updates? | 52 | 8 Capability Domains |
| Technology Service Catalog Maturity Assessment | A 65-question diagnostic across 9 domains that evaluates how the service catalog is governed, fed, structured, run on its platform, offered and fulfilled, maintained, retired, adopted and measured, including AI services, reusable platform offerings and access by AI agents. Written for the Service Catalog Manager or Head of IT Service Management who needs to answer: does our catalog give every consumer, human or agent, an accurate view of what IT offers, and does it drive how services are requested and delivered? | 65 | 9 Capability Domains |
| Technology Workforce Readiness Maturity Assessment | A 56-question diagnostic across 9 domains that evaluates whether technology has the people, skills and coverage it needs now and for the next three years, including skills for AI-assisted work, without single points of failure. Written for the CIO and IT leadership team who need to answer: can we run and change our technology if key people leave, if demand shifts, or if AI changes the work? | 56 | 9 Capability Domains |
| Value Realization and Investment ROI Maturity Assessment | A 48-question diagnostic across 7 domains that evaluates whether technology investments deliver the value they promised, and whether the organization moves money away from investments that do not. Written for the CIO, the CFO and the investment review board who need to answer: what did we get for what we spent, and what should we stop? | 48 | 7 Capability Domains |
| Vibe Coding Security and Governance Maturity Assessment | A 25-question diagnostic across 4 domains that tests whether an organization governs AI-assisted software development: the rules and input protection, how AI-generated code is reviewed and tested, how the dependencies it suggests and the code it produces are secured, and whether the organization measures results and learns. Written for the CTO, engineering lead or AppSec team who needs to answer: are we governing AI-assisted code, or just shipping it faster? | 25 | 4 Capability Domains |
Still have questions? Get in touch
Business Bay, Dubai, UAE
Copyright © ITSGovernance All Rights Reserved