Introducing first PKI Maturity Model (PKIMM)

Thursday August 10, 2023

Last year, the PKI Consortium established the PKI Maturity Model Working Group to build a PKI maturity model for evaluation, planning, and comparison between different PKI implementations.

Today, we are happy to announce that the initial draft version of the model has been finalized and is publicly available!

Anyone who would like to try the model and perform the assessment is more than welcome.

The PKI maturity model

The maturity model is based on the Capability Maturity Model Integration (CMMI) developed by Carnegie Mellon University. It provides the following:

  • Quickly understand the current level of capabilities and performance of the PKI
  • Support comparison of PKI maturity with similar organizations based on size or industry (anonymized)
  • Guidance on how to improve the capabilities of the current PKI
  • Improve overall PKI performance

The PKI maturity model defines 5 levels of the PKI maturity based on different indicators and associated risks.

#Maturity levelShort description
1InitialUnpredictable process with poor control and always reactive
2BasicProcess is characterized by each particular case or project and controls are often reactive
3AdvancedProcess is characterized by organizational standards and controls are proactive
4ManagedProcesses are measured and controlled, proactive approach
5OptimizedContinuous improvement of the processes and procedures, proactive approach for future technology improvement

The model is divided into 4 Modules and 15 Categories that covers aspects and activities related to the PKI (people, process, technology). The overall maturity level is determined based on the maturity of the categories.

The following diagram shows the structure of the model:

      Strategy and vision
      Policies and documentation
      Processes and procedures
      Key Management
      Certificate Management
      Infrastructure Management
      Change Management and Agility
      Monitoring and Auditing
      Knowledge and Training

PKI maturity assessment

The Assessment process provides a consistent and convenient approach to assess the maturity level of any PKI implementation and use case.

The assessment process defines steps to scope, assess, evaluate, and report the maturity level of the PKI implementation, including continuous improvement.

1ScopingThe scope definition is the first step of the assessment process. The scope defines the boundaries of the assessment and the applicability of the requirements.Scoping
2AssessmentThe assessment is the process of evaluating the maturity of the PKI environment against the requirements defined in the maturity model within the boundaries of defined scope.Assessment
3EvaluationThe evaluation is the process of analyzing the results of the assessment and determining the maturity level of the PKI environment.Evaluation
4ReportingThe reporting is the process of documenting the results of the assessment and evaluation.Reporting

To support the assessment process, we have built a simple Excel-based tool that guides you through the process and automatically generates evaluation and reports based on inputs provided by the assessor.

The PKI maturity assessment tool is available for anyone to download and apply.

Feedback and discussion

The PKI Consortium is planning to finalize this draft of the model and release a first official version that can be used to provide consistent assessment results. Therefore, the feedback from users is very valuable.

We have prepared a feedback form and would appreciate providing the information that would help us to improve and adjust the model before its first final version.

Do not hesitate to use our community discussions to raise any question or topic!

Summary of resources

PKI maturity modelDefinition of the PKI maturity model and description of the maturity assessment process and procedures in order to rate the current maturity level and to track progress.
Categories descriptionDescription of PKI maturity model related categories and associated requirement, guidance, assessment tips, and references.
PKI maturity assessment processDescription of the assessment process.
PKI maturity assessment toolsAvailable tools for the assessment of the PKI implementation and use case.
Feedback formPKI maturity model and assessment feedback form.
PKI maturity model community discussionIdeas, questions, or feedback that you want to share or discuss related to the PKI maturity model.

Reading time: 4 minutes


Roman Cinkais (3Key Company)

Related Articles

Related Topics

    Maturity model PKIMM

    We thank our sponsors for their ongoing support of the PKI Consortium

    Participate in our community discussions and/or join the consortium