A maturity level tells you where a practice currently stands. The binding constraint tells you why it cannot advance and what evidence would change the answer.
Use this worksheet after IO computes a practice finding and before selecting the next intervention. It prevents a team from improving the easiest metric instead of the gate that actually limits progression.
Industry basis and IO position
Constraint-based improvement is familiar in operational management, and C2M2 uses staged practice and institutionalisation concepts. IO applies the idea narrowly to its own maturity gates. A binding constraint is the first unmet IO gate in the required sequence; it is not a C2M2 MIL finding, an audit deficiency or proof that the identified action will improve security.
1. Lock the assessment context
| Field | Entry |
|---|---|
| Practice | |
| Domain | |
| Systems, populations and business units in scope | |
| Observation window | |
| IO maturity-model version | |
| Evidence sources required | |
| Source coverage | |
| Record completeness | |
| Confidence | High · Moderate · Limited · Not yet assessable |
If the practice is not yet assessable, stop here. The immediate constraint is evidence availability, sample or window, not a maturity gate. Do not assign a Level 0 merely to complete the worksheet.
2. Test the gates in sequence
| Gate | Current result | Required result | Pass? | Evidence reference |
|---|---|---|---|---|
| Accountable ownership | ||||
| Timely disposition | ||||
| Sustained cadence | ||||
| Structured rule coverage | ||||
| Governed exceptions | ||||
| Verification coverage | ||||
| Adaptation after failure |
Stop at the first unmet required gate. A stronger result at a later gate does not compensate for it, because IO levels do not average and do not skip.
3. Name the binding constraint
This practice is held at Level ____ because ___________________________.
| Constraint field | Entry |
|---|---|
| First unmet gate | |
| Current value | |
| Required value | |
| Absolute gap | |
| Eligible denominator | |
| Missing or excluded population | |
| Confidence limitation | |
| Earliest date the gap can be re-measured honestly |
The denominator matters as much as the percentage. “Verification coverage is 41%” is incomplete without the number of eligible interventions and the share whose data could not be assessed.
4. Test whether it is truly binding
- All earlier gates passed under the same model version.
- The assessment window and minimum sample are complete.
- The result is not caused by an impaired or missing source.
- The scope was fixed before the result was known.
- The gap is not a threshold or model-version change presented as operating movement.
- Closing the gap would make this gate pass if nothing else changed.
If any answer is no, describe the issue as a measurement or model constraint rather than an operating constraint.
5. Choose the next intervention
| Field | Entry |
|---|---|
| Proposed playbook | |
| Why it addresses this gate | |
| Accountable owner | |
| Population | |
| Expected completion window | |
| Verification measure | |
| Guardrail measure | |
| Strongest alternative | |
| Reason not selected |
The selected intervention should address the mechanism behind the gap. Adding more owners will not fix late disposition if the workflow has no decision window; producing more completed work will not fix missing verification criteria.
6. State what success would and would not mean
If the measure reaches ______ by ______, the practice would satisfy the current ______ gate under model version ______, subject to the remaining gates and evidence confidence.
Passing the constraint permits a new maturity determination. It does not prove that the intervention caused the change, that risk is within appetite, or that the organisation satisfies an external framework.
Worked example
Practice: third-party access review Assured level: 3 - Governed Binding constraint: verification coverage 41% against the Level 4 gate of 70%, across 34 eligible completed interventions. Gap: 10 additional eligible interventions must carry a valid baseline, expected outcome, post-intervention measurement and result, assuming the denominator remains 34. Important qualification: the denominator will change as new work completes, so the required count must be recomputed at the next assessment.
References
- US Department of Energy, C2M2 v2.1 (opens in a new tab)
- IO, IO Maturity Model - Specification, current model version