Controls now carry a real maturity score instead of a binary implemented flag.
Controls used to be implemented or not. A checkbox. Useful for a compliance binary, useless for tracking where a control actually is.
That boolean is gone. Controls now use a CMMI maturity level. You can tell the difference between a control that someone documented last week and one that’s been running and measured for a year. Auditors see it, your team sees it, and you stop pretending ad hoc work counts as mature.
