When an organization asks for a maturity assessment, it usually expects to hear that something is missing. The more common finding is that nothing is missing. Everything is there, somewhere, owned by someone, and none of it connects.
The business impact analysis lives in a spreadsheet the IT team built. Crisis plans, developed by legal, sit in a shared drive that IT disaster recovery has never opened. The exercise program runs on a calendar maintained by one person who also does the vendor questionnaires. Each piece works. Together they do not add up to a program, and they do not add up to a score leadership can act on.
What scattered looks like on the scale
On the 0 to 5 scale, scattered programs cluster between 1.5 and 2.5. Individual controls often score a 3: documented, standardized within their silo. The categories that pull the score down are the ones that require the pieces to talk to each other: alignment between the business impact analysis and recovery strategies, the link between exercise findings and plan updates, leadership review of the whole rather than reports on the parts.
That is why a scattered program can feel busy and still score a 2. The effort is real. The integration is not.
Why it matters for the conversation with leadership
A 2 presented as a list of findings reads as criticism of people who are working hard. A 2 presented as a score with a picture by domain reads as a starting point. The difference is the picture. When leadership can see that business continuity scores 2.8 and crisis management scores 1.9 and the gap between them is the problem, the conversation shifts from “who dropped the ball” to “where do we invest first.”
What to do with a scattered program
Resist the urge to fix everything. Pick the two or three categories whose improvement would connect the rest, usually governance, the business impact analysis, and exercising. Set a target of 3 for those, not 4. Reassess in twelve months. Programs that do this reliably move from the low 2s to the low 3s within two years, and the second assessment is where the political capital comes from, because the improvement is visible.
The self-check will not tell you whether your program is scattered, but it will show you which domains are holding the score down, which is usually the same thing.