Blockchain Maturity Model (BMM)
Blockchain Maturity Model (BMM)
Version: 1.0
Date: January 14, 2023
Status: Approved
Approvals
This document is the work product of the GBA Standards & Certification Working Group.
Government Blockchain Association
Blockchain Maturity Model (BMM)
Overview
Contents
1 Introduction ..................................................................................................................................................................... 1
1.1 Why Do We Need the BMM? ............................................................................................................................ 1
1.2 What is the BMM? ................................................................................................................................................ 1
1.3 Who is the Audience for the BMM? ............................................................................................................... 1
1.3.1 Blockchain Solution Providers .............................................................................................................. 1
1.3.2 Investors......................................................................................................................................................... 1
1.3.3 Acquisition Professionals ........................................................................................................................ 1
1.3.4 Customers ...................................................................................................................................................... 1
1.4 How is the BMM Used......................................................................................................................................... 2
1.5 How is the BMM Maintained ........................................................................................................................... 2
1.6 Terms & Definitions ............................................................................................................................................ 2
2 Scope of the BMM Series ............................................................................................................................................. 2
2.1 Blockchain Solutions........................................................................................................................................... 2
2.2 BMM Document Series ....................................................................................................................................... 2
2.2.1 Overview ........................................................................................................................................................ 3
2.2.2 Requirements ............................................................................................................................................... 3
2.2.3 Resources & Tools ...................................................................................................................................... 3
3 Guiding Principles.......................................................................................................................................................... 4
3.1 Blockchain Principles ......................................................................................................................................... 4
3.1.1 Primary Principles ..................................................................................................................................... 4
3.1.2 Secondary Principles ................................................................................................................................. 5
3.2 Blockchain Maturity Model (BMM) Principle ........................................................................................... 5
3.2.1 Solution Improvement Journey ............................................................................................................ 5
3.2.2 Domain Context ........................................................................................................................................... 6
3.3 Assessments ........................................................................................................................................................... 6
3.3.1 GBA Authorized BMM Assessment Partners (BAPs) ................................................................... 6
3.3.2 Assessment Preparation .......................................................................................................................... 7
3.3.3 Assessment Planning ................................................................................................................................ 7
3.3.4 Objectivity vs Insight................................................................................................................................. 7
3.3.5 Conflicts of Interests.................................................................................................................................. 8
3.4 Conducting Assessments & Reporting Results ........................................................................................ 8
4 BMM Content & Structure .......................................................................................................................................... 8
Appendixes:
A Terms & Definitions
B Authors, Contributors, and Acknowledgements
C Amendment History and Change Management
1 Introduction
The purpose of this document is to describe the content, structure, use, and maintenance
of the Blockchain Maturity Model (BMM) which is composed of requirements, resources &
tools applicable to blockchain solutions. A blockchain solution includes all layers (network,
protocol, application & transactions) of the solution.
1.1 Why Do We Need the BMM?
Some governments and enterprises are in the process of purchasing and acquiring
blockchain based solutions. However, they have little if any experience in acquiring,
implementing, or maintaining blockchain based solutions.
1.2 What is the BMM?
The BMM is a structured framework to compare a proposed or instantiated blockchain
solution against the attributes or elements of a reliable solution. It includes an
assessment of both the product characteristics and the processes used to develop and
maintain the solution. This model is technology agnostic and is equally applicable to
public, private or hybrid blockchain solutions. It is not associated with any specific vendor,
domain, or industry. It is intended to be equally applicable to all blockchain
implementations.
1.3 Who is the Audience for the BMM?
1.3.1 Blockchain Solution Providers
Blockchain solution providers use the BMM as a roadmap to improve their solution and
to demonstrate how it satisfies industry best practices and can be trusted by investors,
acquisition professionals, and customers. The assessment is used to demonstrate that
the solution meets internationally recognized criteria for trusted blockchain solutions.
1.3.2 Investors
Solution Investors uses BMM assessment results to evaluate the maturity and value of
potential solution investments. Level one & two assessments are applicable to potential
solutions and evaluate the feasibility and soundness of plans, and designs.
1.3.3 Acquisition Professionals
Acquisition professionals use assessment results to evaluate proposed solutions and
benchmark offered solutions against a common standard to support fair and effective
acquisition selections.
1.3.4 Customers
Solution customers use assessment results to support the evaluation and selection of
blockchain solutions that meet their expectations and can be trusted to have integrity
and sustainability for the life cycle of a solution.
2.2.1 Overview
This BMM Overview Document describes the overall purpose, content, and structure of
the BMM series of work products. It also establishes guiding principles, definitions, and
references to related work products that compose the BMM Series.
2.2.2 Requirements
2.2.2.1 Model Requirements
The BMM Model Requirements describes the criteria required for each element and
level of maturity in order to achieve a rating for each element of the BMM.
2.2.2.2 Assessment Requirements
BMM Assessment Program Requirements describe the method and criteria to plan,
conduct, and report BMM assessment results.
2.2.2.3 Training & Certification Requirements
The BMM Training & Certification Requirements Document describes the method and
criteria for ensuring that individuals have received adequate training & demonstrated
their competence to implement and assess BMM compliance.
2.2.3 Resources & Tools
The GBA makes resources and tools available to the public on the GBA BMM Resources
page. This includes general information such as videos, overview text, downloads of the
model, assessment requirements, and a directory of certified BMM professionals.
2.2.3.1 Certified BMM Professionals
The GBA maintains a directory of GBA credentialed professionals. These individuals
include:
• Consultants - GBA members that complete a GBA Blockchain Foundations Course,
the GBA BMM Course, and a BMM Workshop, and are active participants in the
GBA BMM Continuous Educational Program are listed on the GBA site as BMM
consultants.
• Assessors – Individuals that meet the consultant criteria and have successfully
completed the GBA Assessment Team Member course and have been accepted
into the BMM Assessment Program, are listed on the GBA site as BMM Assessors.
• Lead Assessors – Individuals who have met the requirements of a BMM Assessor
and have:
o Participated in at least two assessments, as a team member
o Led an assessment observed and evaluated by GBA Certified Lead Assessor.
• BMM Trainer – Individuals who are qualified by GBA.
2.2.3.2 Consulting Toolbox
The GBA develops resources and tools available to certified individuals that have met
the criteria described in the BMM Training & Certification Requirements Document.
These resources include checklists, templates, and guidance documents to support the
3 Guiding Principles
This Guiding Principles are fundamental truth or proposition that serves as the foundation
for the BMM series. The following principles are used to interpret and guide the
implementation and continual improvement of the BMM series, and the solutions being
implemented and evaluated.
3.1 Blockchain Principles
The primary principles, Decentralization & Distributed are fundamentals of a blockchain
solution. The secondary principles support the achievement of the primary principles or
are the result of the primary principles.
3.1.1 Primary Principles
The primary reason that the first blockchain was established in the early 1990’s resulted
from a concern that as the world was increasingly relying on digital records and those
electronic records could be altered without detection. The researchers pondered what it
would be like to live in a world where records could not be trusted. Using the work of
David Chaum’s paper "Computer Systems Established, Maintained, and Trusted by
Mutually Suspicious Groups" they developed a system that was decentralized and
distributed. In 1991 Scott Stornetta and Stuart Haber developed and implemented the
first blockchain and are considered by many to be the Founders of blockchain. Their
solution used the concept of data linked together cryptographically and confirmed with
collective witnessing. In 2008 Satoshi Nakamoto 2referred to their work in the Bitcoin
whitepaper3, adding the concept of a payload that included a ledger and a token
(Bitcoin).
1 Access to the GBA BMM Professionals Document Library is limited to GBA BMM Professional members.
2 The identity of Satoshi Nakamoto is widely disputed.
3 https://bitcoin.org/bitcoin.pdf
should be used as a coaching tool. Consultants, assessors, and lead assessors should be
focused on helping solution providers improve their solution.
3.2.2 Domain Context
While the BMM identifies core requirements that are applicable to all blockchain
solutions, it must be understood that some domains have differing expectations and
requirements. For example, identity management expectations are very different
depending on the domain.
• Banking & financial systems in regulated industries require strict observance of
Anti-Money-Laundering (AML) and Know-Your-Customer (KYC) regulations.
• Medical trials solutions require that you know that data came from a specific
patient identifier. However, their specific identity may need to be concealed.
• Most election systems require permanent separability between the voter and
their vote.
BMM professionals must have the flexibility, expertise, and judgement to apply the
requirements appropriately in the domain context.
3.3 Assessments
BMM assessments are a process. This process is based on specific requirements for:
• Preparing
• Planning, and conducting assessments, and
• Reporting results.
3.3.1 GBA Authorized BMM Assessment Partners (BAPs)
GBA recognizes and publishes assessment results that are performed by either the GBA
or GBA Authorized BMM Assessment Partners (BAPs). The process to become a BAP
includes the following criteria:
• GBA standard organizational member in good standing
• Recommended by the GBA Regional Lead
• Approved by the GBA Director of Standards & Certifications
The BAPs establish business relationships with entities for the conduct of an assessment.
However, a BAP may not engage in business relationships to conduct consulting and
appraisal services to the same entity.
The BAP is required to register the assessment with the GBA Director of Standards &
Certification within 30 days of entering an assessment agreement. Upon conclusion of the
assessment the BAP submits all the assessment deliverables to the GBA Director of
Standards & Certification for review and approval along with a BMM Assessment Review
Fee. Once approved, the assessment results shall be posted on the BMM Website.
• No internal member of the assessment team may have supervisory authority over
another internal member of the team.
3.3.5 Conflicts of Interests
Conflicts of interest are almost unavoidable. However, the Lead Assessor is responsible
for ensuring that all potential conflicts of interest are identified and mitigated.
3.4 Conducting Assessments & Reporting Results
Assessment teams will review evidence and conduct interviews to perform the
assessment. The team will achieve consensus on the results of the appraisal. Appraisal
results include a rating for each element. The lowest common element rating for all
elements determines the overall solution level rating. Along with the ratings are
weaknesses/improvement opportunities identified by the team to help the organization
mature the solution to the next level of maturity for each element. The assessed
blockchain solution will be listed on the GBA website.
The following subparagraphs describes the goals associated with each element.
4.1.1 Distribution
The goal of distribution is to assess the hosting concentration risk from homogeneous to
heterogeneous.
4.1.2 Governance
The goal of governance in a blockchain solution is to provide effective management of
key components, including assets, nodes, synchronization mechanisms,
infrastructure/network, system, participants, protocols, records, and smart contracts or
life cycle scripts. Governance may be performed by a variety of mechanisms ranging
from a centralized authority to one or more mutualized network agreement.
4.1.3 Identity Management
The goal of identity management in a blockchain solution is to ensure that controls are
in place for identity and access management. Controls include:
• Methods to identify users of a system and establish a user profile, address, or
other identifier
• Define the activities and processes to bind a user to a known identity or
dissociate a user from a real-word identity to protect anonymity.
• Associating user profiles with one or more roles and/or permissions
• Associating roles and levels of access and permissions
• Allocating users to groups
• Adding, modifying, or removing users, roles, groups, and permissions
• Limiting access to individuals and groups based on defined rules.
4.1.4 Interoperability
The goal of interoperability is to facilitate the ability of a blockchain solution to share
and use information and assets with other legacy and blockchain solutions.
4.1.5 Performance
The goal of performance in a blockchain solution is to ensure that the transaction
volumes and speed are suitable for the use of the blockchain. This is measured based on
an understanding of demand requirements and resource utilization. It includes
consideration of capacity, cost, latency, memory, transaction speeds, and transaction
finality.
4.1.6 Privacy
The goal of privacy in a blockchain solution is to ensure that the solution has adequate
encryption and protections of Personal Identifiable Information (PII) in accordance with
international standards such as the General Data Privacy Regulation (GDPR). The
protections are required both internally and externally to the network because the key
components, composed of nodes, synchronization mechanisms, infrastructure/network,
system, deterministic scripts, and smart contracts.
4.1.7 Reliability
The goal of reliability in a blockchain solution is to provide the assurance that adequate
controls address and mitigate the resolution of the disputed forks, blocks, errors or
fraud of the network.
Term Definition
Administrative The ability to make changes to either node hardware or ledger
Control updates.
Asset Anything that has value to a stakeholder. See ISO/TS 19299:2015 3.3
Block Structured data comprising block data and a block header
Block data Structured data comprising zero or more transaction records or
references to transaction records.
Block header Structured data that includes a cryptographic link to the previous
block unless there is no previous block
Block reward reward given to miners or validators after a block is confirmed in a
block chain system
Blockchain distributed ledger with confirmed transactions organized in an
append-only, sequential chain using cryptographic links
Blockchain system system that implements a blockchain
Charter The term “charter’ or “project charter” refers to one or more
documents that describes how the blockchain solution will be
implemented. It could be a proposal, white paper, project plan,
design document, technical data package or any other combination
of work products that define the intentions of parties to implement
a blockchain solution.
Components Referred to nodes, consensus mechanisms, infrastructure/network,
system, deterministic scripts and smart contracts.
Consensus Agreement among DLT nodes that a transaction is validated and that
the distributed ledger contains a consistent set and ordering of
validated transactions
Consensus Rules and procedures by which consensus is reached
Mechanism
Crypto-asset Digital asset implemented using cryptographic techniques
Cryptocurrency crypto-asset designed to work as a medium of value exchange
Cryptographic hash function mapping binary strings of arbitrary length to binary strings
function of fixed length, such that it is computationally costly to find for a
given output an input that maps to the output, it is computationally
infeasible to find for a given input a second input that maps to the
same output, and it is computationally infeasible to find any two
distinct inputs that map to the same output
Cryptographic link Reference, constructed using a cryptographic hash function
technique, that points to data.
Cryptography Discipline that embodies the principles, means, and methods for the
transformation of data in order to hide their semantic content,
Term Definition
prevent their unauthorized use, or prevent their undetected
modification.
Decentralization This term is used to describe the degree to which decision or actions
can be taken by a single party compared to a general population of
stakeholders
Decentralized Application that runs on a decentralized system
application DApp
Decentralized system Distributed system wherein control is distributed among the persons
or organizations participating in the operation of the system.
Digital Asset Asset that exists only in digital form or which is the digital
representation of another asset.
Domain Area The set of functions that are necessary for the application of
blockchain technology for specific uses.
Element A single characteristic that a blockchain solution should have for it to
be a reliable solution.
Immutability A property wherein ledger records cannot be modified or removed
once added to a distributed ledger
Interoperability The ability of two or more systems or applications to exchange
information and assets. It also includes the ability to mutually use
the information and assets that have been exchanged.
Key Component A component that if it fails or is degraded would negatively impact
the overall performance of the blockchain solution.
Blockchain Node A blockchain node is a device, usually a computer, that participates
in a blockchain network. It runs the blockchain protocol's software,
allowing it to help validate transactions and keep the network
secure. Blockchain nodes communicate with each other. The more
independently controlled nodes there are, the more decentralized
the network is.
Smart Contract Software code that automates the execution of an agreement.
Note: A smart contract can represent terms in a contract in law and
create a legally enforceable obligation under the legislation of an
applicable jurisdiction.
Solution Point of The solution point of contact is the person within an organization
Contact (SPoC) who collaborates with the lead appraiser to plan and conduct the
appraisal. The solution point of contact receives the appraisal
findings from the appraisal team and is considered the customer of
the appraisal.
Transaction Finality The moment when it becomes impossible to revert or alter a
transaction that has been added to the blockchain.
Special thanks to the following people for their hard work, contributions, and inputs:
• Alejandro Mandujano
• Allyson R Ugarte
• Dino Cataldo Dell'Accio
• Frederic de Vaulx
• Gerard Dache
• Lori Souza
• Meiyappan Masilamani
• Paul F. Dowding
• Steve Henley