Every chapter in this guidebook ends with a "Maturity model" that describes how
a practice typically evolves. This appendix consolidates every chapter's
maturity model into one reference so you can assess a team, a domain, or a whole
organization at a glance.
All chapters describe the same progression. The exact wording varies slightly
between chapters, but the intent maps cleanly onto these five levels:
Level 1, Initiate. Ad hoc, reactive, and personality-driven. Practices
exist only where an individual chooses them, so outcomes depend on heroics and
luck.
Level 2, Develop. Basic practices exist, but they are inconsistent across
teams, partly manual, and often bypassed under pressure.
Level 3, Standardize. Practices are documented, standardized, and enforced
org-wide. This is the audit and compliance floor: the level most enterprise
and government work must reach to be dependable and auditable.
Level 4, Manage. Practices are measured and controlled with data and
metrics against baselines. You know quantitatively how each practice performs,
and you act on the numbers.
Level 5, Orchestrate. Practices are continuously improved, integrated
across the organization, and adaptive. The safe or correct path is the
default, and the organization learns and evolves deliberately.
For each chapter relevant to your context, read the five cells below and pick
the level that honestly describes your typical behaviour, not your best team
on its best day, and not your written policy, but what actually happens.
Score each chapter 1 to 5. Round down when in doubt; a practice that is
inconsistent is Level 2, not Level 3.
Average scores within a part to see where a whole domain stands, then look at
the spread: a part at "3 on average" that hides a Level 1 chapter still has a
Level 1 risk.
Re-assess periodically and track the trend. Movement matters more than any
single snapshot.
Higher maturity is not automatically better. The goal is fit: enough rigour to
manage the risk and scale you actually face, and no more. A small, low-stakes
tool does not need Level 5 chaos engineering. Reaching for a high level as a
trophy, rather than to solve a real problem, produces ceremony without value.
Read every "Level 5" below as "appropriate when the stakes justify it," and let
risk, scale, and regulatory exposure decide how far to climb.
Culture is accidental and personality-driven; incidents mean blame; knowledge lives in a few heads.
Some teams run postmortems and write docs, but practice is inconsistent and unreinforced by leadership.
Blameless learning, ownership models, and a writing culture are org-wide norms with clear expectations and tooling.
Culture health is measured (psychological-safety surveys, incident-learning rates, retention) and tracked against baselines and acted on.
Culture is continuously improved and practices spread between teams; leadership adapts norms as the organization grows and learns.
Team topologies
Teams form by accident or headcount; structure mirrors legacy hierarchy; dependencies everywhere.
Some stream-aligned teams exist, but shared bottlenecks and functional silos persist.
The four team types and explicit interaction modes are used deliberately; platforms and InnerSource cut dependencies.
Cognitive load, flow, and dependency counts are measured per team against targets; boundaries are adjusted when the numbers slip.
The organization continuously reshapes teams and interaction modes to sustain flow as products and platforms evolve.
Roles, career ladders, growth
No written ladder; promotions and pay are ad hoc and personality-driven.
A basic ladder exists but is applied inconsistently; no calibration; hiring is unstructured.
Dual tracks, a clear competency matrix, calibration, and structured hiring are standard.
Progression rates, pay equity, and time-in-level are measured against baselines; calibration outcomes are analysed for bias.
The framework evolves continuously with the work; sponsorship and apprenticeship are deliberate and org-wide as roles change.
Ways of working
Process is ad hoc or cargo-cult; communication is meeting-driven and undocumented; estimates are treated as promises.
A methodology is followed consistently, but ceremonies are rote and cross-team coordination is heavy.
Practices are chosen to fit context; async, docs-first communication is the norm; estimation informs, not controls.
Flow metrics (lead time, work in progress, throughput) are tracked against baselines and reviewed each cycle.
Teams continuously tune their way of working from those metrics; coordination need is minimized at the source and good practice spreads org-wide.
Decision-making and governance
Decisions are ad hoc and unrecorded; governance is absent or a blanket bottleneck; debt is invisible.
Some decisions are documented and some review exists, but process is inconsistent and mismatched to decision weight.
ADRs, a paved road, reversibility-based delegation, and a debt inventory are standard and transparent.
Decision cycle time, reversal rates, and debt levels are measured; scrutiny is calibrated by decision weight against those numbers.
Governance is continuously tuned across the organization; scrutiny targets irreversible decisions; debt and sourcing are managed as evolving portfolios.
Security metrics (threat-modelling coverage, finding-to-fix time, control adoption) are tracked against baselines.
Security is genuinely everyone's job; threat modelling is habitual; zero-trust is largely realized and the practice improves continuously org-wide.
Application security
Security depends on individual knowledge; no standard controls; secrets in code; stale deps; ad hoc auth.
OWASP Top 10 awareness; some framework protections; secrets manager unevenly used; occasional dependency scanning.
ASVS-based requirements per tier; parameterized queries; central identity with MFA; managed secrets; SBOMs and pipeline scanning.
Vulnerability density, mean time to remediate, and control coverage are measured against baselines across services.
Secure defaults ship in paved-road frameworks; short-lived credentials and full supply-chain assurance (SLSA) are verified continuously org-wide.
Infrastructure and cloud security
Manual provisioning; broad permissions and static keys; flat networks; inconsistent encryption; no posture management.
Some IAM roles and MFA; basic network tiers; encryption at rest for major stores; periodic manual reviews; partial IaC.
Least-privilege RBAC/ABAC with short-lived creds; default-deny segmentation; encryption by default with KMS; CSPM with policy.
Posture, drift, and policy-violation metrics are tracked against baselines; guardrail effectiveness is measured.
Secure defaults ship in landing zones and IaC; micro-segmentation and preventive guardrails evolve continuously and drift is auto-remediated org-wide.
Security operations
Security testing manual and rare; no central logging or SIEM; no incident plan; ad hoc patching; never adversarially tested.
Some scanners in the pipeline; central logging; a basic incident plan; loose patching timelines; annual pentest.
Full DevSecOps scanning with risk-based gates; SIEM with some SOAR; rehearsed IR with tabletops; remediation SLAs; red teaming.
MTTD and MTTR are measured against baselines; detection coverage is mapped to adversary techniques and tracked.
Testing and response are highly automated; purple teaming and detection engineering improve continuously and adapt to new threats org-wide.
Privacy and data protection
Personal data collected freely; no inventory, minimization, or retention; consent an afterthought; no rights process.
A privacy policy and basic consent exist; some retention awareness; rights requests handled manually and slowly.
Privacy by design with DPIAs; data mapped and classified; retention enforced; lawful basis documented; rights met on deadline.
Privacy posture is measured: data-inventory coverage, retention compliance, and rights-request turnaround against baselines.
Privacy is a default engineering constraint; minimization and automated retention are standard; rights requests are self-service and the practice adapts org-wide.
Compliance and governance
Compliance is reactive; no control framework; evidence assembled manually under deadline; frequent findings.
Key frameworks identified; some documented controls; audits pass with heavy manual effort; accessibility considered late.
A unified control framework cross-maps standards; evidence partly automated; accessibility tested; records and authorizations established.
Control effectiveness and evidence coverage are measured continuously against baselines; findings are trended.
Compliance is continuous with always-on evidence and compliance-as-code; new certifications are low-cost and the framework adapts org-wide, audit-ready at any moment.
No dedicated UX practice; decisions by opinion; research ad hoc; inconsistent flows and terminology.
Some designers and occasional usability testing; personas unmaintained; UX is a phase, often bypassed.
Continuous mixed-method research feeds prioritization; shared personas, journey maps, and IA; UX quality gates in the DoD.
UX metrics (task success, satisfaction, usability scores) are tracked against baselines alongside business metrics.
Research is continuous and outcome-linked; controlled experiments close the loop and insights spread across teams as products evolve.
UI design and design systems
Each team builds its own UI; no shared components; inconsistent look; hard-coded colours and spacing.
A partial style guide or component library exists but is optional and often out of sync between design and code.
A tokenized design system with a maintained coded library, docs, and governance is used across teams; a11y built in.
Design-code parity, component adoption, and drift are measured against baselines; versioning is tracked.
The system is a governed product with a roadmap; it improves continuously org-wide and rebrands become token changes.
Accessibility
No accessibility practice; issues found via complaint or lawsuit; non-semantic, untested markup.
Awareness exists; some automated scanning and a pre-launch audit; a11y is a late checklist, often deprioritized.
WCAG 2.2 AA is the standard; a11y built into the design system, tested, and in the DoD; teams trained with an owner.
Accessibility conformance is measured in CI against WCAG baselines; defect rates and audit results are tracked.
Accessibility is continuous; disabled people are involved in research; it is embedded in procurement, tokens, and CI and improves org-wide.
Content and communication design
No content practice; words written ad hoc; inconsistent terminology and tone; unhelpful errors and empty states.
A style guide may exist; some plain-language awareness; content is still late-stage and per-team with little reuse.
A content strategy, voice-and-tone guide, and glossary used across teams; plain language standard; shared patterns.
Content is measured against outcomes (comprehension, task completion, error rates) versus baselines.
Content is continuously improved from that evidence; dark patterns are prohibited and audited; patterns are localized and accessible by default org-wide.
Internationalization and localization
Single language; hard-coded strings; non-Unicode assumptions; new locales require code changes.
Strings externalized and Unicode used, but localization is a manual pre-launch batch; formatting and plurals inconsistent.
Shared i18n architecture and locale-aware formatting; a TMS and continuous pipeline; pseudo-localization and multi-locale CI.
Localization coverage, string freshness, and locale-defect rates are measured against baselines.
i18n is enforced by tooling and lint across teams; localization is continuous, cultural adaptation is systematic, and new locales launch fast.
Frontend engineering
Ad hoc per-team frontend; heavy client code; no budgets; tested only on team devices; framework by hype.
Some shared tooling and a component library; performance measured occasionally, not budgeted; limited cross-device testing.
Framework and rendering chosen deliberately per surface; budgets enforced in CI with RUM; progressive enhancement standard.
Performance, resilience, and reach are measured against real-user baselines and budgets; regressions fail the build.
Those signals are tied to outcomes and continuously improved across surfaces as the frontend and its users evolve.
Utilization, cost per outcome, and latency are measured against baselines; budgets and quotas are enforced.
Routing and scaling are automated, LLMOps observability is full, and utilization and cost are continuously optimized with portability maintained org-wide.
Data undocumented and unowned; conflicting definitions; quality found when reports break; no catalogue or lineage.
Some datasets have owners and docs; a partial catalogue; manual, reactive quality checks; policy written but weakly enforced.
Critical data products have owners, contracts, SLAs; catalogue with automated lineage; continuous quality; federated governance.
Data quality, contract compliance, and freshness are measured against SLAs and baselines.
Data-as-product is the norm; contracts are enforced automatically, self-service guardrails adapt, and definitions are trusted enterprise-wide.
Data engineering
Ad hoc scripts, manual runs, no tests or monitoring; failures found by consumers; costs unmanaged.
Some orchestration and scheduling; basic transformations in version control; occasional tests; reactive firefighting.
ELT with layered, tested, versioned models; orchestrated dependencies with retries/backfills; observability; costs tracked.
Pipeline reliability, freshness, and cost are measured against SLAs; anomalies are detected against baselines.
Pipelines are software with CI/CD, contracts, and testing; the platform improves continuously and new data products ship fast org-wide.
Analytics and business intelligence
Reports built ad hoc in spreadsheets; inconsistent metrics; misleading charts; no governance.
A BI tool with some shared dashboards; metric definitions still diverge; uncontrolled self-service and sprawl begins.
A semantic layer defines core metrics once; certified vs experimental content; self-service within guardrails; managed lifecycle.
Metric usage, freshness, and definition changes are tracked against baselines; certified content is monitored.
Metrics are governed like APIs with owners and changelogs; analytics spans descriptive to prescriptive and embeds at decision points across the organization.
Product analytics and experimentation
Little/inconsistent instrumentation; decisions by opinion; no experiments; vanity metrics; careless consent.
Some events tracked but taxonomy inconsistent; occasional A/B tests without power analysis; north star proposed, not embedded.
A governed, validated tracking plan; funnels/cohorts/retention routine; experiments on a shared platform; consent handled properly.
Experiment volume, power, and win rates are measured against baselines; instrumentation coverage is tracked.
Experimentation is the default; a shared results repository and owned instrumentation let the organization learn cumulatively and adapt.
Decision science and data culture
Decisions by hierarchy and intuition; correlation treated as causation; uncertainty ignored; metrics surveil and are gamed.
Data consulted selectively to justify decisions; some awareness of causal traps; uncertainty rarely communicated.
Analyses tied to decisions with predefined criteria; correlation vs causation distinguished; uncertainty communicated; outcome focus.
Decision quality and forecast calibration are tracked against outcomes and baselines.
"What would change our mind?" is routine; causal rigour and honest uncertainty are norms and leaders update visibly on evidence org-wide.
Some infrastructure scripted, but practices vary; inconsistent state; common drift; policy enforced by manual review.
Declarative IaC standard from shared versioned modules with remote state; policy-as-code guardrails; regular drift detection.
Drift, provisioning time, and policy-violation rates are measured against baselines; compliance evidence is automatic.
Infrastructure is immutable, GitOps-driven, and self-healing; the module and policy library improves continuously and adapts org-wide.
Containers, orchestration, cloud-native
Containers used ad hoc; hand-built unscanned images; manual deploy; no shared platform or isolation model.
Teams containerize and use an orchestrator, but practices vary; inconsistent scanning and limits; ungoverned cost and tenancy.
A standardized platform with hardened images, signing/scanning gates, namespace tenancy with quotas and network policy, cost allocation.
Utilization, density, and cost per workload are measured against baselines; FinOps optimization is data-driven.
A self-service, self-healing platform with strong multi-tenancy stays portable and hybrid/sovereign-ready and improves continuously org-wide.
Platform engineering and DevEx
No platform; each team assembles its own tooling inconsistently; ticket-driven handoffs; high cognitive load.
Some shared tools and templates, but fragmented and partly manual; limited self-service; DevEx unmeasured.
A platform team runs golden paths, self-service provisioning, a developer portal, and scorecards; guardrails in paved roads; DevEx measured.
Adoption, DevEx scores, and cognitive-load signals are measured against baselines and reviewed.
A mature platform product improves continuously from that feedback; voluntary adoption is high and governance stays invisible in the workflow org-wide.
Test and process automation
Testing and ops largely manual; inconsistent coverage; procedures in heads or stale docs; compliance evidence by hand.
Automated tests exist but slow/flaky and run inconsistently; some operational scripts; manual remediation; periodic-review governance.
Fast, parallel, reliable test infra; codified runbooks; ChatOps; auto-generated compliance evidence; governance as automated checks.
Automation coverage, false-positive rates, and remediation times are measured against baselines.
Routine incidents are auto-remediated with safeguards; compliance is continuous and audit-ready and humans focus on judgement org-wide.
Part 9. Operations, Reliability, and Observability¶
Topic
Level 1 Initiate
Level 2 Develop
Level 3 Standardize
Level 4 Manage
Level 5 Orchestrate
Site reliability engineering
Operations manual and reactive; no SLOs; reliability is opinion; the same incidents recur; firefighting dominates.
Key services have basic SLIs/SLOs; some monitoring and alerting; toil acknowledged but unmeasured; inconsistent postmortems.
Error budgets influence prioritization; toil measured and capped; routine capacity planning; funded automation; PRR and engagement model.
Error budgets, toil, and SLO attainment are measured against baselines and drive prioritization.
Error-budget policy is automated and respected; self-service ops and proactive capacity let the organization trade velocity and stability on data and adapt.
Observability and monitoring
Basic uptime checks and unstructured logs per machine; debugging means SSH; noisy, ignored alerts.
Centralized metrics and log aggregation; some dashboards and threshold alerts; partial/absent traces; manual correlation.
Alert quality, MTTD, and telemetry cost are measured against baselines; burn-rate alerting is tuned to SLOs.
High-cardinality, event-rich observability supports ad hoc investigation; retention is cost-optimized and telemetry informs decisions across the organization.
Incident management
Incidents handled ad hoc by whoever notices; no roles, severities, or postmortems; informal on-call; failures recur.
Basic on-call rotations and severities; some postmortems, but unclear roles and inconsistently tracked corrective actions.
A formal incident command system with clear roles and criteria; blameless postmortems standard; actions tracked; on-call compensated.
Incident frequency, MTTR, and on-call load are measured against baselines; recurring causes are trended.
Response is rehearsed via game days; on-call stays sustainable and quiet and aggregate analysis drives structural investment as the organization learns.
Cost, sustainability, green software
Cloud costs are a monthly surprise; no tagging, allocation, or carbon awareness; generous, unrevisited provisioning.
Basic cost visibility and tagging; some reactive rightsizing and idle cleanup; sustainability acknowledged but unmeasured.
A FinOps practice with attribution, budgets, forecasts, anomaly alerts, commitments, rightsizing; carbon measured for major services.
Cost and carbon are measured per team against budgets and baselines; anomalies are flagged.
Cost and carbon are continuous team-owned signals; efficient defaults, automated optimization, and carbon-aware scheduling improve continuously org-wide.
Priorities set ad hoc by whoever asks loudest; no portfolio view; dependencies surface as crises; annual funding scrambles.
A periodically reviewed portfolio inventory; published objectives weakly linked to work; a dependency register; project-based budgeting.
Strategy cascades via OKRs; a consistent prioritization framework; cross-team planning manages dependencies; persistent team funding.
Portfolio outcomes, delivery predictability, and dependency counts are measured against baselines.
The portfolio is continuously rebalanced on outcome evidence; dependencies are designed away and funding cadence matches learning cadence org-wide.
Risk, audit, and assurance
Risk handled reactively after incidents; no framework or register; undocumented controls; painful manual audits.
Risk registers for major systems; a control framework adopted, audits pass but manual and point-in-time; suppliers assessed at onboarding.
Three-lines model and common framework org-wide; many controls automated; continuous monitoring; supplier/SBOM inventories; scheduled DR.
Control effectiveness, open-risk counts, and audit findings are measured against risk appetite and baselines.
Assurance is continuous and largely automated; auditors sample live evidence and supply-chain integrity is verified as risks evolve org-wide.
Procurement, open source, licensing
Open source added freely; no policy or inventory; licences unexamined; end-of-life found by accident; no owner.
A basic policy and approved-licence list; some manual/late scanning; an inventory for major systems; ad hoc contribution.
An OSPO owns strategy and tooling; automated licence/vuln scanning and attribution; SBOMs; clear contribution; EOL tracked.
Licence compliance, dependency currency, and vulnerability exposure are measured against baselines.
Open source is a managed strategic asset with fully automated compliance; upstream investment is deliberate and currency and EOL are managed continuously org-wide.
Sustaining large and long-lived systems
Systems depend on heroes; ownership by memory; undocumented knowledge; systems frozen until they break; retirements never finish.
Ownership assigned and recorded for major systems; some docs and runbooks; obvious critical functions have a backup person; reactive maintenance.
Team-level ownership in a catalogue surviving reorgs; bus factor measured and mitigated; decision records and runbooks; incremental modernization.
Bus factor, ownership coverage, and knowledge-transfer progress are measured against baselines.
Stewardship is a funded discipline; no critical system is a single point of human failure and knowledge transfer and planned endings continue org-wide.
Ethics, accountability, public interest
Ethics unaddressed or reactive after scandal; accessibility ignored; opaque automated decisions with no recourse; bias untested.
A code of conduct and some (late) accessibility; high-profile automated decisions get some oversight; occasional bias checks.
Ethical review is part of the process; accessibility designed in and user-tested; consequential decisions carry explanation and recourse.
Equity, accessibility, and algorithmic-accountability outcomes are monitored against baselines.
Responsibility is embedded in how the organization builds; equity is a non-negotiable default and algorithmic accountability is standard and continuously improved org-wide.
Do not try to raise everything at once, and do not chase the highest average.
Prioritize by risk-weighted maturity gap: attack the domains where a low
level meets high consequence.
First: the lowest-maturity chapters in your highest-risk domains. For most
organizations that means security, privacy, reliability, compliance, and any
system whose failure harms people or violates law. A Level 1 here is urgent.
Next: foundational enablers (culture, ways of working, CI/CD, IaC,
observability) that raise the ceiling for every other domain. Improving these
makes later gains cheaper.
Later: domains that are already at Level 3 and could climb to Level 4 or 5.
Only push beyond the floor where the stakes and scale justify the added investment.
Enterprise and government contexts usually cannot stop at "it works." To pass
audits, sustain authorizations, and meet regulatory and public-accountability
obligations, most domains must reach at least Level 3 (Standardize), the level
where practices are standardized, documented, enforced across teams, and produce
evidence. Level 2 typically fails audit because it is inconsistent and
manually assembled under deadline; Level 1 fails outright.
Read Level 3 as the floor for anything auditable or safety-relevant, and the
higher levels (4 and 5) as targets only where continuous assurance, scale, or
public trust make the extra rigour worth it. Maturity remains a means: the aim
is a defensible, proportionate level of control for the risk you actually carry,
not a perfect score.