# Generic Assessment Factors — DevSecOps / SRE / Platform / MLOps

Vendor-neutral factor model for assessing an organisation or workload across 18 domains.
Every domain has its own table whose factor weights sum to **100 points**. Domains are then
combined into one composite score using the domain weights in §1.

---

## 1. Scoring model

### 1.1 Maturity scale (applied to every factor)

| Level | Name | Meaning |
|---|---|---|
| 0 | Absent | Not done, or ad hoc with no owner and no evidence |
| 1 | Initial | Done manually / partially; tribal knowledge; inconsistent |
| 2 | Defined | Documented standard exists and is followed for most critical systems |
| 3 | Managed | Automated and measured; coverage > 80 %; KPIs reviewed |
| 4 | Optimised | Fully automated, continuously improved, coverage ≈ 100 %, evidence on demand |

### 1.2 Formulas

- **Factor score** = `weight × (level ÷ 4)`
- **Domain score (0–100)** = Σ factor scores in the domain
- **Composite score (0–100)** = Σ (domain score × domain weight ÷ 100)
- **Gate rule**: any factor tagged **G** (gate) scoring Level < 2 caps the domain at 59 ("Developing") regardless of points.

### 1.3 Criticality tags

| Tag | Meaning |
|---|---|
| G | Gate — minimum Level 2 required; failure caps the domain rating |
| H | High — major contributor to risk or reliability |
| M | Medium — maturity / efficiency factor |

### 1.4 Rating bands

| Score | Band | Interpretation |
|---|---|---|
| 0–39 | At Risk | Fundamental gaps; remediation program needed |
| 40–59 | Developing | Basics exist, inconsistent; prioritised backlog |
| 60–79 | Managed | Solid, measured; targeted optimisation |
| 80–100 | Optimised | Industry-leading; focus on sustaining |

### 1.5 Domain weights (composite)

| # | Domain | Code | Weight | Factors |
|---|---|---|---|---|
| 1 | DevOps & Infrastructure as Code | DO | 7 | 10 |
| 2 | CI/CD | CI | 7 | 11 |
| 3 | SecDev / Application Security (Shift-Left) | SD | 7 | 11 |
| 4 | SecOps (Detection, Response, Cloud Security) | SO | 8 | 11 |
| 5 | Cloud Architecture | CA | 7 | 12 |
| 6 | Platform Engineering | PE | 5 | 9 |
| 7 | SRE & Reliability | SR | 8 | 11 |
| 8 | Observability & Metrics | OB | 6 | 11 |
| 9 | FinOps | FO | 5 | 11 |
| 10 | Data Protection & Privacy | DP | 7 | 11 |
| 11 | Disaster Recovery & Business Continuity | DR | 7 | 10 |
| 12 | Identity & Access Management | IA | 5 | 10 |
| 13 | Governance, Risk & Compliance | GR | 4 | 10 |
| 14 | MLOps / LLMOps | ML | 3 | 11 |
| 15 | Git & Source Control Strategy | GS | 3 | 11 |
| 16 | Testing Strategy | TS | 4 | 12 |
| 17 | Kubernetes | K8 | 4 | 13 |
| 18 | Database & Data Operations | DB | 3 | 11 |
| | **Total** | | **100** | **196** |

> Adjust domain weights per engagement (e.g. fintech → raise SO/DP/GR; ML product → raise ML; K8s-centric platform → raise K8/PE). Keep the sum at 100.
>
> Overlap rule: a few factors in DO/PE/SR deliberately summarise a topic that has its own detailed domain (e.g. DO-06 ↔ GS, DO-07 ↔ TS, PE-04 ↔ K8, SR-08 ↔ TS-12). Score the summary factor from the detailed domain's result, or drop the summary factor and redistribute its weight when the detailed domain is in scope.

---

## 2. DevOps & Infrastructure as Code (DO) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| DO-01 | Version control for everything | App code, IaC, config, pipelines, dashboards, policies all in Git with protected branches | 12 | % of assets under VCS; branch protection enabled | G |
| DO-02 | Infrastructure as Code coverage | ≥ 95 % of cloud resources created/changed only via IaC (Terraform/Pulumi/CFN/Bicep); no console changes | 14 | % resources IaC-managed; console-change alerts | G |
| DO-03 | Environment parity & ephemeral envs | Dev/stage/prod built from same modules; per-PR ephemeral environments; drift < 1 % | 10 | Drift report; time to spin up env | H |
| DO-04 | Configuration & secrets externalised | 12-factor config; no secrets/env-specific values in code or images | 10 | Secret-scan findings = 0; config stored in vault/param store | G |
| DO-05 | Immutable artefacts & container standards | Approved base images, semantic tags/digests, SBOM generated, no `latest` in prod | 10 | % images from golden base; SBOM coverage | H |
| DO-06 | Branching strategy & code review (summary → §GS) | Trunk-based or short-lived branches; mandatory review; CODEOWNERS | 8 | Median branch age; % PRs reviewed | M |
| DO-07 | Automated testing culture (summary → §TS) | Unit + integration + contract tests run on every change; coverage threshold enforced | 10 | Coverage %; test pass rate; flaky-test ratio | H |
| DO-08 | Drift detection & reconciliation | GitOps (Argo/Flux) or scheduled plan; auto-reconcile or alert within minutes | 8 | Drift events/month; reconcile time | H |
| DO-09 | Toolchain standardisation & docs | Standard toolchain, README/runbook per repo, ADRs for key decisions | 6 | % repos with runbook/ADR | M |
| DO-10 | DORA metrics tracked | Deploy frequency, lead time, change-failure rate, MTTR measured automatically and reviewed | 12 | DORA dashboard; trend quarterly | H |
| | **Total** | | **100** | | |

---

## 3. CI/CD (CI) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| CI-01 | Pipeline as code | Pipelines versioned with the app, reusable templates/shared libraries, no click-ops pipelines | 10 | % pipelines in VCS; template reuse | G |
| CI-02 | Build reproducibility & caching | Hermetic builds, pinned dependencies/lockfiles, dependency & layer caching | 8 | Rebuild produces identical digest; cache hit rate | M |
| CI-03 | Automated quality gates | Lint, unit tests, coverage threshold, static analysis block merge | 10 | Gate pass rate; coverage trend | H |
| CI-04 | Security gates in pipeline | SAST, SCA, secret scan, IaC scan, image scan with severity thresholds that fail the build | 12 | % pipelines with all 5 scans; blocked builds | G |
| CI-05 | Artefact management & provenance | Private registry, immutable tags, signed artefacts (cosign/Sigstore), SLSA ≥ L2 provenance | 10 | % artefacts signed; SLSA level | H |
| CI-06 | Progressive delivery | Canary / blue-green / feature flags with automated analysis for prod changes | 12 | % prod deploys progressive; auto-abort count | H |
| CI-07 | Automated rollback & verification | Post-deploy health checks; one-click or automatic rollback < 5 min | 10 | Rollback MTTR; % deploys with smoke tests | H |
| CI-08 | Environment promotion & approvals | Same artefact promoted dev→stage→prod; prod approval with separation of duties; audit trail | 8 | Promotion audit log; SoD enforced | H |
| CI-09 | Pipeline performance | p50 pipeline < 10 min; flakiness < 2 %; queue time monitored | 6 | Pipeline duration; flaky rate; queue time | M |
| CI-10 | Deployment frequency & lead time | On-demand deploys; lead time for change < 1 day (elite DORA) | 8 | Deploys/day; lead time | H |
| CI-11 | Runner / pipeline security | Ephemeral isolated runners, OIDC federation to cloud (no static keys), least-privilege tokens, pinned actions | 6 | Static creds in CI = 0; runner isolation | H |
| | **Total** | | **100** | | |

---

## 4. SecDev / Application Security — Shift-Left (SD) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| SD-01 | Threat modelling | STRIDE/PASTA performed for new services & major changes; findings tracked to closure | 10 | % services with threat model < 12 months old | H |
| SD-02 | Secure coding standards & training | OWASP-aligned standards, language guidelines, annual secure-coding training | 8 | Training completion %; standards adoption | M |
| SD-03 | SAST coverage & triage | SAST on every PR; findings triaged within SLA; false-positive tuning | 10 | % repos covered; open critical SAST findings | H |
| SD-04 | SCA / dependency & licence management | SBOM per build; vulnerable & disallowed-licence dependencies blocked; automated upgrade PRs | 12 | Critical CVEs in deps; SBOM coverage | G |
| SD-05 | Secrets detection & prevention | Pre-commit hooks + pipeline scan + repo history scan; leaked secret rotated < 1 h | 10 | Leaked secrets/quarter; time to rotate | G |
| SD-06 | Container & IaC security scanning | Image CVE + misconfiguration scans (Trivy/Checkov/etc.) block on critical; admission control in cluster | 10 | % images scanned; critical CVEs in prod images | H |
| SD-07 | DAST / API security testing | Authenticated DAST + API schema/fuzz testing in stage per release | 8 | DAST coverage; API endpoints tested % | M |
| SD-08 | Supply-chain integrity | Signed commits & artefacts, verified provenance, pinned third-party actions/charts, dependency allow-list | 10 | % verified artefacts; unpinned deps = 0 | H |
| SD-09 | Vulnerability remediation SLAs | Critical ≤ 7 d, High ≤ 30 d, Medium ≤ 90 d; measured and escalated | 12 | % within SLA; mean time to remediate | G |
| SD-10 | Security champions & PR security review | Named champion per team; security-impact label triggers review | 5 | Champions per team; security reviews/quarter | M |
| SD-11 | Penetration testing & bug bounty | Annual external pentest for internet-facing + after major change; bounty/VDP program | 5 | Last pentest date; open findings | M |
| | **Total** | | **100** | | |

---

## 5. SecOps — Detection, Response & Cloud Security (SO) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| SO-01 | Centralised logging & SIEM coverage | Cloud audit, IdP, network, endpoint, app security logs in SIEM; ≥ 95 % of critical sources | 12 | Source coverage %; log ingestion gaps | G |
| SO-02 | Detection engineering | Use-cases mapped to MITRE ATT&CK; rules tested, tuned, versioned (detection-as-code) | 10 | ATT&CK coverage %; false-positive rate | H |
| SO-03 | Incident response plan & exercises | IR plan, severity matrix, playbooks, roles; tabletop ≥ 2×/year; lessons learned | 12 | Last exercise date; playbook coverage | G |
| SO-04 | Cloud Security Posture Management | CSPM against CIS benchmarks; critical misconfigs auto-remediated or fixed < 24 h | 10 | CIS compliance %; open critical findings | H |
| SO-05 | Workload runtime protection | EDR on servers/endpoints; container runtime security (Falco/CWPP); alerts integrated | 8 | % workloads covered | H |
| SO-06 | Network security & zero trust | Segmentation, private endpoints, WAF, DDoS protection, egress filtering, identity-aware access | 10 | Public exposure count; egress-deny coverage | H |
| SO-07 | Vulnerability & patch management | Authenticated scanning of hosts/images; patch SLAs; EOL software tracked | 10 | Patch SLA compliance; EOL assets | G |
| SO-08 | Privileged access monitoring & audit trails | Immutable, centrally stored audit logs; alerts on privileged/anomalous actions | 8 | Audit log immutability; privileged alerts | H |
| SO-09 | Threat intel & attack-surface management | External ASM scanning; TI feeds enriched into detections | 5 | Unknown exposed assets; TI integration | M |
| SO-10 | Security MTTD / MTTR tracked | Detection and containment times measured per severity and reviewed | 8 | MTTD, MTTR by severity | H |
| SO-11 | Security automation (SOAR) | Enrichment, containment, and common remediations automated | 7 | % alerts auto-triaged; auto-remediations | M |
| | **Total** | | **100** | | |

---

## 6. Cloud Architecture (CA) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| CA-01 | Well-Architected review & ADRs | Formal review (AWS WAF / Azure / GCP framework) per critical workload yearly; ADRs maintained | 10 | Review date; open high-risk items | H |
| CA-02 | Landing zone & account/project structure | Org hierarchy, separate accounts/projects per env & workload, guardrails (SCP/Org policy), central logging | 12 | Landing zone compliance; accounts per env | G |
| CA-03 | Network design | Hub-spoke/segmented VPCs, private service access, DNS strategy, no public DBs, IPAM | 10 | Public endpoints count; network diagram current | H |
| CA-04 | High-availability design | Multi-AZ, stateless tiers, health checks, no single points of failure for Tier-1 | 12 | SPOF count; availability achieved vs target | G |
| CA-05 | Scalability & elasticity | Horizontal autoscaling, load tests at 2× peak, limits/quotas validated | 10 | Load test results; scaling events | H |
| CA-06 | Managed vs self-hosted discipline | Documented decision criteria; managed services preferred unless justified | 6 | % managed services; justification records | M |
| CA-07 | Multi-region / portability strategy | Explicit stance on multi-region & lock-in; abstraction where it matters | 6 | Strategy doc; region failover tested | M |
| CA-08 | Data architecture | Correct store per workload (OLTP/OLAP/cache/object), tiering, connection pooling, read replicas | 8 | DB performance SLOs; cache hit rate | H |
| CA-09 | API & integration architecture | API gateway, versioning, rate limiting, async messaging/event-driven where fit, idempotency | 8 | API standards doc; gateway coverage | M |
| CA-10 | Tagging / labelling & naming standards | Mandatory tags (owner, env, cost-centre, data-class) enforced by policy | 6 | Tag compliance % | H |
| CA-11 | Architecture documentation current | C4/system context, data-flow diagrams, dependency maps refreshed each release | 6 | Doc freshness (days) | M |
| CA-12 | Quotas, limits & capacity planning | Service quotas monitored; capacity forecast quarterly | 6 | Quota utilisation alerts; forecast accuracy | M |
| | **Total** | | **100** | | |

---

## 7. Platform Engineering (PE) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| PE-01 | Internal developer platform / portal | Service catalog & portal (e.g. Backstage) with ownership, docs, scorecards | 12 | % services in catalog; portal MAU | H |
| PE-02 | Golden paths & templates | Scaffold new service with CI/CD, observability, security baked in < 1 h | 14 | % new services via template; time to first deploy | H |
| PE-03 | Self-service provisioning with guardrails | Devs request infra via code/portal; policy-checked; no ticket queue | 14 | Provisioning lead time; tickets to platform team | G |
| PE-04 | Kubernetes / runtime standards (summary → §K8) | Namespace model, RBAC, network policies, resource quotas, PDBs, pod security standards | 12 | Policy compliance %; clusters conformant | G |
| PE-05 | Service ownership & metadata | Every service has owner, tier, on-call, runbook, SLO recorded | 10 | % services with complete metadata | H |
| PE-06 | Platform as a product | Roadmap, user research, adoption metrics, SLAs for platform itself | 10 | Adoption %; satisfaction (NPS) | M |
| PE-07 | Developer experience metrics | Onboarding time, build/test time, inner-loop latency, DevEx survey tracked | 8 | Onboarding days; survey score | M |
| PE-08 | Platform reliability & lifecycle | Cluster/runtime upgrades N-1, EOL tracking, platform SLO met | 10 | Version skew; platform availability | H |
| PE-09 | Policy as code & admission control | OPA/Kyverno/Sentinel rules enforce security & cost policies at admission/plan time | 10 | Policies enforced; violations blocked | H |
| | **Total** | | **100** | | |

---

## 8. SRE & Reliability (SR) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| SR-01 | SLIs / SLOs defined | Availability & latency SLOs for all Tier-1/2 services, agreed with business, published | 14 | % services with SLO; SLO attainment | G |
| SR-02 | Error budgets & policy | Burn-rate alerts; budget exhaustion triggers feature freeze/reliability work | 10 | Error budget remaining; policy invocations | H |
| SR-03 | On-call structure & escalation | Sustainable rotations, documented escalation, alert routing, compensation; pages/shift tracked | 10 | Pages per shift; escalation time | G |
| SR-04 | Incident management process | Severity definitions, incident commander, status page, stakeholder comms, timeline tooling | 12 | MTTA/MTTR; incident count by severity | G |
| SR-05 | Blameless postmortems | Postmortem for Sev1/2 within 5 days; action items tracked to completion | 10 | % postmortems done; action-item closure | H |
| SR-06 | Toil measurement & reduction | Toil tracked; < 50 % of SRE time; automation backlog prioritised | 8 | Toil %; automation delivered | M |
| SR-07 | Capacity & performance testing | Load/stress/soak tests per release for critical paths; capacity model | 8 | Headroom %; test cadence | H |
| SR-08 | Chaos engineering / resilience testing | Fault injection (AZ loss, dependency failure, latency) in stage & controlled prod | 6 | Experiments/quarter; findings closed | M |
| SR-09 | Change management & release risk | Change failure rate tracked; risk-based approvals; freeze windows rational | 8 | CFR %; change-related incidents | H |
| SR-10 | Failure-mode design | Timeouts, retries with backoff, circuit breakers, bulkheads, graceful degradation, idempotency | 8 | Dependency failure tests; cascading incidents | H |
| SR-11 | Runbooks & auto-remediation | Runbook linked from every alert; common remediations automated | 6 | % alerts with runbook; auto-remediated % | M |
| | **Total** | | **100** | | |

---

## 9. Observability & Metrics (OB) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| OB-01 | Metrics coverage (golden signals) | RED/USE metrics for every service & infra layer; SLIs derived from them | 14 | % services instrumented; metric gaps | G |
| OB-02 | Structured centralised logging | JSON logs, correlation IDs, central store, retention policy, PII redaction | 12 | % services structured; retention compliance | G |
| OB-03 | Distributed tracing | OpenTelemetry traces across services with context propagation; sampling strategy | 10 | Trace coverage %; p99 investigation time | H |
| OB-04 | Alerting quality | Symptom/SLO-based alerts, actionable, routed; noise reviewed monthly | 12 | Alerts/week; actionable %; alert fatigue survey | G |
| OB-05 | Dashboards | Per-service standard dashboard + exec/business view; dashboards as code | 8 | Dashboard coverage; usage | M |
| OB-06 | Synthetic & real-user monitoring | Synthetic checks for critical journeys; RUM for web/mobile | 8 | Journey coverage; RUM Core Web Vitals | H |
| OB-07 | Observability standards | OTel semantic conventions, label/naming rules, cardinality limits | 8 | Standards doc; cardinality incidents | M |
| OB-08 | Business KPIs correlated | Business metrics (orders, sign-ups, revenue/min) alongside technical signals | 8 | Business metrics on dashboards | M |
| OB-09 | Observability cost & data governance | Sampling, tiered retention, cost per GB tracked, telemetry budget | 6 | Observability spend %; retention tiers | M |
| OB-10 | Operational metrics reporting | DORA + MTTD/MTTR/availability reported monthly to leadership | 8 | Report cadence; trend improvement | H |
| OB-11 | Security telemetry integrated | Audit & security events in same observability/SIEM pipeline with correlation | 6 | Security source coverage | M |
| | **Total** | | **100** | | |

---

## 10. FinOps (FO) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| FO-01 | Cost visibility & allocation | ≥ 95 % spend allocated via tags/labels/accounts; showback or chargeback to teams | 14 | Allocation %; unallocated spend | G |
| FO-02 | Budgets, forecasts & anomaly alerts | Budgets per team/product; forecast ±5 %; anomaly alerts within 24 h | 12 | Forecast variance; anomalies caught | H |
| FO-03 | Rightsizing & idle elimination | Automated recommendations acted on; idle/orphaned resources removed weekly | 12 | Waste %; rightsizing savings realised | H |
| FO-04 | Commitment discounts | RI/Savings Plan/CUD coverage ≥ 70 % of steady state; utilisation ≥ 95 % | 10 | Coverage %; utilisation % | H |
| FO-05 | Unit economics | Cost per transaction/customer/tenant/request tracked and trending | 10 | Unit cost trend | H |
| FO-06 | Autoscaling, scheduling & spot | Scale-to-demand, off-hours shutdown for non-prod, spot/preemptible for fault-tolerant work | 10 | Non-prod off-hours %; spot % | M |
| FO-07 | Storage & data-transfer optimisation | Lifecycle policies, tiering, snapshot cleanup, egress/NAT/cross-AZ costs reviewed | 8 | Storage cost/GB trend; egress spend | M |
| FO-08 | FinOps governance & accountability | FinOps cadence (weekly/monthly), owners, KPIs, engineering accountable for cost | 10 | Meeting cadence; KPI reviews | H |
| FO-09 | Cost in design & CI | Cost estimate in architecture reviews; cost diff in IaC PRs (e.g. Infracost) | 6 | % IaC PRs with cost estimate | M |
| FO-10 | Licensing & SaaS spend | Third-party/SaaS/licence inventory, utilisation and renewals managed | 4 | Unused licences %; renewal calendar | M |
| FO-11 | Sustainability reporting | Carbon footprint tracked; region/efficiency choices consider emissions | 4 | Carbon metric reported | M |
| | **Total** | | **100** | | |

---

## 11. Data Protection & Privacy (DP) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| DP-01 | Data classification & inventory | Classification scheme; data map with owners, location, sensitivity; automated discovery | 12 | % data stores classified | G |
| DP-02 | Encryption at rest | All storage encrypted; customer-managed keys for sensitive data; key rotation & separation of duties | 12 | % encrypted; CMEK coverage; rotation age | G |
| DP-03 | Encryption in transit | TLS 1.2+ everywhere, mTLS for service-to-service, automated certificate lifecycle | 10 | Plaintext endpoints = 0; cert expiry incidents | G |
| DP-04 | Secrets management | Central vault/secret manager, dynamic/short-lived credentials, rotation, access audited | 12 | Secrets in vault %; rotation age; static creds | G |
| DP-05 | Access control to data | Least privilege to data stores, row/column-level security, IAM DB auth, approval for prod data access | 10 | Prod data access grants; review cadence | H |
| DP-06 | Retention, deletion & minimisation | Retention schedule per class; automated deletion; data minimisation in design | 8 | Over-retained data; deletion jobs | H |
| DP-07 | Masking / anonymisation in non-prod | No real PII in dev/test; synthetic or masked datasets | 8 | PII in non-prod = 0 | H |
| DP-08 | DLP & exfiltration controls | DLP on egress channels; object-store public-access blocks; anomaly detection on bulk reads | 6 | DLP incidents; public buckets = 0 | M |
| DP-09 | Privacy compliance | GDPR / PDPL / local regulation mapped; DSAR process; consent & purpose records; DPIAs | 8 | DSAR SLA; DPIA coverage | H |
| DP-10 | Database security | Hardened configs, private endpoints only, audit logging, automated backups verified | 8 | Public DBs = 0; audit-log coverage | H |
| DP-11 | Data residency & sovereignty | Regional constraints enforced by policy; cross-border transfers documented | 6 | Residency policy violations | M |
| | **Total** | | **100** | | |

---

## 12. Disaster Recovery & Business Continuity (DR) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| DR-01 | BIA & RTO/RPO per tier | Business impact analysis done; RTO/RPO defined and agreed per service tier | 14 | % services with RTO/RPO; tier catalog | G |
| DR-02 | Backup coverage, encryption & immutability | All stateful systems backed up (3-2-1), encrypted, immutable/locked copy, separate account/region | 14 | Backup coverage %; immutable copy present | G |
| DR-03 | Restore testing | Automated, scheduled restore tests with timing; restore success logged | 14 | Restore success %; measured restore time | G |
| DR-04 | DR strategy per tier | Backup/restore, pilot-light, warm-standby or active-active chosen per tier and implemented | 12 | Strategy coverage; cost vs tier | H |
| DR-05 | DR runbooks & automation | Full environment rebuild via IaC; failover scripts; documented, versioned runbooks | 10 | Rebuild time from scratch; runbook freshness | H |
| DR-06 | DR drills / game days | ≥ annual full DR test (regional failover) with RTO/RPO actually measured against target | 12 | Last drill date; RTO/RPO achieved vs target | G |
| DR-07 | Cross-region / cross-account isolation | Replication to another region/account with separate credentials (blast-radius isolation) | 8 | Replication lag; isolation verified | H |
| DR-08 | Ransomware resilience | Immutable backups, offline/air-gapped copy, clean-room recovery procedure | 6 | Clean-restore test done | H |
| DR-09 | Dependency DR | DNS, IdP, CI/CD, secrets manager, observability, third parties covered in DR plan | 6 | Dependencies with DR plan % | M |
| DR-10 | Business continuity & crisis comms | BCP, crisis communication plan, alternate work arrangements, contact trees tested | 4 | BCP review date | M |
| | **Total** | | **100** | | |

---

## 13. Identity & Access Management (IA) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| IA-01 | SSO / federation & MFA | All human access via central IdP; MFA enforced; phishing-resistant (FIDO2) for admins | 16 | MFA coverage %; local accounts = 0 | G |
| IA-02 | Least privilege & role design | Custom roles, no standing Owner/Admin, permission boundaries, unused-permission analysis | 14 | Over-privileged identities; admin count | G |
| IA-03 | Privileged access management | Just-in-time elevation, approval, session logging; break-glass accounts sealed & monitored | 12 | Standing privileged accounts; JIT usage | H |
| IA-04 | Workload identity | No long-lived keys; OIDC/Workload Identity Federation for CI and cross-cloud; IRSA/WI for pods | 12 | Long-lived keys count; key age | G |
| IA-05 | Access reviews & recertification | Quarterly reviews of privileged/prod access; automated revocation on non-attestation | 10 | Review completion %; revocations | H |
| IA-06 | Joiner / mover / leaver automation | SCIM provisioning; deprovisioning within 24 h of leaving; role change triggers review | 10 | Deprovision SLA %; orphan accounts | H |
| IA-07 | Service account & API key hygiene | Inventory, owner, purpose, rotation ≤ 90 d, unused disabled | 8 | Unowned SAs; keys > 90 d | H |
| IA-08 | Kubernetes / platform RBAC | Namespaced roles, no cluster-admin for humans, RBAC audited, IdP-mapped groups | 8 | cluster-admin bindings; RBAC audit date | H |
| IA-09 | Identity audit & anomaly detection | Sign-in, privilege change and key creation events logged and alerted (impossible travel, new admin) | 6 | Identity alerts configured | M |
| IA-10 | Zero-trust access to internal tools | Identity-aware proxy / device posture; no flat network VPN to everything | 4 | % internal apps behind IAP/ZTNA | M |
| | **Total** | | **100** | | |

---

## 14. Governance, Risk & Compliance (GR) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| GR-01 | Policy framework & standards | ISMS, security/ops policies approved, reviewed yearly, acknowledged by staff | 12 | Policy review dates; acknowledgement % | H |
| GR-02 | Compliance mapping & continuous control monitoring | Controls mapped (ISO 27001, SOC 2, PCI DSS, NCA ECC, SAMA CSF, etc.); automated evidence | 14 | Controls passing %; framework coverage | G |
| GR-03 | Risk register & treatment | Risks owned, scored, treatment plans with dates, reviewed quarterly | 12 | Open high risks; overdue treatments | G |
| GR-04 | Change management & separation of duties | Change records linked to deploys; emergency change process; SoD enforced in tooling | 10 | Unauthorised changes; SoD violations | H |
| GR-05 | Asset inventory / CMDB accuracy | Automated discovery; owner & criticality per asset; ≥ 95 % accuracy | 10 | Inventory accuracy %; unknown assets | H |
| GR-06 | Third-party / vendor risk | Vendor assessments, DPAs, SLAs, sub-processor list, periodic review | 8 | Vendors assessed %; critical vendors with DR | M |
| GR-07 | Audit readiness & evidence automation | Evidence collected continuously (compliance automation); audit findings closed on time | 10 | Audit findings open; evidence lead time | H |
| GR-08 | Preventive guardrails (policy as code) | Org policies/SCPs, IaC policy checks block non-compliant resources before creation | 10 | Guardrail coverage; blocked violations | H |
| GR-09 | Security awareness & training | Annual + role-based training; phishing simulations | 6 | Completion %; phishing click rate | M |
| GR-10 | Exception & technical-debt management | Exceptions time-bound, risk-accepted by owner; tech-debt register with budget | 8 | Open exceptions; expired exceptions | M |
| | **Total** | | **100** | | |

---

## 15. MLOps / LLMOps (ML) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| ML-01 | Data versioning & lineage | Datasets versioned (DVC/lakeFS/Delta), lineage from raw → feature → model → prediction | 12 | % training data versioned; lineage graph | G |
| ML-02 | Feature store / reproducible features | Shared, versioned features; same code for training & serving (no skew) | 8 | Training–serving skew incidents | M |
| ML-03 | Experiment tracking & model registry | All runs tracked (params, metrics, artefacts); registry with stages & approvals | 12 | % models in registry; reproducible runs | G |
| ML-04 | Automated training pipelines | Pipelines (Kubeflow/Vertex/SageMaker/Airflow) triggered by code/data change; reproducible | 12 | Manual trainings = 0; pipeline success rate | H |
| ML-05 | Model validation & pre-deploy gates | Performance thresholds, fairness/bias tests, robustness checks block promotion | 10 | Gate pass rate; validation report per release | H |
| ML-06 | Deployment patterns | Shadow / canary / A-B for models; one-click rollback; versioned endpoints | 10 | % model deploys progressive; rollback time | H |
| ML-07 | Model monitoring & retraining | Data & concept drift, prediction quality, latency monitored; retraining triggers defined | 12 | Drift alerts; time to retrain | G |
| ML-08 | ML infrastructure cost & GPU utilisation | GPU utilisation tracked; spot/preemptible for training; cost per training run / inference | 6 | GPU utilisation %; cost per 1k inferences | M |
| ML-09 | Model governance & responsible AI | Model cards, approval workflow, explainability, risk classification (e.g. EU AI Act tiers) | 8 | % models with model card & approval | H |
| ML-10 | Security of ML assets | Access control to data/models, model supply chain (signed artefacts, trusted hubs), prompt-injection & data-poisoning defences | 6 | Model artefacts signed; red-team findings | H |
| ML-11 | LLMOps specifics | Prompt versioning, evaluation sets, guardrails, RAG index freshness, token cost tracking | 4 | Eval score trend; guardrail block rate | M |
| | **Total** | | **100** | | |

---

## 16. Git & Source Control Strategy (GS) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| GS-01 | Branching model defined & enforced | Deliberate model (trunk-based / GitHub Flow / GitFlow) fit to release cadence; branches live < 2 days; documented | 14 | Median branch age; long-lived branches count | G |
| GS-02 | Protected branches & merge rules | Required reviews + passing checks, no force-push/direct push to main, linear history or squash policy, signed-off merges | 12 | Protection enabled on 100 % of prod repos; direct pushes = 0 | G |
| GS-03 | Commit conventions & signing | Conventional Commits (or equivalent), atomic commits, GPG/SSH-signed commits or DCO | 8 | % signed commits; lint pass rate | M |
| GS-04 | Code review standards | CODEOWNERS, review SLA (< 1 business day), PR size limit (~400 LOC), review checklist, two reviewers for critical paths | 12 | Review turnaround; median PR size; % PRs > limit | H |
| GS-05 | Versioning & tagging | SemVer, immutable release tags, automated changelog/release notes from commits | 10 | % releases tagged; changelog automation | H |
| GS-06 | Repo topology strategy | Monorepo vs polyrepo decided deliberately; ownership boundaries clear; tooling (build graph, sparse checkout) matches | 6 | Decision record; cross-repo change lead time | M |
| GS-07 | Release branching & hotfix process | Release-cut, backport and hotfix paths documented, automated and rehearsed; hotfix lead time measured | 8 | Hotfix lead time; backport failures | H |
| GS-08 | Repository hygiene | Repo templates, `.gitignore`/LFS for binaries, stale repos archived, secret history scrubbed, large-file limits | 6 | Stale repos %; repos from template % | M |
| GS-09 | Git platform security | SSO + 2FA mandatory, scoped short-lived tokens, app/webhook permissions reviewed, audit logs exported, Git server backed up and restore-tested | 10 | 2FA coverage; token age; last restore test | G |
| GS-10 | Merge queue & integration health | Merge queue/bot keeps main green; required rebase/update before merge; main-broken time tracked | 6 | Main red time/week; merge queue adoption | M |
| GS-11 | GitOps repository structure | App repos separated from config/deployment repos; env promotion via PR; env overlays and ownership clear | 8 | % envs promoted via PR; config drift | H |
| | **Total** | | **100** | | |

---

## 17. Testing Strategy (TS) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| TS-01 | Test strategy & pyramid | Written strategy: pyramid/trophy shape, test types per layer, ownership, definition of done includes tests | 10 | Strategy doc; DoD compliance | H |
| TS-02 | Unit testing | Fast suite (< 5 min), coverage thresholds on critical modules (e.g. ≥ 80 %), mutation testing on core logic | 12 | Coverage %; suite duration; mutation score | G |
| TS-03 | Integration & contract testing | Consumer-driven contracts (Pact/OpenAPI), DB/queue integration tests with containers, run per PR | 12 | Contract coverage of APIs; integration pass rate | H |
| TS-04 | End-to-end / UI testing | Critical user journeys automated, parallelised, stable; run pre-prod per release | 8 | Journey coverage; E2E pass rate; duration | H |
| TS-05 | Performance & load testing | Load/stress/soak per release for critical paths; baselines and regression thresholds fail the pipeline | 10 | p95 regression caught; test cadence | H |
| TS-06 | Security testing in strategy | SAST/DAST/SCA/secret scans positioned in the strategy with owners and SLAs (detail → §SD) | 6 | Security test coverage per layer | M |
| TS-07 | Test data management | Synthetic or masked datasets, versioned fixtures/seed scripts, no production PII in tests | 8 | PII in test data = 0; fixture reuse | H |
| TS-08 | Test environments & virtualisation | On-demand ephemeral envs with prod parity; service virtualisation/mocks for third parties | 8 | Env provisioning time; env wait time | H |
| TS-09 | Flaky test management | Flakiness detected automatically, quarantined with owner, < 2 % flaky rate, fixed within SLA | 6 | Flaky rate; quarantine age | M |
| TS-10 | Tests gate merge & shift-left | Tests block merge; pre-commit/local runs; TDD/BDD practised on critical code | 8 | Merges with failing tests = 0; pre-commit adoption | G |
| TS-11 | Infrastructure & config testing | IaC unit/integration tests (Terratest, policy tests), Helm/Kustomize schema & unit tests, post-deploy smoke tests | 6 | % IaC modules tested; smoke test coverage | H |
| TS-12 | Resilience, chaos & DR testing | Fault-injection tests in pipeline/stage, game days, DR drills scheduled (links SR-08, DR-06) | 6 | Experiments/quarter; findings closed | M |
| | **Total** | | **100** | | |

---

## 18. Kubernetes (K8) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| K8-01 | Cluster architecture & lifecycle | Managed control plane, multi-AZ node pools, version within N-1 of upstream, regular tested upgrades (surge/blue-green), separate clusters per env/tier | 10 | Version skew; upgrade cadence; unplanned upgrade incidents | G |
| K8-02 | Multi-tenancy & namespace model | Namespace per team/app/env, ResourceQuotas, LimitRanges, mandatory labels, tenant isolation documented | 8 | Namespaces with quotas %; label compliance | H |
| K8-03 | RBAC & identity | IdP-mapped groups, no human cluster-admin, namespaced roles, workload identity (IRSA/WI), SA token auto-mount disabled where unneeded | 10 | cluster-admin bindings; SA tokens mounted | G |
| K8-04 | Pod security | Pod Security Standards `restricted` (or `baseline` min) enforced; non-root, read-only rootfs, caps dropped, no privileged/hostPath | 10 | Namespaces at restricted %; privileged pods = 0 | G |
| K8-05 | Network policies & service mesh | Default-deny NetworkPolicies, explicit ingress/egress, mTLS via mesh or CNI where required, egress gateway | 8 | Namespaces with default-deny %; mTLS coverage | H |
| K8-06 | Workload resource management | Requests/limits on all pods, HPA/VPA/KEDA, PDBs, PriorityClasses, topology spread, anti-affinity for Tier-1 | 10 | Pods without requests = 0; PDB coverage; OOMKills | H |
| K8-07 | Ingress, gateway & TLS | Standard ingress controller or Gateway API, cert-manager automation, WAF/rate-limit integration, no NodePort exposure | 6 | Cert expiry incidents; exposed NodePorts | M |
| K8-08 | Secrets & config in cluster | External Secrets Operator / CSI driver from vault/secret manager, etcd encryption at rest, no plaintext secrets in Git or manifests | 8 | Plaintext secrets in repos = 0; ESO coverage | G |
| K8-09 | Admission control & policy as code | Kyverno/Gatekeeper enforce image signature verification, registry allow-list, required labels/probes, no `latest` | 8 | Policies in enforce mode; violations blocked/week | H |
| K8-10 | Image & supply-chain standards | Minimal/distroless images, scanned + signed, pinned digests, private registry mirror, base image refresh cadence | 6 | Critical CVEs in running images; unsigned images | H |
| K8-11 | Kubernetes observability | Cluster/node/pod metrics, events, logs, control-plane audit logs centralised; readiness/liveness probes on all workloads | 6 | Probe coverage %; audit log retention | H |
| K8-12 | GitOps & manifest standards | Argo CD/Flux for all deployments, Helm/Kustomize conventions, env overlays, drift auto-sync, app-of-apps/ApplicationSets | 6 | % workloads GitOps-managed; drift events | H |
| K8-13 | Stateful workloads & storage | StorageClasses defined, CSI snapshots, Velero/backup for PVs & cluster state, operators for DBs/queues, restore tested | 4 | PV backup coverage; last restore test | M |
| | **Total** | | **100** | | |

---

## 19. Database & Data Operations (DB) — 100 pts

| ID | Factor | What "good" (Level 4) looks like | Weight | Evidence / KPI | Tag |
|---|---|---|---|---|---|
| DB-01 | HA topology & failover | Managed or clustered DB, multi-AZ, read replicas, automatic failover tested regularly with measured downtime | 14 | Failover test date; failover time | G |
| DB-02 | Schema migrations as code | Versioned migrations (Flyway/Liquibase/Alembic/Prisma), backward-compatible expand/contract, run from pipeline with rollback plan | 12 | Manual schema changes = 0; failed migrations | G |
| DB-03 | Backup & point-in-time recovery | Automated backups, PITR enabled, cross-region copy, restore tested & timed (links DR-02/03) | 12 | PITR window; restore test result | G |
| DB-04 | Performance management | Slow-query logging, index/plan reviews, connection pooling (PgBouncer/ProxySQL), query SLOs | 10 | p95 query latency; slow queries/day | H |
| DB-05 | Capacity & growth planning | Storage auto-scaling, growth forecast, archiving/partitioning of cold data | 8 | Headroom %; forecast vs actual | M |
| DB-06 | Access & security | Private endpoints only, IAM/short-lived auth, least-privilege roles, audit logging, encryption with CMEK (links DP) | 10 | Public DBs = 0; shared admin accounts = 0 | H |
| DB-07 | Database observability & SLOs | Latency, replication lag, connections, locks/deadlocks, disk & IOPS monitored with SLO-based alerts | 8 | Replication lag alerts; DB-caused incidents | H |
| DB-08 | Data quality & pipeline reliability (DataOps) | Validation tests (Great Expectations/dbt tests), freshness SLAs, lineage, idempotent & re-runnable ETL/ELT | 10 | Freshness SLA met %; failed quality checks | H |
| DB-09 | Engine version & patch management | Supported engine versions, minor patches in maintenance windows, EOL tracked, upgrade rehearsed in stage | 6 | Versions out of support = 0 | M |
| DB-10 | Non-prod refresh & masking | Automated refresh of lower envs from masked/synthetic data (links DP-07) | 4 | Refresh cadence; PII in non-prod = 0 | M |
| DB-11 | Caching & read-scaling strategy | Cache layer with invalidation strategy, read/write split, replica lag awareness in app | 6 | Cache hit rate; read-replica utilisation | M |
| | **Total** | | **100** | | |

---

## 20. Quick-reference: gate factors (minimum Level 2)

| Domain | Gate factors |
|---|---|
| DO | DO-01, DO-02, DO-04 |
| CI | CI-01, CI-04 |
| SD | SD-04, SD-05, SD-09 |
| SO | SO-01, SO-03, SO-07 |
| CA | CA-02, CA-04 |
| PE | PE-03, PE-04 |
| SR | SR-01, SR-03, SR-04 |
| OB | OB-01, OB-02, OB-04 |
| FO | FO-01 |
| DP | DP-01, DP-02, DP-03, DP-04 |
| DR | DR-01, DR-02, DR-03, DR-06 |
| IA | IA-01, IA-02, IA-04 |
| GR | GR-02, GR-03 |
| ML | ML-01, ML-03, ML-07 |
| GS | GS-01, GS-02, GS-09 |
| TS | TS-02, TS-10 |
| K8 | K8-01, K8-03, K8-04, K8-08 |
| DB | DB-01, DB-02, DB-03 |

## 21. Worked example

Domain **DR**, assessed levels: DR-01=3, DR-02=4, DR-03=1, DR-04=2, DR-05=2, DR-06=0, DR-07=2, DR-08=1, DR-09=1, DR-10=2.

Points = 14·0.75 + 14·1 + 14·0.25 + 12·0.5 + 10·0.5 + 12·0 + 8·0.5 + 6·0.25 + 6·0.25 + 4·0.5
= 10.5 + 14 + 3.5 + 6 + 5 + 0 + 4 + 1.5 + 1.5 + 2 = **48 / 100** → "Developing".
Gate check: DR-03 (Level 1) and DR-06 (Level 0) fail → domain capped at 59 (already below). Priority actions: restore testing and a DR drill.

A companion machine-readable file is generated at `factors.csv` (one row per factor) for import into spreadsheets or scoring tools.