0 / 24

Model 31 of 74 · Technology & Data

Cloud Maturity Assessment

Evaluate cloud strategy, adoption, operations, and optimisation.

Pillars & areas

Strategise

Plan the journey

  1. 01Cloud Strategy & Governance
  2. 02Migration & Adoption

Architect

Design for cloud

  1. 03Architecture & Design
  2. 05Security & Compliance

Operate

Run and optimise

  1. 04Operations & Reliability
  2. 06Cost Management & Optimisation

Levels

  1. 1Lift-and-ShiftTactical & reactive
  2. 2Cloud-EnabledDeliberate & standardised
  3. 3Cloud-NativeStrategic & optimised

01 Cloud Strategy & Governance

Does the organisation have a clear cloud strategy with defined decision-making, policies, and accountability?

0/4 answered

SG-1How does your organisation decide what goes to the cloud versus staying on-premises?

Think about whether there is a documented policy or whether each team makes its own call.

SG-2How are cloud accounts, subscriptions, and projects structured and governed?

Consider whether your cloud tenancy is well-organised or whether it has grown organically without structure.

SG-3Who is accountable for cloud decisions and outcomes in your organisation?

Think about whether there is a named person or team responsible for cloud direction, standards, and outcomes.

SG-4How does your organisation manage its relationship with cloud providers?

Consider whether you actively manage vendor relationships, contracts, and lock-in risk, or simply consume services.

02 Migration & Adoption

Does the organisation take a structured approach to moving workloads to the cloud and driving adoption?

0/4 answered

MA-1How does your organisation plan and prioritise cloud migrations?

Think about whether migrations are planned as a portfolio or handled one at a time without sequencing.

MA-2What migration approach does your organisation typically use?

Consider whether workloads are simply moved as-is or whether the migration is used as an opportunity to modernise.

MA-3How does your organisation build cloud skills across teams?

Think about whether cloud knowledge is concentrated in a few specialists or distributed across the organisation.

MA-4How does your organisation validate that a migrated workload is performing correctly in the cloud?

Consider whether there is a formal cutover and validation process or whether workloads are switched over and hoped for the best.

03 Architecture & Design

Are cloud workloads designed to take advantage of cloud capabilities rather than simply replicating on-premises patterns?

0/4 answered

AD-1How are cloud architectures designed and reviewed in your organisation?

Think about whether there are architectural standards for cloud or whether each team designs independently.

AD-2How does your organisation handle high availability and disaster recovery in the cloud?

Consider whether workloads are designed for resilience or whether they rely on single points of failure.

AD-3How does your organisation manage infrastructure provisioning and configuration?

Think about whether cloud resources are created manually through the console or defined and managed as code.

AD-4How does your organisation approach application scalability in the cloud?

Consider whether applications can scale automatically to handle varying demand or whether capacity is statically allocated.

04 Operations & Reliability

Are cloud environments operated with the discipline, observability, and automation needed for production reliability?

0/4 answered

OR-1How does your organisation monitor cloud workloads?

Think about whether you have comprehensive observability or whether you only notice problems when users report them.

OR-2How does your organisation handle incidents affecting cloud workloads?

Consider whether there is a structured incident response process or whether each outage is handled ad hoc.

OR-3How does your organisation deploy changes to cloud environments?

Think about whether deployments are manual and risky or automated and routine.

OR-4How does your organisation manage patching and updates for cloud resources?

Consider whether patching is proactive and automated or whether systems fall behind and require emergency remediation.

05 Security & Compliance

Are cloud environments secured by design, continuously monitored, and aligned with regulatory requirements?

0/4 answered

SC-1How does your organisation manage identity and access in cloud environments?

Think about whether access is tightly controlled with least privilege or whether broad permissions have accumulated over time.

SC-2How does your organisation protect data stored and processed in the cloud?

Consider whether data classification drives protection decisions or whether all data is treated the same way.

SC-3How does your organisation detect and respond to security threats in cloud environments?

Think about whether you would know if someone was misusing cloud resources or if a breach occurred.

SC-4How does your organisation ensure cloud environments meet regulatory and compliance requirements?

Consider whether compliance is verified continuously or only checked during periodic audits.

06 Cost Management & Optimisation

Does the organisation understand, control, and optimise its cloud spending?

0/4 answered

CO-1How does your organisation track and allocate cloud costs?

Think about whether you know which teams, applications, or projects are driving cloud spend.

CO-2How does your organisation identify and eliminate cloud waste?

Consider whether anyone actively looks for idle resources, oversized instances, or unused storage.

CO-3How does your organisation use commitment-based pricing (reserved instances, savings plans, committed-use discounts)?

Think about whether your organisation optimises pricing through long-term commitments or pays on-demand rates for everything.

CO-4How does your organisation forecast and budget for cloud spending?

Consider whether cloud budgets are set proactively or whether spending is discovered after the fact.

Self-assessment report

Cloud

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Cloud maturity model

Cloud maturity is not about how many services you consume or how large your cloud bill is. It is about how deliberately your organisation adopts, operates, and evolves its use of cloud technology. An organisation that runs two workloads in the cloud with strong governance, automated operations, and clear cost accountability is more mature than one running hundreds of workloads with no standards, no visibility, and no control.

This model treats cloud as an operating model shift, not a technology migration. Moving a server from a data centre to a virtual machine in the cloud changes very little if the same manual processes, siloed teams, and reactive practices follow it there. True cloud maturity means rethinking how you design, deploy, secure, operate, and pay for technology — and building the organisational discipline to do all of those things well.

The Cloud Maturity model evaluates six areas that together determine how effectively an organisation uses the cloud. It covers the full lifecycle: from the strategic decisions about what belongs in the cloud, through migration and architectural design, into day-to-day operations and security, and finally into the financial discipline needed to sustain cloud at scale.

The model is designed to be cloud-provider agnostic. Whether your organisation uses AWS, Azure, Google Cloud, or a multi-cloud approach, the practices and behaviours assessed here apply equally. The focus is on organisational capability, not specific tooling.

Each area contains four questions scored across three maturity levels. The levels are named to reflect the typical cloud adoption journey: from tactical lift-and-shift, through deliberate cloud enablement, to a fully cloud-native operating model.

Who this assessment is for

  • Cloud architects and engineers looking to benchmark their organisation's cloud practices against a structured framework.
  • IT leaders and CTOs who need to understand where cloud adoption is strong and where it needs investment.
  • Platform and infrastructure teams responsible for building the foundations that other teams build upon.
  • FinOps practitioners assessing cost management and financial governance maturity.
  • Security and compliance teams evaluating whether cloud environments are governed and protected effectively.
  • Programme managers overseeing cloud migration or modernisation initiatives who need to assess readiness across multiple dimensions.

The three maturity levels

  • Level 1 — Lift-and-Shift: Cloud usage is tactical and reactive. Workloads are moved to the cloud without rethinking their architecture, and on-premises operating practices are carried over unchanged. Governance is informal or absent, costs are opaque, and cloud knowledge is concentrated in a few individuals. The organisation is using cloud infrastructure but has not changed how it works.
  • Level 2 — Cloud-Enabled: The organisation has moved beyond basic adoption and is managing cloud deliberately. Standards, policies, and operational processes are defined and followed for most workloads. Infrastructure-as-code is used for new deployments, monitoring covers key metrics, costs are tracked and allocated, and security controls are in place. Teams have cloud skills, though pockets of manual or inconsistent practice remain.
  • Level 3 — Cloud-Native: Cloud is a strategic platform that shapes how the organisation designs, builds, and runs technology. Architecture follows cloud-native patterns with automation, resilience, and scalability built in. Security and compliance are codified as policy. Operations are observable, incident response is practised, and deployments are frequent and low-risk. Cost management is a shared discipline between engineering and finance. The organisation continuously optimises its cloud usage and treats cloud capability as a competitive advantage.

The 6 areas assessed

1. Cloud Strategy & Governance

Assesses whether the organisation has a clear cloud strategy with defined decision-making criteria, structured account governance, accountable ownership, and active vendor management. Without strategic governance, cloud adoption becomes fragmented — teams make independent decisions that create inconsistency, duplication, and risk.

2. Migration & Adoption

Evaluates how the organisation plans and executes cloud migrations. This includes portfolio-level planning and prioritisation, choosing the right migration approach for each workload, building cloud skills across the workforce, and rigorously validating that migrated workloads perform correctly. Poor migration practices create technical debt that compounds over time.

3. Architecture & Design

Examines whether cloud workloads are designed to take advantage of cloud capabilities rather than replicating on-premises patterns. This covers architectural standards and review processes, resilience and disaster recovery design, infrastructure-as-code practices, and application scalability. Architecture decisions made during design have the greatest long-term impact on reliability, cost, and agility.

4. Operations & Reliability

Assesses the operational discipline applied to cloud environments. This includes monitoring and observability, incident management, deployment automation, and patching practices. Cloud makes it easy to provision infrastructure but does not automatically make it easy to run reliably — that requires deliberate investment in operational capability.

5. Security & Compliance

Evaluates whether cloud environments are secured by design and continuously monitored. This covers identity and access management, data protection, threat detection and response, and regulatory compliance. Cloud security requires a different approach from traditional perimeter-based models — the attack surface is broader, change is faster, and misconfiguration is the leading cause of breaches.

6. Cost Management & Optimisation

Assesses financial governance of cloud spending. This includes cost tracking and allocation, waste identification and elimination, commitment-based pricing strategies, and forecasting and budgeting. Cloud spending is operational expenditure that scales with usage — without active management, costs grow faster than value.

How this model relates to other frameworks

  • AWS Well-Architected Framework — Amazon's lens for evaluating cloud workloads across operational excellence, security, reliability, performance efficiency, cost optimisation, and sustainability.
  • Azure Cloud Adoption Framework — Microsoft's guidance for cloud strategy, planning, readiness, migration, and governance.
  • Google Cloud Well-Architected Framework (formerly the Architecture Framework) — Google's best practices for designing and operating workloads on Google Cloud.
  • FinOps Foundation Framework — The standard framework for cloud financial management, covering inform, optimise, and operate phases.
  • NIST SP 500-292 — NIST Cloud Computing Reference Architecture, providing a standard taxonomy for cloud services and deployment models.
  • ISO/IEC 27017 — Security controls for cloud services, extending ISO 27002 with cloud-specific guidance.
  • Cloud Security Alliance (CSA) Cloud Controls Matrix — A security controls framework specifically designed for cloud computing environments.

Frequently asked questions

What is the Cloud maturity model?

Evaluate cloud strategy, adoption, operations, and optimisation. It is an original, simplified model with three maturity levels (Lift-and-Shift, Cloud-Enabled and Cloud-Native), assessed through 24 questions across 6 areas: Cloud Strategy & Governance, Migration & Adoption, Architecture & Design, Operations & Reliability, Security & Compliance and Cost Management & Optimisation.

How long does the Cloud assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Lift-and-Shift), 2 (Cloud-Enabled) or 3 (Cloud-Native). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.