0 / 24

Model 35 of 74 · Technology & Data

Infrastructure & Architecture Maturity Assessment

Evaluate infrastructure management, architecture governance, and modernisation.

Pillars & areas

Govern

Set the blueprint

  1. 01Architecture Governance & Standards
  2. 06Documentation & Knowledge

Operate

Build & run reliably

  1. 02Infrastructure Provisioning & Management
  2. 03Capacity, Performance & Scalability

Advance

Evolve & modernise

  1. 04Resilience & Disaster Recovery
  2. 05Modernisation & Technical Debt

Levels

  1. 1SprawlingBreak-fix & ad-hoc
  2. 2StandardisedDefined & repeatable
  3. 3ComposableSelf-healing & evolving

01 Architecture Governance & Standards

How well does the organisation govern technology decisions and enforce architectural consistency?

0/4 answered

AG-1How does your organisation make decisions about which technologies to adopt?

Think about whether technology choices follow a formal evaluation process or whether teams pick whatever they prefer.

AG-2How are architecture standards communicated and enforced across delivery teams?

Consider whether architects publish standards that nobody reads, or whether standards are embedded into how teams actually build.

AG-3How does your organisation manage architectural exceptions and deviations?

Think about whether deviations are tracked with a plan to remediate, or whether they quietly become permanent.

AG-4How does your architecture function engage with business stakeholders?

Consider whether architects understand business strategy and translate it into technology direction, or whether they operate in isolation.

02 Infrastructure Provisioning & Management

How efficiently and consistently does the organisation provision, configure, and manage infrastructure?

0/4 answered

IP-1How does your organisation provision new infrastructure environments?

Think about how long it takes to stand up a new environment and whether the process is manual or automated.

IP-2How does your organisation manage configuration drift across environments?

Consider whether you can guarantee that production matches what was tested, or whether manual changes have created hidden differences.

IP-3How does your organisation manage the lifecycle of infrastructure assets?

Think about whether you know what is running, who owns it, what it costs, and when it should be retired.

IP-4How does your organisation handle patching and vulnerability remediation on infrastructure?

Consider whether patching is a planned, low-risk activity or a stressful fire drill that often breaks things.

03 Capacity, Performance & Scalability

Does the organisation proactively manage capacity and performance to meet current and future demand?

0/4 answered

CP-1How does your organisation forecast and plan for capacity needs?

Think about whether capacity planning happens before demand arrives or whether you find out you need more capacity when things slow down.

CP-2How does your organisation monitor and respond to performance degradation?

Consider whether you learn about performance problems from monitoring dashboards or from users complaining.

CP-3How does your organisation design systems for scalability?

Think about whether scaling up requires re-architecture or whether systems are designed to grow from the outset.

CP-4How does your organisation manage and optimise infrastructure costs?

Consider whether anyone knows how much each service costs to run, or whether the cloud bill is a monthly surprise.

04 Resilience & Disaster Recovery

How well does the organisation withstand failures and recover from disruptions?

0/4 answered

RD-1How does your organisation define and meet recovery objectives for critical systems?

Think about whether you have documented RTO and RPO targets and whether you have proven you can actually meet them.

RD-2How does your organisation test its disaster recovery capabilities?

Consider whether DR plans have actually been tested end-to-end, or whether they exist only on paper.

RD-3How does your organisation design systems for high availability?

Think about whether a single server failure would take down a business-critical service.

RD-4How does your organisation learn from outages and incidents?

Consider whether post-incident reviews lead to concrete changes, or whether the same type of outage keeps recurring.

05 Modernisation & Technical Debt

How deliberately does the organisation manage technical debt and drive infrastructure modernisation?

0/4 answered

MT-1How does your organisation identify and track technical debt?

Think about whether technical debt is visible to decision-makers or whether it is hidden inside engineering teams.

MT-2How does your organisation approach legacy system modernisation?

Consider whether legacy systems are left alone until they break, or whether there is an active programme to modernise them.

MT-3How does your organisation prevent new technical debt from accumulating?

Think about whether shortcuts taken during delivery are tracked and paid back, or whether they compound silently.

MT-4How does your organisation manage end-of-life software and unsupported platforms?

Consider whether you know which components are approaching end-of-life and whether migration plans exist before support expires.

06 Documentation & Knowledge

Is infrastructure and architecture knowledge captured, current, and accessible to those who need it?

0/4 answered

DK-1How does your organisation document its infrastructure and architecture?

Think about whether a new team member could understand how systems are connected without asking the one person who built them.

DK-2How does your organisation manage operational runbooks and procedures?

Consider whether operations staff follow documented procedures during incidents or rely on tribal knowledge and improvisation.

DK-3How well does your organisation understand dependencies between systems?

Think about whether you could quickly determine which downstream services would be affected if a given system went offline.

DK-4How does your organisation share infrastructure and architecture knowledge across teams?

Consider whether knowledge stays siloed within teams or whether there are deliberate mechanisms to spread it.

Self-assessment report

Infrastructure & Architecture

Answer the questions above and your report builds here: an overall score, a score and target for each area, and the three changes that matter most.

About this model

About the Infrastructure & Architecture maturity model

Infrastructure and architecture are the foundation upon which every digital service, application, and business capability is built. Yet in many organisations, infrastructure is treated as a cost centre to be minimised rather than a strategic enabler to be invested in. This model takes the position that mature infrastructure management is not about chasing the newest technology — it is about making deliberate, governed decisions that balance reliability, cost, agility, and security.

Architecture governance without pragmatism creates ivory towers. Infrastructure automation without standards creates sprawl at speed. This model measures whether an organisation has found the balance: standards that enable rather than constrain, automation that enforces rather than replaces governance, and modernisation that is driven by business outcomes rather than technical novelty.

The Infrastructure & Architecture maturity model evaluates six areas that together determine whether an organisation's technology foundation is fit for purpose today and adaptable for tomorrow. It covers the full lifecycle — from how technology decisions are governed and infrastructure is provisioned, through how capacity and resilience are managed, to how technical debt is addressed and knowledge is preserved.

The model uses three maturity levels that reflect how organisations typically evolve: from reactive firefighting, through deliberate standardisation, to adaptive and self-correcting infrastructure management. Each level describes observable behaviours rather than aspirational statements, making it possible to assess honestly where the organisation stands.

This is not a cloud-versus-on-premises assessment. The questions are intentionally technology-agnostic — they apply equally to organisations running physical data centres, public cloud, hybrid environments, or edge infrastructure.

Who this assessment is for

  • Infrastructure and platform engineering leaders seeking a structured view of operational maturity across their teams.
  • Enterprise and solution architects evaluating whether governance mechanisms are effective and adopted.
  • CTOs and technology directors who need to communicate infrastructure risk and investment needs to non-technical leadership.
  • Cloud and DevOps teams assessing whether automation, observability, and self-service capabilities are genuinely mature or merely present.
  • IT auditors and risk managers looking for a structured framework to evaluate infrastructure management practices.

The three maturity levels

  • Level 1 — Sprawling: Infrastructure is managed on a break-fix basis. Technology decisions are made independently by individual teams with no central governance. Systems are provisioned manually, documentation is scarce, and the organisation discovers problems only when they cause outages or cost overruns. Knowledge depends heavily on a small number of individuals, and technical debt accumulates unchecked.
  • Level 2 — Standardised: The organisation has established repeatable processes and defined standards for infrastructure management. Architecture governance guides technology decisions through formal reviews and approved technology lists. Infrastructure-as-code is used for common patterns, monitoring covers critical systems, and disaster recovery plans are tested periodically. Technical debt is tracked and prioritised, and documentation exists for production systems.
  • Level 3 — Composable: Infrastructure is built from well-governed, reusable building blocks. Architecture standards are built into the templates and pipelines teams already use, so the compliant path is the easiest one. Environments are available on demand, observability is comprehensive, and recovery is proven through regular realistic testing. Costs and capacity are actively managed by the teams that own them, technical debt is quantified in business terms, modernisation is strategic and ongoing, and knowledge is structural rather than dependent on individuals.

The 6 areas assessed

1. Architecture Governance & Standards

How well does the organisation govern technology decisions and enforce architectural consistency? This area examines whether technology choices follow a deliberate evaluation process, whether standards are communicated and embedded into delivery workflows, and whether the architecture function is connected to business strategy. Mature organisations encode standards as automated guardrails rather than relying on documents and review boards alone.

2. Infrastructure Provisioning & Management

How efficiently and consistently does the organisation provision, configure, and manage infrastructure? This area covers the journey from manual, ticket-driven provisioning through infrastructure-as-code to fully self-service internal platforms. It also examines configuration drift management, asset lifecycle tracking, and patching practices — the operational fundamentals that determine whether infrastructure is reliable and maintainable.

3. Capacity, Performance & Scalability

Does the organisation proactively manage capacity and performance to meet current and future demand? This area assesses whether capacity planning is reactive or forecast-driven, whether monitoring detects problems before users do, whether systems are designed to scale, and whether infrastructure costs are understood and optimised. Mature organisations combine technical observability with financial awareness through FinOps practices.

4. Resilience & Disaster Recovery

How well does the organisation withstand failures and recover from disruptions? This area evaluates whether recovery objectives are defined and validated, whether DR plans are tested realistically, whether systems are designed to eliminate single points of failure, and whether incidents feed a continuous reliability improvement loop. The distinction between levels is primarily about the shift from documented plans to proven, automated recovery.

5. Modernisation & Technical Debt

How deliberately does the organisation manage technical debt and drive infrastructure modernisation? This area examines whether technical debt is visible, quantified, and prioritised alongside feature delivery. It also covers legacy system modernisation strategy, controls to prevent new debt from accumulating, and end-of-life management. Mature organisations treat debt reduction as ongoing maintenance, not as a separate initiative.

6. Documentation & Knowledge

Is infrastructure and architecture knowledge captured, current, and accessible to those who need it? This area covers system documentation, operational runbooks, dependency mapping, and cross-team knowledge sharing. The key maturity differentiator is the shift from static, manually-maintained documentation to auto-generated, always-current knowledge that is embedded into operational tooling and team onboarding.

How this model relates to other frameworks

  • TOGAF (The Open Group Architecture Framework) — enterprise architecture methodology covering architecture governance, standards, and reference models.
  • ITIL 4 — IT service management framework with specific practices for infrastructure and platform management, capacity management, and service continuity.
  • AWS Well-Architected Framework / Azure Well-Architected Framework / Google Cloud Well-Architected Framework — cloud-provider-specific guidance on reliability, performance, cost optimisation, and operational excellence.
  • Site Reliability Engineering (SRE) — Google's approach to infrastructure reliability, covering service level objectives, error budgets, and incident management.
  • FinOps Foundation — framework for cloud financial management, covering cost allocation, optimisation, and organisational accountability.
  • NIST SP 800-53 — security and privacy controls including configuration management, contingency planning, and system and information integrity.
  • ISO/IEC 27001 — information security management with controls relevant to infrastructure security, business continuity, and asset management.

Frequently asked questions

What is the Infrastructure & Architecture maturity model?

Evaluate infrastructure management, architecture governance, and modernisation. It is an original, simplified model with three maturity levels (Sprawling, Standardised and Composable), assessed through 24 questions across 6 areas: Architecture Governance & Standards, Infrastructure Provisioning & Management, Capacity, Performance & Scalability, Resilience & Disaster Recovery, Modernisation & Technical Debt and Documentation & Knowledge.

How long does the Infrastructure & Architecture assessment take?

Most people finish in 10–14 minutes. Each of the 24 questions has three concrete answer options. Your progress is saved in the page URL, so you can bookmark it and come back later.

How is the score calculated?

Each answer scores 1 (Sprawling), 2 (Standardised) or 3 (Composable). An area's score is the average of its answered questions, and the overall score is the average of the area scores, so every area counts equally. Scores run from 1.0 to 3.0.

Is my data stored or shared?

No. Your answers are never sent to a server. They are stored only in the page URL, which you control. Copy the link to share results with colleagues, or export a PDF or CSV report.

How should I use the results?

Start with "Where to focus" in your report. It lists the questions with the biggest gap to the target you set for each area, and shows what the next level looks like in practice. For a fuller picture, ask several people from different teams to complete the assessment and compare their links. Differences in perception are often as revealing as the scores themselves.