Kloia Assessment Framework · 4.0

Nine Disciplines, Scored One at a Time

KAF is the framework our consultants run in every engagement, scoring your engineering organisation across nine disciplines to give you a maturity level, the gaps behind it, and a roadmap to close them.

Book An Assessment Start a Self-Assessment
Framework Spec
KAF-4.0
Observability
 
60 crit
DevOps
 
61 crit
FinOps
 
56 crit
Security
 
64 crit
Resilience
 
60 crit
Architecture
 
46 crit
Developer Experience
 
60 crit
Platform
 
89 crit
AI
 
82 crit

Each pillar carries 10 weighted categories scoring to 100 points.

9
Pillars

90
Categories

578
Criteria

L1-L5
Maturity Levels

The Nine Pillars

Nine Disciplines, Scored One at a Time

Pillars are independent. Most clients start with two or three and add the rest as the programme runs. Select a pillar to see its maturity scale and the ten categories it scores.
Observability
10 cat
Observability Maturity Assessment
Whether the state of production can be seen, explained and predicted without guesswork.
Maturity Scale
L1
Initial
0–20
L2
Basic
21–40
L3
Managed
41–60
L4
Defined
61–80
L5
Advanced
81–100
Categories · Weight Out of 100
01APM & Distributed Tracing
 
12 pts
02Centralized Logging
 
12 pts
03Metrics Collection & Monitoring
 
14 pts
04Alerting & Incident Management
 
14 pts
05Dashboards & Visualization
 
7 pts
06End-User Monitoring
 
7 pts
07Error Tracking & Root Cause Analysis
 
8 pts
08Anomaly Detection & Predictive Analytics
 
9 pts
09Capacity Management & Optimization
 
8 pts
10Integration, Compliance & Knowledge Management
 
9 pts
DevOps
10 cat
DevOps Excellence Maturity Assessment
How code reaches production: automation, repeatability and the speed of feedback.
Maturity Scale
L1
Basic
0–20
L2
Standardized
21–40
L3
Automated
41–60
L4
Optimized
61–80
L5
Innovative
81–100
Categories · Weight Out of 100
01Version Control & Code Management
 
11 pts
02Local Development Environment
 
10 pts
03Pre-Commit Hooks & Code Quality
 
7 pts
04Build & Continuous Integration (CI)
 
10 pts
05Deployment & Continuous Delivery (CD)
 
10 pts
06Testing & Quality Assurance
 
13 pts
07Artifact & Dependency Management
 
7 pts
08Database DevOps
 
8 pts
09Deployment Strategies & Release Management
 
14 pts
10Monitoring, Feedback & Advanced Practices
 
10 pts
FinOps
10 cat
FinOps Maturity Assessment
Whether cloud spend is visible, owned by the teams that create it, and acted on.
Maturity Scale
L1
Foundational
0–20
L2
Standardized
21–40
L3
Established
41–60
L4
Optimized
61–80
L5
Strategic
81–100
Categories · Weight Out of 100
01Cost Visibility & Reporting
 
14 pts
02Cost Allocation & Tagging
 
11 pts
03Budgeting & Forecasting
 
11 pts
04Cost Optimization & Efficiency
 
16 pts
05Chargeback/Showback Models
 
9 pts
06FinOps Culture & Awareness
 
9 pts
07Governance & Policy Enforcement
 
9 pts
08Cross-Functional Collaboration
 
7 pts
09KPIs & Business Alignment
 
7 pts
10Advanced Practices & Innovation
 
7 pts
Security
10 cat
Security Maturity Assessment
Identity, application and cloud security as practised day to day, not as written policy.
Maturity Scale
L1
Foundational
0–20
L2
Managed
21–40
L3
Defined
41–60
L4
Advanced
61–80
L5
Optimized
81–100
Categories · Weight Out of 100
01Identity & Access Management (IAM)
 
12 pts
02Vulnerability & Patch Management
 
13 pts
03Application Security
 
15 pts
04Data Protection & Encryption
 
10 pts
05Network Security
 
8 pts
06Security Monitoring & Incident Response
 
13 pts
07Cloud & Container Security
 
8 pts
08Security Testing & Validation
 
8 pts
09Compliance & Policy Management
 
7 pts
10Security Culture & Training
 
6 pts
Resilience
10 cat
Resilience Maturity Assessment
What happens when something fails, and whether recovery has ever been proven.
Maturity Scale
L1
Basic
0–20
L2
Improved
21–40
L3
Enhanced
41–60
L4
Advanced
61–80
L5
Optimized
81–100
Categories · Weight Out of 100
01High Availability & Redundancy
 
17 pts
02Disaster Recovery (DR) Strategy
 
15 pts
03Backup & Data Protection
 
11 pts
04Recovery Objectives (RPO/RTO)
 
10 pts
05Monitoring, Alerting & Health Checks
 
11 pts
06Scalability & Capacity Planning
 
10 pts
07Chaos Engineering & Resilience Testing
 
9 pts
08Incident Management & Response
 
7 pts
09SLA/SLO Management
 
5 pts
10Documentation, Training & Business Continuity
 
5 pts
Architecture
10 cat
Architecture Maturity Assessment
How systems are decomposed, integrated and governed as they grow.
Maturity Scale
L1
Consolidated
0–20
L2
Modular
21–40
L3
Component-Based
41–60
L4
Distributed
61–80
L5
Domain-Driven
81–100
Categories · Weight Out of 100
01Architecture Style & Modularity
 
14 pts
02API Management
 
10 pts
03Communication Patterns
 
8 pts
04Service Integration & Discovery
 
6 pts
05Data Management & Persistence
 
10 pts
06Scalability
 
8 pts
07Distributed Systems & Containerization
 
17 pts
08Domain-Driven Design (DDD) Practices
 
14 pts
09Technology Stack & Dependency Management
 
5 pts
10Governance, Documentation & Design Standards
 
8 pts
Developer Experience
10 cat
Developer Experience Maturity Assessment
The friction between an engineer having an idea and shipping it safely.
Maturity Scale
L1
Basic
0–20
L2
Streamlined
21–40
L3
Self-Service
41–60
L4
Developer-Centric
61–80
L5
Industry-Leading
81–100
Categories · Weight Out of 100
01Development Environment & Setup
 
11 pts
02CI/CD & Build Automation
 
14 pts
03Code Quality & Static Analysis
 
9 pts
04Documentation & Knowledge Base
 
13 pts
05Developer Self-Service & Autonomy
 
11 pts
06Developer Productivity & Workflow Optimization
 
14 pts
07Collaboration & Code Review
 
7 pts
08Security Integration & Secure Coding
 
9 pts
09Dependency & Compliance Management
 
7 pts
10Innovation & Continuous Learning
 
5 pts
Platform
10 cat
Platform Engineering Maturity Assessment
Infrastructure as a product: how much teams can do for themselves, safely.
Maturity Scale
L1
Basic IaC
0–20
L2
Automated Pipeline
21–40
L3
Self-Service
41–60
L4
Advanced Automation
61–80
L5
Intelligent Optimization
81–100
Categories · Weight Out of 100
01Infrastructure as Code (IaC) Foundation
 
13 pts
02CI/CD Pipeline & Automation
 
14 pts
03State & Secret Management
 
8 pts
04Security & Compliance
 
14 pts
05Self-Service & Internal Developer Platform (IDP)
 
13 pts
06Access Control & Governance
 
9 pts
07Testing & Quality Assurance
 
8 pts
08Observability & Monitoring
 
8 pts
09Cost Management & Optimization
 
7 pts
10AI Assistance & Intelligent Automation
 
6 pts
AI
10 cat
AI Readiness & Maturity Assessment
Whether AI work is grounded in usable data, real use cases and governance.
Maturity Scale
L1
AI-Unaware
0–20
L2
AI-Exploring
21–40
L3
AI-Adopting
41–60
L4
AI-Scaling
61–80
L5
AI-Native
81–100
Categories · Weight Out of 100
01Organizational AI Maturity & Strategy
 
12 pts
02AI Use-Case Identification & Business Value
 
10 pts
03AI Roadmap & Program Management
 
9 pts
04Data Readiness for AI
 
11 pts
05AI Integration & Architecture
 
10 pts
06AI Providers & Infrastructure (Cloud & On-Premise/Air-Gapped)
 
10 pts
07MLOps & Model Lifecycle Management
 
11 pts
08Responsible AI & Governance
 
11 pts
09AI Security & Privacy
 
8 pts
10AI Talent, Culture & Enablement
 
8 pts
Observability Maturity Assessment
Whether the state of production can be seen, explained and predicted without guesswork.
Maturity Scale
L1
Initial
0–20
L2
Basic
21–40
L3
Managed
41–60
L4
Defined
61–80
L5
Advanced
81–100
Categories · Weight Out of 100
01APM & Distributed Tracing
 
12 pts
02Centralized Logging
 
12 pts
03Metrics Collection & Monitoring
 
14 pts
04Alerting & Incident Management
 
14 pts
05Dashboards & Visualization
 
7 pts
06End-User Monitoring
 
7 pts
07Error Tracking & Root Cause Analysis
 
8 pts
08Anomaly Detection & Predictive Analytics
 
9 pts
09Capacity Management & Optimization
 
8 pts
10Integration, Compliance & Knowledge Management
 
9 pts
DevOps Excellence Maturity Assessment
How code reaches production: automation, repeatability and the speed of feedback.
Maturity Scale
L1
Basic
0–20
L2
Standardized
21–40
L3
Automated
41–60
L4
Optimized
61–80
L5
Innovative
81–100
Categories · Weight Out of 100
01Version Control & Code Management
 
11 pts
02Local Development Environment
 
10 pts
03Pre-Commit Hooks & Code Quality
 
7 pts
04Build & Continuous Integration (CI)
 
10 pts
05Deployment & Continuous Delivery (CD)
 
10 pts
06Testing & Quality Assurance
 
13 pts
07Artifact & Dependency Management
 
7 pts
08Database DevOps
 
8 pts
09Deployment Strategies & Release Management
 
14 pts
10Monitoring, Feedback & Advanced Practices
 
10 pts
FinOps Maturity Assessment
Whether cloud spend is visible, owned by the teams that create it, and acted on.
Maturity Scale
L1
Foundational
0–20
L2
Standardized
21–40
L3
Established
41–60
L4
Optimized
61–80
L5
Strategic
81–100
Categories · Weight Out of 100
01Cost Visibility & Reporting
 
14 pts
02Cost Allocation & Tagging
 
11 pts
03Budgeting & Forecasting
 
11 pts
04Cost Optimization & Efficiency
 
16 pts
05Chargeback/Showback Models
 
9 pts
06FinOps Culture & Awareness
 
9 pts
07Governance & Policy Enforcement
 
9 pts
08Cross-Functional Collaboration
 
7 pts
09KPIs & Business Alignment
 
7 pts
10Advanced Practices & Innovation
 
7 pts
Security Maturity Assessment
Identity, application and cloud security as practised day to day, not as written policy.
Maturity Scale
L1
Foundational
0–20
L2
Managed
21–40
L3
Defined
41–60
L4
Advanced
61–80
L5
Optimized
81–100
Categories · Weight Out of 100
01Identity & Access Management (IAM)
 
12 pts
02Vulnerability & Patch Management
 
13 pts
03Application Security
 
15 pts
04Data Protection & Encryption
 
10 pts
05Network Security
 
8 pts
06Security Monitoring & Incident Response
 
13 pts
07Cloud & Container Security
 
8 pts
08Security Testing & Validation
 
8 pts
09Compliance & Policy Management
 
7 pts
10Security Culture & Training
 
6 pts
Resilience Maturity Assessment
What happens when something fails, and whether recovery has ever been proven.
Maturity Scale
L1
Basic
0–20
L2
Improved
21–40
L3
Enhanced
41–60
L4
Advanced
61–80
L5
Optimized
81–100
Categories · Weight Out of 100
01High Availability & Redundancy
 
17 pts
02Disaster Recovery (DR) Strategy
 
15 pts
03Backup & Data Protection
 
11 pts
04Recovery Objectives (RPO/RTO)
 
10 pts
05Monitoring, Alerting & Health Checks
 
11 pts
06Scalability & Capacity Planning
 
10 pts
07Chaos Engineering & Resilience Testing
 
9 pts
08Incident Management & Response
 
7 pts
09SLA/SLO Management
 
5 pts
10Documentation, Training & Business Continuity
 
5 pts
Architecture Maturity Assessment
How systems are decomposed, integrated and governed as they grow.
Maturity Scale
L1
Consolidated
0–20
L2
Modular
21–40
L3
Component-Based
41–60
L4
Distributed
61–80
L5
Domain-Driven
81–100
Categories · Weight Out of 100
01Architecture Style & Modularity
 
14 pts
02API Management
 
10 pts
03Communication Patterns
 
8 pts
04Service Integration & Discovery
 
6 pts
05Data Management & Persistence
 
10 pts
06Scalability
 
8 pts
07Distributed Systems & Containerization
 
17 pts
08Domain-Driven Design (DDD) Practices
 
14 pts
09Technology Stack & Dependency Management
 
5 pts
10Governance, Documentation & Design Standards
 
8 pts
Developer Experience Maturity Assessment
The friction between an engineer having an idea and shipping it safely.
Maturity Scale
L1
Basic
0–20
L2
Streamlined
21–40
L3
Self-Service
41–60
L4
Developer-Centric
61–80
L5
Industry-Leading
81–100
Categories · Weight Out of 100
01Development Environment & Setup
 
11 pts
02CI/CD & Build Automation
 
14 pts
03Code Quality & Static Analysis
 
9 pts
04Documentation & Knowledge Base
 
13 pts
05Developer Self-Service & Autonomy
 
11 pts
06Developer Productivity & Workflow Optimization
 
14 pts
07Collaboration & Code Review
 
7 pts
08Security Integration & Secure Coding
 
9 pts
09Dependency & Compliance Management
 
7 pts
10Innovation & Continuous Learning
 
5 pts
Platform Engineering Maturity Assessment
Infrastructure as a product: how much teams can do for themselves, safely.
Maturity Scale
L1
Basic IaC
0–20
L2
Automated Pipeline
21–40
L3
Self-Service
41–60
L4
Advanced Automation
61–80
L5
Intelligent Optimization
81–100
Categories · Weight Out of 100
01Infrastructure as Code (IaC) Foundation
 
13 pts
02CI/CD Pipeline & Automation
 
14 pts
03State & Secret Management
 
8 pts
04Security & Compliance
 
14 pts
05Self-Service & Internal Developer Platform (IDP)
 
13 pts
06Access Control & Governance
 
9 pts
07Testing & Quality Assurance
 
8 pts
08Observability & Monitoring
 
8 pts
09Cost Management & Optimization
 
7 pts
10AI Assistance & Intelligent Automation
 
6 pts
AI Readiness & Maturity Assessment
Whether AI work is grounded in usable data, real use cases and governance.
Maturity Scale
L1
AI-Unaware
0–20
L2
AI-Exploring
21–40
L3
AI-Adopting
41–60
L4
AI-Scaling
61–80
L5
AI-Native
81–100
Categories · Weight Out of 100
01Organizational AI Maturity & Strategy
 
12 pts
02AI Use-Case Identification & Business Value
 
10 pts
03AI Roadmap & Program Management
 
9 pts
04Data Readiness for AI
 
11 pts
05AI Integration & Architecture
 
10 pts
06AI Providers & Infrastructure (Cloud & On-Premise/Air-Gapped)
 
10 pts
07MLOps & Model Lifecycle Management
 
11 pts
08Responsible AI & Governance
 
11 pts
09AI Security & Privacy
 
8 pts
10AI Talent, Culture & Enablement
 
8 pts
How Scoring Works

Build AI Into Your Delivery

01 · Criteria are checked

Each category holds four to nine yes/no criteria, reviewed against evidence rather than opinion.

02 · A scoring band is assigned

Four bands per category describe practice as it actually is, from absent to fully implemented. The band sets the points.

03 · Points roll up to the pillar

Ten weighted categories total 100 points, which maps to one of five maturity levels. Weights differ by pillar, so scores are comparable across teams and over time.

Worked Example  ·  Observability

APM & Distributed Tracing

12 pts
0 No APM solution in place
4 Basic APM without distributed tracing
8 Distributed tracing partially implemented
12 Full distributed tracing with end-to-end visibility
Criteria Behind The Band
  • Is an APM solution deployed?
  • Is distributed tracing capability active?
  • Are all services traceable?
  • Can transaction flows be visualized end-to-end?
  • Are performance bottlenecks easily identified?
The Engagement

How We Run an Assessment

Our engagement follows AWS Migration Acceleration Program phases, extended with modernization sprints.

01 · Scope

Pick The Pillars

We agree which disciplines are in scope and which teams and systems each one covers.

02 · Workshop

Walk The Criteria

Half a day per pillar with the engineers who own the systems, going through criteria one by one.

03 · Score

Band With Evidence

Every category gets a band and a note on what backs it. Nothing is scored without a reference.

04 · Gaps

Order What Is Missing

Unmet criteria are ranked by the points they carry and the effort they take.

05 · Roadmap

Plan And Re-Assess

A sequenced plan for the next two to four quarters, re-scored after delivery to measure movement.

Deliverables

What You Get

Written up so it can be shared with engineering and with the board without translation.

Maturity Scorecard

A score out of 100 and a level L1–L5 for every pillar in scope, on one page.

Category Breakdown

All 90 categories with the band assigned, the evidence, and the points lost.

Prioritised Gap List

Unmet criteria ranked by score impact against implementation effort.

Roadmap And Baseline

A sequenced improvement plan, plus the frozen baseline to re-assess against.

Self-Assessment

Try a Short Version Yourself

Explore and assess your capabilities through our Self-Assessment forms, mirroring the evaluations we've performed. Take advantage of these tools to gauge your strengths and areas for improvement.

DevOps

Pipeline, delivery and release practice.

Open form →

QA

Test automation, coverage and quality gates.

Open form →

GenAI Maturity

Readiness, data and governance for AI work.

Open form →

Start With One Pillar And a Workshop

Tell us which discipline is under pressure. We will run the assessment for it and come back with the score, the gaps and the plan.

Talk To Kloia Download KAF 4.0

FAQ

Who is KAF built for?

Engineering leaders, mainly VPs of Engineering, CTOs and Heads of Platform, who need a defensible answer to how mature their organisation is, not a gut-feel opinion.

How long does an assessment take?

A single pillar workshop typically runs one to two weeks from kickoff to scored report. A full nine-pillar engagement usually takes four to six weeks, depending on team availability.

Do we have to assess all nine pillars at once?

No. Most engagements start with one or two pillars under the most pressure, such as Observability or Security, and expand from there once the format proves useful.

What's the difference between the self-assessment and a full engagement?

The self-assessment gives your team a quick, internal directional score. A full engagement is run by our consultants, includes interviews with the teams who own the systems, and produces a validated score plus a prioritised roadmap.

Who from our side needs to be involved?

Typically the engineering leader sponsoring the assessment, plus the tech leads or team owners closest to the pillar in question. Most sessions run 60 to 90 minutes per team.

How is the score calculated?

Each pillar has a fixed set of weighted criteria, reviewed against evidence from the teams who run the systems, not self-reported opinion. Weights are published in the framework spec so the score is reproducible and auditable.

What do we walk away with?

A maturity level per pillar, the specific gaps behind that score, and a roadmap ordered by what will move the number fastest, so the output is something you can act on the same week.

Let's Work Together

We are happy to help you transform your DevOps infrastructure and accelerate your delivery pipeline.

18 /* Editable text styling inside the boxes */ 19 .tool-box span[contenteditable="true"] { 20 display: inline-block; 21 outline: none; 22 color: #ffffff; 23 font-size: 1rem; 24 font-weight: 500; 25 text-align: left; 26 white-space: nowrap; /* Prevents text from wrapping while editing */ 27 } 28 29 298 ​ 299