Scoring guide

1. Data Strategy & Business Alignment

Vision, prioritization, executive ownership, and measurable value from data investments.

2. Data Governance & Operating Model

Framework, decision rights, accountability, and measured governance effectiveness.

3. Data Architecture & Integration

Current/target architecture, standards, authoritative sources, and technical debt.

4. Data Quality

Critical data elements, measured dimensions, rules, remediation, and reporting.

5. Master & Reference Data Management

Domains, authoritative sources, resolution, hierarchies, and trusted distribution.

6. Metadata, Catalog & Lineage

Catalog, business and technical metadata, lineage, automation, and discoverability.

7. Data Security, Privacy & Lifecycle

Classification, access control, protection, retention, and demonstrable compliance.

8. Analytics, BI & Semantic Management

Governed KPIs, semantic models, self-service, product lifecycle, and adoption.

9. Data Engineering, Platforms & Operations

Engineering standards, environments, CI/CD, observability, and platform resilience.

10. Data Culture, Literacy & AI Readiness

Literacy, data-driven decisions, and readiness of data for AI and agentic use cases.

1. Enterprise Architecture Strategy & Business Alignment

Documented EA strategy, business outcome linkage, target state, and investment roadmaps.

2. Architecture Governance & Decision Rights

Principles, decision rights, review bodies, exceptions, and measured governance effectiveness.

3. Business Architecture

Capability maps, value streams, gap analysis, and operating-model guidance.

4. Data & Information Architecture

Information architecture, authoritative sources, canonical models, and analytics/AI enablement.

5. Application & Solution Architecture

Application portfolio, solution standards, rationalization, and buy-versus-build governance.

6. Integration & Interoperability Architecture

API, event, and messaging standards with reusable services and governed interfaces.

7. Technology, Infrastructure & Cloud Architecture

Current/target technology architecture, cloud patterns, resilience, and lifecycle roadmaps.

8. Security, Risk & Resilience Architecture

Security-by-design patterns, risk evaluation, threat modeling, and remediation governance.

9. Architecture Portfolio, Standards & Lifecycle Management

Architecture repository, standards lifecycle, technical debt, and portfolio health metrics.

10. Architecture Operating Model, Talent & Transformation Enablement

Architecture roles, skills, collaboration, delivery integration, and measured EA value.

1. Data Quality Strategy & Governance

Approved strategy, policy, executive oversight, funding, and measured program delivery.

2. Ownership & Stewardship

Named owners and stewards with authority, cross-boundary accountability, and training.

3. Standards, Dimensions & Rules

Dimensions, critical data elements, business-readable rules, and calibrated thresholds.

4. Data Profiling & Assessment

Profiling coverage, baselines, SME validation, and quantified impact from findings.

5. Preventive Controls & Validation

Entry validation, in-pipeline controls, change control, quarantine, and release gates.

6. Monitoring, Metrics & Reporting

Scorecards, rule-linked metrics, detection frequency, dashboards, and alerting.

7. Issue Management & Root Cause

Single intake, consistent classification, tracked ownership, and root-cause discipline.

8. Remediation & Data Correction

Prioritized fixes, controlled corrections, upstream repair, and post-fix validation.

9. Metadata, Lineage & Data Lifecycle

Rule-to-metadata linkage, lineage impact analysis, lifecycle, and third-party data terms.

10. Technology, Automation & Continuous Improvement

Tooling, versioned rules, governed automation and AI, adoption, and improvement loops.

1. Governance Strategy & Business Alignment

Documented strategy, measurable outcomes, executive understanding, and a funded roadmap.

2. Governance Operating Model

Defined operating model, council cadence, escalation paths, and clear decision scope.

3. Leadership, Accountability & Stewardship

Sponsors, owners, stewards, shared accountability, and current role assignments.

4. Policies, Standards & Controls

Approved policies, implementable standards, embedded controls, exceptions, and enforcement.

5. Data Domains & Critical Data

Defined domains, identified critical data elements, and value/risk-based prioritization.

6. Metadata, Definitions & Data Lineage

Business glossary, term-to-data linkage, technical metadata, and end-to-end lineage.

7. Data Quality Governance

Quality rules for critical data, consistent dimensions, issue workflow, and reporting.

8. Privacy, Security, Risk & Compliance

Classification, least-privilege access, cross-functional alignment, retention, and risk.

9. Data Lifecycle, Architecture & Technology

Lifecycle governance, pre-implementation review, architecture standards, and tooling.

10. Adoption, Measurement & Continuous Improvement

Role-based education, change management, KPIs, and continuous improvement loops.

1. Cybersecurity Governance & Strategy

Govern — strategy, policy, accountability, executive oversight, and measurable security objectives.

2. Cybersecurity Risk & Compliance Management

Govern / Identify — risk process, ERM integration, regulatory mapping, and remediation tracking.

3. Asset, Configuration & Vulnerability Management

Identify — asset inventory, classification, secure baselines, and vulnerability remediation.

4. Identity & Access Management

Protect — centralized identity, least privilege, MFA, lifecycle access, and privileged controls.

5. Data Security & Privacy Protection

Protect — data classification, encryption, access enforcement, DLP, and privacy safeguards.

6. Infrastructure, Endpoint, Cloud & Application Security

Protect — endpoint, network, cloud, and application controls plus Zero Trust security architecture.

7. Security Monitoring, Detection & Threat Management

Detect — centralized logging, detection engineering, threat intelligence, and coverage.

8. Incident Response & Cyber Crisis Management

Respond — response plan, incident handling, exercises, communications, and lessons learned.

9. Business Continuity, Resilience & Disaster Recovery

Recover — service prioritization, RTO/RPO, immutable tested backups, and cyber resilience.

10. Third-Party, Human & Emerging Technology Security

Govern / Protect — third-party risk, contractual assurance, workforce awareness, and emerging technology risk.

1. AI Strategy, Portfolio & Business Value

Approved AI strategy, governed use-case portfolio, value metrics, and funding cadence.

2. Governance, Risk & Responsible AI

AI policies, system inventory, risk assessment, accountability, and responsible-AI controls.

3. Data, Knowledge & RAG Readiness

Governed sources, curated knowledge, standardized RAG practices, and traceability.

4. Model / LLM Selection, Engineering & Evaluation

Model selection criteria, versioned prompts, evaluation suites, and adversarial testing.

5. AI Architecture, Integration & Platform

Reference architecture, reusable patterns, environment controls, integration, and FinOps.

6. Security, Privacy & Resilience

Threat modeling, sensitive-data protection, least privilege, guardrails, and resilience.

7. Use-Case Delivery, Human Oversight & Agentic AI

Product ownership, governed pilots, human oversight, agent boundaries, and process redesign.

8. LLMOps, Monitoring & Incident Management

Versioning, production telemetry, drift and safety monitoring, incidents, and retirement.

9. Vendor, Legal & Third-Party Management

Provider due diligence, IP and licensing, regulatory mapping, portability, and change monitoring.

10. Workforce, Adoption & Continuous Improvement

AI literacy, specialized skills, embedded adoption, behavioral metrics, and improvement loops.

1. Governance & Strategic Alignment

Strategy-linked intake and prioritization, sponsor accountability, portfolio oversight, and stop/pivot discipline.

2. Integration & Lifecycle Management

Approved charters, integrated plans, stage gates, integrated change control, and formal closure.

3. Scope & Requirements Management

Documented outcomes and acceptance criteria, requirements validation, decomposition, traceability, and scope control.

4. Schedule & Dependency Management

Dependency-based schedules, defensible estimates, critical-path management, and objective progress measurement.

5. Cost & Financial Management

Complete budgets, documented estimates, baseline variance tracking, and value/TCO reassessment.

6. Resource & Team Management

Capacity and skills planning, confirmed commitments, RACI accountability, and knowledge transfer.

7. Risk, Issue & Change Management

Consistent risk scoring and ownership, actionable responses, issue escalation, and portfolio trend analysis.

8. Quality & Assurance

Defined quality measures, assurance and testing controls, root-cause analysis, and independent reviews.

9. Stakeholder & Communications Management

Stakeholder mapping, planned communications, forecast-based status reporting, feedback, and escalation paths.

10. Delivery, Adoption & Benefits Realization

Tailored delivery, operational readiness, adoption and change management, benefit ownership, and post-implementation review.

1. Strategy & Business Alignment

Business rationale, prioritized use cases, funded roadmap, measured benefits, and executive sponsorship.

2. Governance & Operating Model

Decision rights, governance forums, role accountability, enforced standards, and controlled federation.

3. Ontology Architecture & Modeling

Modeling principles, consistent method, shared upper concepts, governed identifiers, and modular design.

4. Vocabulary & Taxonomy Management

Authoritative controlled vocabularies, precise definitions, taxonomy design, term reconciliation, and localization.

5. Lifecycle & Change Management

Documented lifecycle, versioning, downstream impact analysis, repeatable releases, and managed deprecation.

6. Technology, Tools & Repository

Modeling tools, governed repository, query and reasoning support, automated pipelines, and platform resilience.

7. Integration & Interoperability

Semantic standards, governed mappings, semantically aligned contracts, external ontology reuse, and metadata ecosystem links.

8. Quality, Validation & Testing

Quality criteria, automated validation, competency-question testing, instance conformance, and independent review.

9. Security, Privacy & Compliance

Least-privilege access, sensitive concept protection, provenance, regulatory obligations, and inference risk control.

10. Adoption, Skills & Operations

Role-based enablement, active community, discoverability, operational monitoring, and grounded AI/knowledge-graph use.

1. Vendor Strategy & Governance

Documented strategy, policies, decision rights, executive accountability, vendor inventory, and measured outcomes.

2. Vendor Selection & Due Diligence

Documented requirements, consistent evaluation, due diligence validation, dependency risk, and defensible decisions.

3. Contract & Commercial Management

Standardized terms, clear obligations, lifecycle tracking, controlled changes, and value review before renewal.

4. Vendor Onboarding & Integration

Standard onboarding, documented operating expectations, controlled access provisioning, education, and verified readiness.

5. Performance & Service Level Management

Defined service levels, regular reviews, issue tracking, root-cause analysis, and performance-driven action.

6. Vendor Risk & Compliance

Risk tiering, periodic reassessment, compliance obligations, owned remediation, and consolidated risk reporting.

7. Third-Party Cybersecurity & Data Protection

Security requirements by sensitivity, assurance evidence, contractual controls, posture monitoring, and access revocation.

8. Relationship & Strategic Value Management

Relationship ownership, business reviews, segmented governance, innovation, and measured relationship health.

9. Financial Management & Optimization

Spend visibility, invoice validation, optimization analysis, fact-based negotiation, and measured savings.

10. Renewal, Exit & Continuity Management

Advance renewals, evidence-based decisions, exit and continuity planning, dependency analysis, and complete offboarding.

1. CI/CD Strategy & Governance

Documented strategy, defined standards, clear ownership, value-based prioritization, and measured governance adoption.

2. Source Control & Branching

Everything in version control, defined branching, mandatory peer review, governed repository controls, and short-lived branches.

3. Continuous Integration & Build Automation

Automatic build triggers, portable scripted builds, fast failure response, reproducible toolchains, and monitored build health.

4. Automated Testing & Quality Gates

Automated unit and higher-level tests, enforced quality gates, automated test data and environments, and test effectiveness tracking.

5. Security & Compliance Integration

Shift-left security in pipelines, automated scanning, vulnerability detection, blocking policy gates, and audit-ready evidence.

6. Artifact & Dependency Management

Versioned artifact repositories, immutable promotion, managed dependencies, provenance and signing, and end-to-end traceability.

7. Continuous Delivery & Deployment

Automated non-production and production deployments, standardized release controls, progressive delivery, and reliable rollback.

8. Environment & Infrastructure Management

Automated provisioning, infrastructure as code, version-controlled configuration, drift remediation, and rapid environment refresh.

9. Observability, Metrics & Feedback

Deployment-linked monitoring, change attribution, DORA metrics, bottleneck analysis, and production feedback loops.

10. Platform Engineering & Continuous Improvement

Golden paths and reusable templates, platform-as-product management, low-friction onboarding, measured DX, and continuous improvement.

1. Vision & Strategic Alignment

Documented strategy, executive vision, translation of objectives, refresh cadence, and shared understanding.

2. Business Value & Outcomes

Outcome-based selection, value hypotheses, traceability, pre-approval benefits, and realized-value measurement.

3. Data Operating Model & Governance

Decision rights, ownership and stewardship, centralization model, policy alignment, and cross-functional forums.

4. Data Domain & Product Strategy

Priority domains, defined owners and sources, data products, consumer-driven priorities, and cross-boundary governance.

5. Data Architecture & Platform Strategy

Target-state architecture, principle-led platform choices, complexity reduction, and non-functional fit.

6. Data Governance, Quality & Trust Strategy

Risk-based governance focus, critical data elements, metadata and lineage, regulatory integration, and trust metrics.

7. Analytics, AI & Decision Intelligence Strategy

Decision-support strategy, prioritization criteria, advanced use cases, responsible AI foundations, and workflow embedding.

8. Data Literacy, Talent & Culture

Required skills and roles, leadership reinforcement, persona-based literacy, gap closure, and supportive norms.

9. Investment, Funding & Value Management

Portfolio management, reuse-aware funding, cost transparency, sponsorship, and disciplined stop/redirect decisions.

10. Roadmap, Execution & Performance Measurement

Sequenced multi-horizon roadmap, balanced value delivery, target maturity, executive review, and adaptive replanning.

1. Strategy, Principles & Governance Model

Documented governance strategy, approved responsible AI principles, operating model, enterprise integration, and policy refresh cadence.

2. Roles, Accountability & Oversight

Executive sponsorship, defined cross-functional roles, an empowered governance body, human oversight duties, and enforceable accountability.

3. AI Use Case Intake, Inventory & Classification

Standardized intake, complete AI inventory, risk classification, recorded system attributes, and reassessment of material changes.

4. Risk Management & Impact Assessment

Pre-deployment risk assessment, impact analysis, tiered acceptance thresholds, enterprise risk integration, and enhanced review of high-risk systems.

5. Data Governance, Privacy & Security

Governed training and grounding data, privacy assessment, disclosure controls, AI-specific security threats, and retention/audit requirements.

6. Model Development, Validation & Documentation

Development and release standards, proportionate validation, documented limitations, dataset suitability, and version/prompt traceability.

7. Fairness, Transparency & Explainability

Bias assessment, contextual fairness thresholds, meaningful explanations, AI interaction disclosure, and attributable outputs.

8. Third-Party, Vendor & Foundation Model Governance

Vendor and foundation model due diligence, AI contract terms, documentation review, change monitoring, and exit planning.

9. Deployment, Human Oversight & Operational Controls

Deployment approvals and access control, calibrated human oversight, user guidance, deterministic safeguards, and rapid shutdown capability.

10. Monitoring, Incident Management & Continuous Assurance

Continuous monitoring, defined key risk indicators, AI incident management, control testing, and feedback-driven improvement.

1. Strategy & Business Alignment

Whether analytics and BI investments are anchored in enterprise strategy, business cases, and a managed portfolio of outcomes.

2. Governance & Operating Model

Decision rights, roles, standards, and operating-model discipline for approving, prioritizing, and running analytics products.

3. Data Foundations & Semantic Layer

The governed data foundations — authoritative sources, shared definitions, semantic models, lineage, and metadata — that analytics depends on.

4. Data Quality & Trust

Data quality requirements, automated monitoring, certification, incident handling, and stakeholder trust in analytics.

5. BI Delivery & Visualization

How effectively dashboards and reports are designed, standardized, contextualized, rationalized, and tested for decision-making.

6. Self-Service Analytics & Adoption

Governed self-service access, enablement, adoption telemetry, and community mechanisms that scale analytics across the business.

7. Advanced Analytics & AI

Use of statistical, predictive, prescriptive, and AI-driven analytics, from use-case prioritization to model monitoring and workflow integration.

8. Platform Architecture & Engineering

The architecture, pipelines, environments, CI/CD practices, and performance management behind the analytics platform.

9. Security, Privacy & Compliance

Access controls, sensitive-data protection, audit logging, and compliance of analytics and BI practices.

10. Value Management & Continuous Improvement

Measurement of analytics delivery, adoption, realized benefits, feedback loops, and reinvestment decisions.

1. APM Strategy & Governance

Documented APM strategy, executive sponsorship, governance body, portfolio entry/exit policies, and measured objectives.

2. Application Inventory & Repository

Centralized application inventory, clear ownership, complete attributes, repeatable maintenance, and reconciliation with authoritative sources.

3. Business Alignment & Capability Mapping

Application-to-capability mapping, strategic differentiation, business stakeholder evaluation, and gap/overlap visibility.

4. Application Health & Technical Fitness

Consistent technical health criteria, quantified technical debt, end-of-life tracking, architecture standards, and refreshed assessments.

5. Business Value & Functional Fitness

Business value and functional fit evaluation, adoption and satisfaction signals, duplication analysis, and value-driven portfolio actions.

6. Cost, Financial & Vendor Management

Application TCO visibility, cost allocation, license/SaaS optimization, vendor risk exposure, and value-based investment decisions.

7. Lifecycle & Technology Currency

Explicit lifecycle statuses, technology currency monitoring, modernization horizons, budget integration, and prevention of transitional apps becoming permanent.

8. Rationalization & Modernization

Repeatable rationalization framework, redundancy evidence, migration complexity analysis, accountable retirements, and tracked benefits.

9. Risk, Security & Compliance

Security, privacy, regulatory, and resilience risk in portfolio decisions, sensitive-data identification, continuity requirements, and linked findings.

10. Integration, Data & Dependency Management

Documented integrations and data flows, dependency-aware change decisions, coupling analysis, and roadmap sequencing.

1. Business Architecture Governance & Operating Model

Formal charter, executive sponsorship, roles and decision rights, governance integration, and consistent modeling standards.

2. Business Capability Management

Enterprise capability map, definitions and ownership, heatmaps, assessment measures, and use in investment and sourcing decisions.

3. Value Streams & Customer Value

End-to-end value stream documentation, capability mapping, measurable outcomes, customer journey linkage, and prioritization.

4. Business Process Architecture

Process taxonomy, capability mapping, ownership, performance and control gap analysis, and operating model improvement.

5. Strategy-to-Execution Alignment

Strategy-to-capability mapping, transformation requirements, initiative alignment, gap visibility, and executive planning integration.

6. Operating Model & Organization Architecture

Current and target operating models, organization-role alignment, decision rights, and operating-model option evaluation.

7. Information & Business Concept Architecture

Shared business vocabulary, business concept mapping, semantic reconciliation, and alignment with data architecture.

8. Initiative, Portfolio & Investment Alignment

Initiative mapping, portfolio investment analysis, prioritization evidence, cross-functional impact assessment, and sequencing.

9. Business Architecture Integration & Traceability

EA/DA/AA/TA integration, end-to-end traceability, relationship-based repositories, impact analysis, and shared architecture views.

10. Measurement, Maturity & Continuous Improvement

Effectiveness KPIs, maturity assessment, artifact lifecycle management, lessons learned, and continuous evolution.

1. Cloud Strategy & Governance

Cloud vision and strategy, executive sponsorship, governance bodies, policy, and alignment of cloud adoption with business outcomes.

2. Cloud Platform & Landing Zones

Cloud platform foundations, landing zone design, account/subscription structure, guardrails, and multi-environment provisioning.

3. Security, Identity & Compliance

Cloud security posture, identity and access management, compliance controls, policy enforcement, and regulatory alignment.

4. Network & Connectivity Enablement

Hybrid and cloud networking, connectivity patterns, segmentation, DNS, and performance across on-premises and cloud environments.

5. Infrastructure Automation & DevSecOps

Infrastructure as Code, CI/CD pipelines, DevSecOps practices, automated testing, and policy-as-code for cloud delivery.

6. Cloud Financial Management (FinOps)

Cloud cost visibility, budgeting and forecasting, allocation and showback/chargeback, optimization, and FinOps operating practices.

7. Cloud Operations, Reliability & Resilience

Cloud operations, monitoring and observability, incident management, reliability engineering, backup, and disaster recovery.

8. Migration & Application Modernization

Migration assessment and planning, workload disposition, modernization patterns, execution, and post-migration validation.

9. Cloud Data & Service Enablement

Cloud data platforms, managed service adoption, integration, data lifecycle management, and self-service enablement.

10. Operating Model, Skills & Adoption

Cloud operating model, roles and skills, training and certification, adoption support, and organizational change management.

1. Strategy & Architecture Principles

The documented strategy, principles, and target state that align data architecture to business, technology, and transformation priorities.

2. Business & Data Domain Architecture

Enterprise data domains, ownership, conceptual models, and cross-domain dependencies that structure accountability and solution design.

3. Data Modeling & Standards

Standards for conceptual, logical, and physical data modeling, naming, canonical models, and lifecycle maintenance.

4. Data Integration & Interoperability

Architected batch, real-time, event-driven, API, and streaming integration patterns with managed contracts and reusable services.

5. Data Platform & Storage Architecture

Intentional design of operational, analytical, lakehouse, warehouse, and specialized stores across cloud, on-premises, and hybrid estates.

6. Master & Reference Data Architecture

Identification, authoritative sourcing, identity resolution, and governed distribution of master and reference data.

7. Metadata, Catalog & Lineage Architecture

Enterprise metadata architecture, cataloging, automated lineage, and active use of metadata for impact analysis and discovery.

8. Data Security, Privacy & Compliance Architecture

Classification-driven access, encryption, masking, privacy-by-design, and compliance controls embedded in data architecture.

9. Data Quality & Observability Architecture

Data quality controls and observability designed into pipelines and platforms, with owned remediation and structural root-cause removal.

10. Lifecycle, Governance & Architecture Operations

Retention and disposal patterns, standards enforcement, deviation management, technical debt visibility, and effectiveness reporting.

1. Strategy & Business Alignment

Assesses whether agentic AI ambitions are anchored in a documented enterprise strategy, prioritized by value and risk, sponsored by executives, and measured against business outcomes.

2. Use Case & Process Readiness

Evaluates how systematically the organization selects, scopes, and documents processes and use cases that are genuinely suitable for agent automation.

3. Data & Knowledge Readiness

Examines whether the data, knowledge, metadata, and retrieval foundations are trustworthy, governed, and ready to support agent reasoning and action.

4. Agent Architecture & Orchestration

Assesses the maturity of agent architecture patterns, orchestration design, deterministic controls, and documented architectural decision-making.

5. Tools, Integration & Interoperability

Evaluates whether agents interact with enterprise systems through governed, tested, and monitored tool and integration interfaces.

6. Governance, Risk & Responsible AI

Examines governance policies, risk tiering, agent risk evaluation, and the ability to suspend or retire agents that behave unacceptably.

7. Security, Identity & Access

Assesses agent identity, least-privilege access, credential management, defense against agentic attack vectors, and auditability of agent actions.

8. Human Oversight & Operating Model

Evaluates human oversight requirements, workforce readiness, cross-functional accountability, and incident and exception operating procedures.

9. Evaluation, Observability & Reliability

Examines pre-deployment evaluation, production performance monitoring, trace observability, regression testing, and reliability engineering for agents.

10. Platform, Deployment & Lifecycle Management

Assesses the engineering platform, environment separation, change management, production monitoring, and end-to-end lifecycle processes for agentic AI.

1. Metadata Strategy & Governance

How the organization plans, funds, governs, and measures metadata management as a strategic enterprise capability.

2. Business Metadata & Glossary

Governed business definitions, glossary management, ownership, and linkage to data assets and business concepts.

3. Technical Metadata Management

Systematic capture and maintenance of technical metadata for data assets, schemas, transformations, and platforms.

4. Operational Metadata & Observability

Capture and use of operational metadata to monitor pipeline health, data reliability, and platform performance.

5. Data Catalog & Discovery

Searchable inventory and catalog of enterprise data assets with sufficient context to support discovery and trust.

6. Data Lineage & Impact Analysis

End-to-end lineage capture, impact analysis, and use of lineage for change, incident, audit, and modernization scenarios.

7. Classification, Taxonomy & Semantic Standards

Controlled vocabularies, classifications, taxonomies, and semantic standards applied consistently across assets.

8. Metadata Quality & Standards

Metadata quality requirements, measurement, remediation, and continuous improvement practices.

9. Metadata Integration & Automation

Integration of metadata across tools and platforms, automation of capture, synchronization, and policy-driven use.

10. Stewardship, Lifecycle & Adoption

Embedding metadata stewardship, lifecycle management, training, and adoption into enterprise ways of working.

1. Debt Identification & Inventory

Documented inventory and consistent capture of technical debt across applications, platforms, infrastructure, data, and integration components.

2. Debt Quantification & Risk Assessment

Consistent estimation of remediation cost and assessment of business, operational, security, compliance, and customer impact.

3. Prioritization & Portfolio Management

Explicit prioritization of technical debt alongside features and strategic work, with portfolio-level visibility and governance.

4. Remediation Planning & Funding

Funded, scheduled, and protected remediation planning with sequenced, incremental delivery of debt reduction.

5. Governance & Accountability

Defined roles, policies, ownership, and leadership decision-making for technical debt across the enterprise.

6. Architecture & Application Modernization

Use of architecture assessments, standards, and rationalization to identify and retire structural technology debt.

7. Platform, Infrastructure & Dependency Debt

Proactive management of end-of-life technologies, dependencies, and cloud/infrastructure configuration debt.

8. Security, Resilience & Compliance Debt

Treatment of security, resilience, and compliance deficiencies arising from deferred technology work as technical debt.

9. Engineering & Delivery Practices

Delivery practices, quality gates, and continuous refactoring that prevent new technical debt from accumulating.

10. Metrics, Reporting & Continuous Improvement

Measurement, executive reporting, and learning loops that connect technical debt to business and delivery outcomes.

1. Strategy, Governance & Operating Model

Documented ITSM strategy, executive sponsorship, defined roles and policies, and governance forums that steer service performance and improvement.

2. Service Portfolio, Catalog & Demand

An authoritative service portfolio and catalog with lifecycle governance and demand capture tied to capacity and investment decisions.

3. Service Desk & Request Fulfillment

A defined service desk, standardized request fulfillment, consistent ticket quality, and self-service that improves first-contact resolution.

4. Incident & Major Incident Management

End-to-end incident management with consistent prioritization, tested major-incident command, measured performance, and clear stakeholder communications.

5. Problem & Knowledge Management

Proactive problem identification, evidence-based root-cause analysis, known-error documentation, and knowledge embedded into ITSM workflows.

6. Change Enablement, Release & Deployment

Risk-based change enablement with proportionate approvals and repeatable release and deployment practices measured for success.

7. Configuration & IT Asset Management

Risk-focused configuration and asset management whose data actively supports impact, change risk, security, cost, and continuity decisions.

8. Service Level, Experience & Supplier Management

Outcome-based service levels, aligned operational and supplier agreements, customer experience measurement, and criticality-based supplier management.

9. Monitoring, Availability, Capacity & Continuity

Actionable monitoring, measured availability and capacity, and tested continuity and resilience for critical services.

10. Metrics, Automation & Continual Improvement

Balanced ITSM measurement, value-driven automation, governed continual improvement, and periodic maturity reassessment.