Leveraging AI For Better Cloud Runtime Security

Scroll to Top

"*" indicates required fields

Name*

Phone*
Email*

Your Company's Name

Location

How can we help you?

"*" indicates required fields

Step 1 of 19

Analytics Journey Assessment Questionnaire
Digital transformation often requires skills across multiple roles and departments. This Analytics assessment questionnaire will walk you through a series of questions to evaluate your company’s readiness for implementing analytics in the departments that matter most in the company.
Please take a moment to complete the questionnaire

Does your organization have a business case for implementing an analytics solution that aligns analytics with your strategic vision?*
Initial. Your organization leverages analytics on an ad hoc basis to address specific business questions or challenges as they arise with no formalized approach to analytics where data is often siloed and unstructured.
Evolving. Your organization has started to develop a more proactive approach to analytics with some basic analytics tools and processes in place, and data is beginning to be integrated across different areas of the organization.
Acceptable. Your organization has a formalized approach to analytics, with dedicated resources and teams responsible for managing and executing analytics initiatives. There is a focus on data governance and quality, and analytics is integrated into the organization's overall decision-making processes..
Advanced. Your organization has optimized analytics capabilities to deliver significant business value. There is a strong focus on leveraging advanced analytics techniques, such as machine learning and artificial intelligence, to drive insights and inform decision-making.
Optimized. Your organization's analytics capability has become a core driver of the organization's strategy and operations. Analytics is fully integrated into the organization's business processes, and there is a culture of continuous improvement and innovation driven by data and analytics.

Do you have an existing and well-defined Data Strategy covering key objectives and capabilities statements?*
Initial. Your Data Capability is performed on a reactive ‘as needs’ basis with no or little alignment between Data Strategy and Business Strategy. No guiding principles or Executive Sponsorship.
Evolving. Your Data Strategy is formed and announced by the Executive Steering Committee where endorsement, buy-in, and communication of Data Strategy made formal Capability Statement is clear and present..
Acceptable. Your Data Strategy is well-defined and aligned with the organization's Business Strategy with Guiding Principles, goals, and objectives clearly set and defined. Official endorsement by the Executive Steering Committee is issued to the organization and execution of the Data Strategy is well on its way.
Advanced. Your Data Strategy is consistently measured and communication on strategy progress is systematic. Leverages next-generation AI techniques to drive business value supported by benefits realization KPIs.
Optimized. Your Data Strategy is consistently measured against progressing strategy initiatives with Data-driven business decisions becoming ingrained into the organization's culture and supporting a large use case inventory.

Does your organization support Data-Driven Culture and decision-making?*
Initial. Your organization's Data-Driven Culture and decision making is limited.
Evolving. Your organization's Data-Driven Culture and decision making is evolving to support business value.
Acceptable. Your organization is at an acceptable level of Data-Driven Culture and decision-making to support business.
Advanced. Your organization's data-driven Culture and decision making is advanced in maturity and supports business value.
Optimized. Your organization's data-driven Culture and decision making is fully optimized. Data-Driven Culture and decision making is fully optimized.

Are you following best practices, documentation, and tools to implement business and technology strategies for the cloud?*
Initial. Your organization makes considerations for Cloud Adoption Framework made with no modern technology infrastructure (i.e., cloud, big data); basic, desktop tools. You are not following best practices, documentation, and tools to implement business and technology strategies for the cloud.
Evolving. Your organization makes limited use of modern technology and cloud infrastructure platforms with shadow IT. Strategy and Planning is in progress. You are considering following best practices, documentation, and tools to implement business and technology strategies for the cloud.
Acceptable. Your organization is making progress with Landing Zones design and setup. Planned Migration of workloads to the cloud and selective use of technology and infrastructure with the option to scale easily. You are following CAF's best practices, documentation, and tools to implement business and technology strategies for the cloud.
Advanced. Your organization is ready to innovate with cloud workloads, extended use of Landing Zones, and moderately scaled systems and platforms to facilitate enterprise-wide insights. You are following Microsoft's guidance on achieving your cloud adoption goals. Innovate with cloud workloads, Extended use of Landing Zones, moderately scaled systems, and platforms to facilitate enterprise-wide insights. Managed and governed with security and compliance.
Optimized. Your organization is organized and managed, centrally driven, real-time technology with self-service-oriented architecture. Your organization is optimized to follow Microsoft's guidance on achieving your cloud adoption goals.

What is your business strategy for adopting the cloud?*
Initial. Your organization does not have a solid business strategy of pathway to take you to the cloud.No solid business strategy of pathway to take you to the cloud.
Evolving. Your organization is planning to document business strategy in a way that's both understandable to cloud technicians and palatable to your business stakeholders.
Acceptable. Your organization has a vision and drafts a business strategy in a way that's both understandable to cloud technicians and palatable to your business stakeholders.
Advanced. Your organization has a Business Strategy that helps you drive adoption efforts that capture targeted business value in a cross-functional model. Clarity and vision to help you drive adoption efforts that capture targeted business value in a cross-functional model
Optimized. Your organization is optimized to take advantage of business strategies to reach your expected state of transformation.

With your workloads hosted in the cloud, have you created and utilized landing zones to host workloads?*
Initial. Your organization has no workloads hosted in the clouds or have not created and utilized landing zones to host new workloads. Not hosted in the cloud, and have not created and utilized landing zones to host workloads
Evolving. Your organization has some workloads hosted in the cloud or considered creating and utilizing landing zones to host new workloads. Some workloads are hosted in the clouds or considered creating and utilizing landing zones to host new workloads.
Acceptable. Your organization is prepared to host some workloads in the cloud and has considered creating or creating and utilizing landing zones to host new workloads. Some workloads are already hosted in the cloud and considered or created as landing zones to host new workloads.
Advanced. Your organization has created and confirmed Azure landing zone conceptual architecture and Azure landing zone accelerator to commence the migration of workloads
Optimized. Your organization is fully utilizing Azure landing zones and implementation against the three core concepts of starting, aligning, and enhancing your workloads in the cloud.

Does your company have a well-defined and managed plan for cloud operations?*
Initial. Your organization has no solid planning, readiness, and adoption approach to move to the cloud.
Evolving. Your organization has ad-hoc or evolving thinking around solid planning, readiness, and adoption approach to move to the cloud.
Acceptable. Your organization's planning, readiness, and adoption approach is repeatable and in progress.
Advanced. Your organization is developing the business and technical approaches needed to move to the cloud and provide cloud management.
Optimized. Your organization is managed and driven with a clear and solid plan in place to drive readiness, and an adoption approach to move to the cloud.

How do you separate dev/test/prod environments to run development and testing workloads on Azure/AWS?*
Initial. Your organization does not believe in the development and testing of workloads on Azure/AWS.
Evolving. Your organization works in an ad-hoc manner to do basic development and testing of workloads on Azure/AWS
Acceptable. Your organization makes use of separating environments to run development and testing workloads on Azure/AWS
Advanced. Your organization makes use of properly separating dev/test/prod environments to run development and testing workloads on Azure/AWS
Optimized. Your organization leverages the use of continuous development and integration by properly separating dev/test/prod environments to run development and testing workloads on Azure/AWS

What kind of logs are you collecting for your data platform?*
Initial. Your organization does not collect any logs which is a log data platform that collects activity logs and resource logs along with other monitoring data to provide deep analysis across your entire set of resources.
Evolving. Limited. Your organization collects some logs, manually, that capture activity logs and resource logs along with other monitoring data to provide deep analysis across your entire set of resources.
Acceptable. Your organization has a way to repeatedly and systematically capture activity logs and resource logs along with other monitoring data to provide deep analysis across your entire set of resources.
Advanced. Your organization has a repeated, measured way to collect and aggregate data from various activities and resource logs into a common data platform where it can be used for analysis, visualization, and alerting.
Optimized. Your organization has a fully automated, alerted, and monitored way to collect and aggregate data from various activities and resource logs into a common data platform where it can be used for analysis, visualization, and alerting.

How do you visualize an application health model and encompass logs and metrics for your data platform?*
Initial. Your organization has no way to visualize the application health model and encompassed logs and metrics for your data platform.
Evolving. Your organization has the means to do an ad-hoc way to visualize the application health model and encompass logs and metrics for your data platform, but it's tedious and time-consuming.
Evolving. Your organization has the means to do an ad-hoc way to visualize the application health model and encompass logs and metrics for your data platform, but it's tedious and time-consuming.
Advanced. Your organization has a systematic way to regularly capture and visualize application health models and encompass logs and metrics for your data platform and flexibility to add additional health performance metrics.
Optimized. Your organization fully utilizes a systematic way to regularly capture and visualize application health models and encompass logs and metrics for your data platform and flexibility to add additional health performance metrics.

How do you monitor and process alerts?*
Initial. Your organization has no way to process and be notified by alerts. Your organization has no way to process and be notified by alerts.
Evolving. Your organization uses an ad-hoc way to monitor performance and issue manual alerts. Your organization uses an ad-hoc way to monitor performance and issue manual alerts.
Acceptable. Your organization has a repeatable way to identify that there may be a problem with your infrastructure or application.
Advanced. Your organization has an automated way to generate alerts when there is data to indicate that there may be a problem with your infrastructure or application.
Optimized. Your organization has an automated way to detect and address issues before users notice them by proactively notifying you when Azure Monitor data indicates that there may be a problem with your infrastructure or application.

Do you currently have a scalable, repeatable framework that meets your organization's unique needs for building modern data platforms?*
Initial. Your organization often has unplanned analytics projects. Each application is highly specialized to unique data and stakeholder needs. Data isn't exploited programmatically and consistently. Each application also has significant code bases and engineering teams.
Evolving. You organization tends to be good at traditional data capture and analytics. It might have some level of commitment to a cloud-scale approach. Teams are being formed and strategy is being created, but analytics remains departmentalized.
Acceptable. Your organization can answer a few "why" questions and is actively working towards an end-to-end data strategy that uses centrally governed data lake stores to control data store sprawl and improve data discoverability. Innovation the platform is almost ready. Workflows are in place to address data quality.
Advanced. Your organization uses analytics platforms to make predictions, unlock digital innovation from both data estate and application development standpoints and successfully deliver on critical business workloads. The organization uses a holistic data approach. Projects related to data are integrated into business outcomes.
Optimized. Your entire organization uses frameworks, standards enterprise, and a data-driven culture. Automation, data-driven feedback loops, and centers of excellence around analytics or automation can be observed in action.

Optimized. Your entire organization uses frameworks, standards enterprise, and a data-driven culture. Automation, data-driven feedback loops, and centers of excellence around analytics or automation can be observed in action.*
Initial. Your organization is consuming the cloud in an unstructured way and not across cloud-scale analytics consisting of two main architectures: the data management landing zone and the data landing zone.
Evolving. Your organization is aware of cloud-scale analytics consisting of two main architectures: the data management landing zone and data landing zone and is planning to implement this reference architecture.
Acceptable. Your organization has a defined strategy and plan to prepare analytics estate and investigate deployment templates for creating a cloud-scale analytics data landing zone to set the foundation.
Advanced. Your organization is utilizing physical architecture and scaling cloud-scale analytics deployments by using multiple data landing zones and deployment templates for cloud-scale analytics.
Optimized. Your organization is well advanced and has addressed key design areas considerations like enterprise enrollment, networking, identity, and access management, policies, business continuity, and disaster recovery for building out the data architectures of your cloud-scale analytics framework.

Do you scale analytics adoption beyond a single platform and a single implementation of the team in your organization?*
Initial. Your organization has a very basic understanding of data mesh architectural patterns and a view of the decentralized approach.
Evolving. Your organization has a basic understanding of domain-driven design and feels data mesh will help with a decentralized approach and empower different business units and departments to handle different parts of the operation.
Acceptable. Your organization is looking to a decentralized and distributed approach, from a business perspective to design and develop an architectural pattern for implementing enterprise data platforms in large, complex organizations.
Advanced. Your organization understands foundational concepts for data mesh architecture and is developing an architectural pattern for implementing enterprise data platforms in large, complex organizations.
Optimized. Your organization has successfully implemented data mesh architecture to support every business domain to retain control over all aspects of its data products for both analytical and operational use cases.

Do you understand and use the foundational concept of Data Domains?*
Initial. Your organization has limited knowledge or understanding of data domains.
Evolving. Your organization has a growing appetite to understand and learn about the data domain and see its relevance.
Acceptable. Your organization sees the value in the data domain as a data domain is a way to define boundaries around your enterprise data.
Advanced. Your organization has a full understanding of decentralization and the distribution of responsibility to domains and has modeled data domains based on your business processes or source systems.
Optimized. Your organization fully embraced Domain-Driven Design and uses domains as a way to define boundaries around your enterprise data.

Do you use Data Contracts and/or how do you gain data usage insights and information about who owns each data product?*
Initial. Your organization has a limited understanding of how data products will provide value and information about who owns each data product.
Evolving. Your organization has a fair understanding and planned need for how data contracts can help gain data usage insights because they provide information about who owns each data product.
Acceptable. Your organization leverages data contracts to provide insight into coupling and dependencies between domains and applications.
Advanced. Your organization leverages data contracts to simplify oversight and manage the compatibility of data products.
Optimized. Your organization fully leverages data contracts to guarantee interface compatibility.

Do you currently follow prescriptive guidance, coupled with best practices for your Azure workloads?*
Initial. Your organization has limited knowledge of what landing zones are and how to use them.
Evolving. Your organization is familiar with the concept of a data landing zone and intends to deploy it to enable agility for creating data products.
Acceptable. Your organization has a clear plan to validate and build underpinning architectural components to support the design and deployment of landing zones.
Advanced. Your organization has built one or more landing zones to host and run analytics workloads.
Optimized. Your organization has successfully operationalized landing zones to host and run analytics workloads and can easily scale to deploy new data landing zones with a standard set of services that let the data landing zone begin ingesting and analyzing data.

Do you have a centralized data governance and management view across your organization?*
Initial. Your organization does not have a centralized data governance and management view across your organization.
Evolving. Your organization has plans for a centralized data governance and management view across your organization.
Acceptable. Your organization has researched and understands the data management landing zone concept and its benefits.
Advanced. Your organization has a centralized data governance and management view across your organization.
Optimized. Your organization has implemented a data management landing zone to provide the foundation for your platform's centralized data governance and management across your organization.

"*" indicates required fields

Step 1 of 22

Cloud Adoption Assessment Questionnaire
Digital transformation often requires skills across multiple roles and departments. This Cloud adoption assessment questionnaire will walk you through a series of questions to evaluate your company’s readiness for cloud adoption in various areas.
Please take a moment to complete the questionnaire

Are you responding to any critical business events, such as, datacenter exit, mergers and acquisition, end of support for mission-critical technologies, or response to regulatory compliance change?*

What are the critical business events driving your cloud transformation?*
Datacenter exit
Merger, acquisition, or divestiture
Reduction in capital expenses
End of support for mission-critical technologies
Response to regulatory compliance changes
New data sovereignty requirements
Reduction of disruptions and improvement of IT stability
Report and manage the environmental impact of your business
Expanding capacity without migrating because you're not able to move to OpEx or can't deprecate due to business needs
None of the above

Are there any other motivations that are driving your cloud transformation, other than those driven by critical business events?*
Cost savings
Reduction in vendor or technical complexity
Optimization of internal operations
Increase in business agility
Scaling to meet market and/or geographic demands
Integration of a complex IT portfolio
Improved customer experiences and engagements
Transformation of products or services
Market disruption with new products or services
Preparation for, or building new, technical capabilities
Democratization and/or self-service environments
None of the above

Has your cloud strategy been communicated broadly across the organization?*

Do you conduct regular cloud strategy reviews with the broader organization?*

Have you documented a cloud strategy with multi-year horizon and C-level participation and/or sponsorship?*

What are the business outcomes driving your cloud transformation?*
Increase profitability while driving compliance
Accelerate sales, improve customer lifetime value
Acquire and retain customers, build a reputation
Retain, recruit, and empower employees
Meet market growth requirements and environmental sustainability metrics
Global reach
Performance and reliability
None of the above

Do these outcomes have associated business drivers, KPIs, and necessary technical capabilities?*

Yes.

No.

Don't know

Have you developed a financial model or performed an economic assessment that provides business justification for moving to the cloud?*

Yes.

No.

Don't know

It's important to understand how to account for cloud costs before you begin a cloud transformation journey. Select your company's model from the following common cloud accounting models.*

Cost-center model

Profit-center model

Charge-back model

Show back or awareness-back model

Don't know

None of the above

When you're making the shift to the cloud, there are technical considerations around how it can help you beter manage and maintain your cloud and workloads. Discover the technical flexibility, efficiencies, and capabilities that help you build a business case to adopt the cloud.
Do you understand how your resources need to scale depending on usage, utilization, and demand in a cloud context?*

Yes.

No.

Have you identified the workloads that need to be built with highly available infrastructure?*

Yes.

No.

Have you identified the workloads that have specific security and compliance requirements?*

Yes.

No.

Have you identified resources to rightsized and optimize capacity?*

Yes.

No.

Have you selected an initial cloud workload?*

Yes.

No.

Are you familiar with the Hybrid cloud Benefit and how to use it to optimize licensing costs?*

Yes.

No.

Are you familiar with pay-as-you-go pricing models?*

Yes.

No.

Are you familiar with Virtual Machines and its cost savings?*

Yes.

No.

Do you have a strong understanding of the baseline financial data in your on-premises datacenter today?*

Yes.

No.

Depending on the motivations and business outcomes associated with cloud adoption, leaders might need to establish new organizational structures or virtual teams to handle various functions. Organizational and environmental (technical) readiness often require new skills for technical and nontechnical contributors.*

Yes.

No.

Don't know

Do your developers understand cloud computing concepts, general cloud computing models, and services, such as public, private, and hybrid cloud services, like IaaS, PaaS, and SaaS?*

Yes.

No.

Don't know

"*" indicates required fields

Step 1 of 7

Cloud Governance Assessment Questionnaire
Digital transformation often requires skills across multiple roles and departments. This Migration assessment questionnaire will walk you through a series of questions to evaluate your company’s readiness for cloud migration in various areas.
Please take a moment to complete the questionnaire

How did you build your cloud governance team?
Your cloud governance team oversees cloud governance for your organization's cloud. Your team is responsible for assessing risks, documenting cloud governance policies, and reporting on the progress of cloud governance. They need to understand your organization's needs and ensure that cloud governance policies minimize risks.*
We defined the functions of our cloud governance team. Outline the specific tasks and responsibilities that the team must handle to manage your organization's cloud governance effectively.
We selected the members of our cloud governance team. Select the individuals that are responsible for overseeing and managing cloud governance within your organization.
We defined the authority of our cloud governance team. Empower your cloud governance team to effectively implement and oversee cloud governance.
We defined the scope of our cloud governance team. Establish the boundaries of your cloud governance team’s responsibility.
None of the above.

How do you assess cloud risks?
Every technology presents organizational risk. Risks are undesirable outcomes. When your organization adopts the cloud, your cloud governance team needs to identify the risks so they can create cloud governance policies to manage those risks.*
We identify cloud risks.Catalog a comprehensive list of cloud risks. Know the risks so you can create governance policies that effectively mitigate them.
We analyze cloud risks.Assign a qualitative or quantitatove ranking to each risk so you can prioritize them by severity. Consider the probability and the impact of a risk to determine its priority. Prefer quantitative risk analysis over qualitative for more precise risk prioritization.
We document cloud risks.Document each risk and the details of the risk analysis. Create a list of risks, called a risk register, that contains all the information you need to identify, categorize, prioritize, and manage risks.
We communicate cloud risks.Clearly convey the identified cloud risks to your executive sponsor and executive-level management. It's important to ensure that your organization prioritizes cloud risks.
We review cloud risks.Review cloud risks to ensure the risks are valid and accurate. Perform reviews regularly in response to specific events. Maintain, update, and remove risks as needed.
None of the above

How do you document cloud governance policies?
Cloud governance policies specify what should or shouldn't occur in the cloud. Your cloud governance team should create one or more cloud governance policies for each identified risk.*
We defined an approach for documenting cloud governance policies.Establish an approach for creating, maintaining, and updating the rules and guidelines that govern the use of your cloud services. Produce cloud governance policies that don’t require frequent updates, and consider the effects of cloud governance policies across your cloud environment.
We define cloud governance policies.Create cloud governance policies that outline how to use and manage the cloud to mitigate risks. Create a governance framework that manages risk.
We distribute cloud governance policies.Grant access to everyone who needs to adhere to cloud governance policies. Look for ways to make adherence to the cloud governance policies easier for people in your organization.
We review cloud governance policies.Assess and update cloud governance policies to ensure they remain relevant and effective in governing cloud environments. This approach helps maintain the policies alignment with evolving regulatory requirements, technological advancements, and organizational objectives.
None of the above.

How do you enforce cloud governance policies?
Cloud governance enforcement refers to implementing controls and procedures that align cloud activity to cloud governance policies. Atier your cloud governance team assesses cloud risks and creates cloud governance policies to manage those risks, they must ensure that cloud governance policies are enforced. They must delegate governance enforcement responsibilities, which empowers each team or individual to enforce cloud governance policies within their area of responsibility*
We defined an approach for enforcing cloud governance policies. Establish a systematic strategy to enforce cloud governance policies. Use a combination of automated tools and manual oversight to enforce policies efficiently.
We automatically enforce cloud governance policies.Use cloud management and governance tools to automate the enforcement of governance policies. Incorporate these tools to help set up guardrails, monitor configurations, and ensure compliance.
We enforce cloud governance policies manually as needed.In cases where you can’t automate the enforcement of cloud governance policies, enforce cloud governance policies manually. Sometimes a tool limitation or cost makes automated enforcement unpractical.
We review policy enforcement mechanisms.Regularly review and update policy enforcement mechanisms. Keep cloud governance policy enforcement aligned with current needs, including developer, architect, workload, platform, and business requirements.
None of the above.

How do you monitor cloud governance?
Continuously monitor your cloud environment to ensure that it aligns with cloud governance policies. Find an effective way to monitor governance and progressively reduce non-compliance issues to zero.*
We configured cloud governance monitoring.Implement monitoring solutions to track compliance with your organizational cloud governance policies.
We configured cloud governance alerts.Configure alerts based on specific compliance metrics or events that indicate a deviation from your governance policies.
We developed a remediation plan.Develop a targeted action plan to address any non-compliance events. When non-compliance is detected, carry out the remediation plan to correct the deviations and minimize the risk and impact on your cloud environment.
We audit cloud governance regularly.Even with automated monitoring, conduct periodic manual reviews and audits to validate compliance monitoring processes and ensure that automation tools are functioning correctly.
None of the above.

Do you have a centralized data governance and management view across your organization?
Initial. Your organization does not have a centralized data governance and management view across your organization.Your organization does not have a centralized data governance and management view across your organization.*
Evolving - Your organization has plans for a centralized data governance and management view across your organization.Your organization has plans for a centralized data governance and management view across your organization.
Acceptable - Your organization has researched and understand data management landing zone concept and its benefits.Your organization has researched and understand data management landing zone concept and its benefits.
Advanced - Your organization has a centralized data governance and management view across your organization.Your organization has a centralized data governance and management view across your organization
Optimized. - Your organization has implemented data management landing zone to provide the foundation for your platform's centralized data governance and management across your organization. Implement data management landing zone to provide the foundation for your platform's centralized data governance and management across your organization.

"*" indicates required fields

Step 1 of 52

Devops Capability Assessment
Digital transformation often requires skills across multiple roles and departments. This DevOps assessment questionnaire will walk you through a series of questions to evaluate your company’s readiness to adopt continuous processes throughout.
Please take a moment to complete the questionnaire

Describe how your team plans, prioritizes, and schedules work.
An Agile development team typically operates from a backlog of requirements, often referred to as user stories. The backlog is prioritized to ensure that the most critical user stories are at the top. The product owner is responsible for managing the backlog, which includes adding, modifying, and reordering user stories based on customer needs. One of the most significant impediments to an Agile team's productivity is an ill-defined backlog. To consistently deliver high-quality software each sprint, it's essential to have well-defined requirements. <br> By completing features in accordance with the requirement specifications*
Within time-boxes, such as sprints or iterations lasting 1-4 weeks
Our goal is to achieve a continuous, one-piece flow of product backlog items, prioritized by their stack rank
We formulate measurable experiments based on hypotheses and utilize production data to evaluate the outcomes
We use other tools for planning
None of the above

Describe the methodology is used to estimate work.
Estimating in Agile software development differs from estimating in traditional IT delivery. Agile teams estimate the workload for the upcoming sprint and, potentially, a portion of the backlog for future sprints.In contrast, sequential IT delivery teams seek to provide precise estimates for the entire project, which may span many months or even years.*
T-shirt sizing
Planning poker
Dot voting
Story points
Story Counting
Swim Lane Sizing
None of the above

Can you describe how much work - equivalent to the number of sprints - is present on your backlog or to-do list?
During sprint planning, the team selects backlog items to include in the upcoming sprint based on priority and their estimation of what can be completed during that sprint. Breaking down these items into smaller tasks helps the sprint team better prioritize their work.*
Undefined, or unclear
A couple of sprints
More than a couple of sprints but less than three month's worth of work
Three month's worth of work or more but no more than six months
Up to a year's worth of work
More than a year's worth of work

Can you describe how many products your team is currently working on simultaneously?
Managing too many projects simultaneously can result in decreased morale among lower-level teams. When resources are stretched thin, they spend more time 'context switching' between projects, which significantly impacts their productivity.*
A couple of sprints
More than a couple of sprints but less than three month's worth of work
Three month's worth of work or more but no more than six months
Up to a year's worth of work
More than a year's worth of work

Can you describe how many products your team is currently working on simultaneously?
Managing too many projects simultaneously can result in decreased morale among lower-level teams. When resources are stretched thin, they spend more time 'context switching' between projects, which significantly impacts their productivity*
We work exclusively on one product.
We have a few things we are working on.
We work on dozens of products.
There are too many to count.

How do members of the team collaborate?
In your DevOps journey, inadequate communication can result in unfavorable outcomes. It is essential to maintain regular communication and collaboration within your team. Consider conducting daily stand-up meetings and leveraging tools such as work items, ChatOps, and other mechanisms for effective collaboration.*
We hold daily stand-up meetings and collaborate using work items, ChatOps, and other mechanisms.
We use e-mail or instant messaging for communication as needed.
We opt for weekly calls to ensure that we stay updated on our project.
Our teams operate in silos, and communication primarily occurs when issues arise.
None of the above

How does the team gather and measure feedback from customers and users?
Collecting feedback from your end-users and incorporating it into your development process is crucial for providing an excellent customer experience. A team adds value to the customer when they receive feedback and then adjust their backlog according to that feedback.*
Manual testing, user acceptance testing, or general acceptance criteria.
Direct email, phone, or web contact forms, web meetings, or chat.
In-product qualitative feedback (e.g., Send-a-Smile) and surveys such as Net Promoter Score (NPS).
We maintain ongoing engagement with our stakeholders, capturing and responding to feedback, as well as transforming and implementing new ideas into functionalities within our applications.
None of the above

How do coordinate or split work up across teams?
Agile assumes that each team possesses all the necessary resources to deliver an increment of work independently. This involves creating cross-functional teams equipped with the knowledge and permissions required to build, test, and deploy a product from start to finish with minimal external interaction, which may not be achievable by a single team alone.*
We have a Project Management Office that handles it.
We utilize a "Scrum of Scrums" approach.
We conduct demos for other teams working on components that interface with our system.
We maintain a Portfolio Board.
We have an open office space, ensuring that everyone is kept in the loop.
We regularly share our backlog with other teams to keep them informed.
None of the above

Describe how your team collaborates, shares risks, innovates, and learns.
In Agile, there are several effective methods for sharing project information with your team. Not having a structured way to share information with the team can result in poor collaboration, increased project risks, and reduced innovattion. Encouraging collaboration and consistently practicing it tends to lead to the generation of beter ideas, greater buy-in, and improved outcomes.*
We isolate ourselves to avoid being held responsible for failures, and risk-taking is discouraged.
There is some communication. When mistakes occur, the responsible person is held accountable.
Communication and collaboration are strong among teams, and innovation is actively encouraged.
There is high cooperation among teams. Risks are shared, and failure leads to learning and inquiry to help the team improve. Innovation is not only encouraged but also implemented.
None of the above

Describe how your team handles risk with a project.
Risk is defined as uncertainty in a project. Agile projects tend to have fewer quality risks compared to traditional projects due to iterative cycles that aim to mitigate risks continuously. In an Agile team, anyone can identify risks and propose mitigation strategies.*
Prepare a clearly detailed project scope.
Define requirement specifications and acceptance criteria.
Obtain sign-off from stakeholders on the scope agreement.
Establish and implement a change control process that stakeholders are aware of and agree to.
Develop and implement a change control process that the stakeholders are aware of and agree to
Monitor project progress against the defined scope. For example: By holding regular review meetings. (based on the needs and priorities of the team)
None of the above

Describe how your team regularly comes together to share and evaluate new ideas.
In an agile team, sharing ideas is an integral part of the iterative process. By making ideas known to the team, it fosters an environment of experimentation and innovation.*
We document the ideas and revisit them every few sprints to determine which ones to pursue.
We try to allocate some time in the upcoming sprint to explore certain ideas that have been suggested.
We can engage in discussions with the team, and for promising ideas, we follow up promptly. This is why we have dedicated slack time in our schedule.
None of the above

Describe how your team manages code?
As teams scale, the number of stakeholders who depend on and contribute to codebases can quickly increase. Without a strategy in place to manage changes to their source code, teams expose themselves to significant risks, including ongoing confusion, errors, and decreased productivity*
Use a common code repository (for example: Git based repo) for source files
Use a common code repository (for example: Git based repo) for configuration files
Have a defined branching structure
Have a defined branching policy that is enforced daily
Manage branch and repository permissions
Utilize artificial intelligence solutions (such as GitHub Copilot) to boost Developer productivity
Enforce check-in comments and workflows for code commits
None of the above

Describe what files do you keep under source control?
A version control system tracks changes to a file or a set of files over me, allowing you to recall specific versions later. You should aim to place all application-related files under source control.*
Application source code
Application source code and tests
Application source code, tests and configuration files
All files used to build, test, configure, deploy, run and document our service
None of the above

Describe how your team merges changes into a shared branch?
In Git, each developer saves changes to their own local code repository. As a result, there can be many different changes in a single commit. Git provides tools for isolating changes and later merging them back together. Git repositories otien have one or more shared branches where developers collaborate and eventually contribute their changes. The top level shared branch is usually called "main".*
Use Pull Requests to pull code changes back into the parent branch
Directly merge changes into the parent branch without a pull request
Directly change source code in the shared branch
None of the above

Describe the branch strategy in place to control pull/push requests?
In Git, branches, which serve as lightweight pointers to work in progress, help manage this separation. Once the work created in a branch is completed, it can be merged back into the team's main (or trunk) branch. While there are various valid methods, it is essential to have a clearly defined strategy in place and ensure that it is understood.*
We keep new work in separate branches and merge it only when finished, usually within weeks or months
We have no branches and develop only in the trunk or master
We use branches that live for a few days at most and commit all changes to the master or trunk at least daily
We maintain traceability on code changes but treat branches as temporary by using topic branches that we squash-merge to master when the work is complete
None of the above

Describe how the team monitors and reviews code changes?
All code changes should be peer-reviewed and approved, regardless of the scope of the change, as even one-line code updates frequently introduce bugs to a system. Pick the option that represent the most common practices for your team or organization.*
We do not have a policy; however, some code changes may undergo review, and at times, the reviewer may also be the requestor
We review code changes through live peer reviews or pair programming
Some code is reviewed, and we capture the review history using a pull request workflow or its equivalent
We ensure that all code changes are peer-reviewed before being commited to the master or trunk through a pull request workflow, branch policies, or their equivalent, and we enforce branch policies
None of the above

Describe how your team deals with cross-team code dependencies?
Do you store compiled code in version control? Do you duplicate components? Do you have inefficient processes for managing dependencies? If the answer is 'yes,' you should consider sharing and reusing code across the organization using packages.*
We track work items in a spreadsheet or document
We use a work item tracking system
The dependencies are published as packages to a repository, so we can track the dependencies in our code. We publish our own artifacts as well so other teams that depend on us can see the new artifacts.
We have full access to the source code of other teams and can build our own version of the dependencies if necessary (inner source)
We have an open-source model, so anyone can contribute and use our code as well as we can use other team's code
We use an ad-hoc or manual process for communicating dependencies.
None of the above

Describe how your team performs static code analysis?
Static analysis tools enable you to enforce coding standards, identify common errors, and address failures to follow best practices. Many static analysis tools can also be extended to implement custom rules and enforce your own policies. The following products are examples of static code analysis tools: SonarQube, SonarCloud, ESLint, FindBugs*
Static code analysis is performed early in development, before software testing begins.
Static code analysis is performed later in development, after software testing begins.
Static code analysis is performed after development, before deployment begins.
None of the above
Continuous Integration and Continuous Delivery (CI/CD)

Describe how your team gets notified about the build status and failures?
Sometimes failures happen, so it is important to ensure you have visibility into your pipeline. Receive a notification from the build system. Notifications may be delivered via a communication app such as Teams, SMS, or e-mail*
Receive alerts through IT service management tools
Receive alerts from DevOps build system directly
Teams review the status manually on a regular basis
None of the above
Continuous Integration and Continuous Delivery (CI/CD)

Describe how frequently your team refactors code or addresses technical debt?
Code refactoring is defined as the process of restructuring computer code without changing or adding to its external behavior and functionality. The primary benefit of refactoring is to enhance the quality of code and reduce technical debt.*
We do this when we have time
We plan to do this once every quarter
We use stabilization sprints to perform this kind of work
We continually do this
We do this on a set weekly interval
We do not refactor code in our team / A separate team handles it
Continuous Integration and Continuous Delivery (CI/CD)

Describe how your team release/deployment process works?
The entire end-to-end CI/CD deployment process should be understood, and ideally, as much of the deployment process as possible should be automated.*
Use environments for development and testing stages that simulate the production environmentMaintaining production-like environments for your pre-production stages means that if issues occur in production, you are far more capable of developing, testing, and releasing hotfixes/updates quickly.
Manage and actively resolve any technical debt in your environments technical debt includes anything that increases the complexity of the database workload or code, usually incurred due to delivery pressures.
There is a systematic approach to the development and release process The use of source code control systems, such as Azure Repos or GitHub, and build and release systems, such as Azure Pipelines or GitHub Actions, should be understood, including the corresponding processes for accessing, reviewing, and approving changes.
The application can be deployed automatically from scratch without any manual operations Manual deployment steps introduce significant risks, where human error is concerned and also increase overall deployment times.
There is a documented process for any portions of the deployment that require manual intervention Without detailed release process documentation, there is a much higher risk of an operator improperly configuring settings for the application.
N-1 or N+1 versions can be deployed via automated pipelines, where N is the current deployment version in production N-1 and N+1 refer to roll-back and roll-forward. Automated deployment pipelines should allow for quick roll-forward and roll-back deployments to address critical bugs and code updates outside of the normal deployment lifecycle.
The application deployment process leverages blue-green deployments and/or canary release Blue/green or canary deployments are ways to gradually release new features or changes without impacting all users at once.
Releases to production are gated by having it successfully deployed and tested in other environments Deploying to other environments and verifying changes before going into production can prevent bugs from reaching end-users.
Feature flags are used to test features before rolling them out to everyone To test new features quickly and with lower risk, feature flags are a technique to help frequently integrate code into a shared repository, even if incomplete. It allows for deployment decisions to be separated from release decisions.
None of the above
Continuous Integration and Continuous Delivery (CI/CD)

Choose the deployment strategy that your team uses. If you use several, choose the one that is most frequently used.
To ensure that the software connects with the operations system effectively, business goals must align with the DevOps deployment. By merging software development and IT operations, an effective DevOps deployment approach can achieve this.*
Blue/Green- Version B is released alongside version A, then the traffic is switched to version B.
Canary - The rollout takes place in a set of adoption "rings" or "groups".
A/B testing - The amount of users seeing version B is increased over time until the rollout is complete.
Rolling - Version B is slowly rolled out and replacing version A.
Recreate - Version A is terminated then version B is rolled out.
Shadow - Version B receives real-world traffic alongside version A and doesn’t impact the response.
None of the above
Continuous Integration and Continuous Delivery (CI/CD)

Describe the approval process for production deployments?
The quality signals used to approve deployments should be constantly tracked every day. While it's not critical for every service to always be available, teams should approach their DevOps delivery and operation stages with the mindset that they can and should deploy new versions without having to take them down at any time. Please choose the option that most closely reflects the most common method used in your team or organization.*
The approval process is infrequent or manual
The decision from the program/project office serves as the approval for deployment
We hold meetings before the deployment that establish our approval
We utilize gates and team approvals to manage our deployment
None of the above
Continuous Integration and Continuous Delivery (CI/CD)

Describe how your team rolls out new features to users?
Feature flagging allows DevOps teams to make new capacity available to only a small segment of application users as organizations roll out new features. Assuming all goes well, the DevOps teams can confidently make that functionality available to all users.*
We deploy when the appropriate manager approves
We run a full test suite in a production-realistic environment and proceed with deployment after obtaining any necessary approvals
We use progressive deployment with feature flags or exposure control and monitor telemetry to determine whether to continue the rollout
All changes get deployed continuously but we use feature flags to control which users have access to new features in production
None of the above
Continuous Integration and Continuous Delivery (CI/CD)

Describe how your team is using feature flags to test features before rolling them out to all users?
"Feature flags" (or "feature toggles") comprise another technique used for experimentation and "dark launches." Feature flags can toggle features on or off for different end-users based on their identity and group membership. Feature flags assist developers with code branch management, testing in production, and selective activation.*
Developers and testers test new features and functionality
Use for creative purposes, such as A/B testing
Using for progressive experimentation
Beta Feedback and Feature Targeting
Hypothesis-Driven Development
None of the above / Feature Flags not implemented
Continuous Integration and Continuous Delivery (CI/CD)

Describe your team's standard for testing?
If your team is atempting to use DevOps to deliver sotiware frequently into production, continuous testing is vital. Continuous testing, when done correctly, provides rapid and continuous insight into the health of the most recent build of your application.*
Testing that validates conformance to requirements and addresses identified bugs
Testing that is both fast and thorough enough to provide feedback in the continuous integration and continuous delivery flow
Testing that fosters continuous improvement in user satisfaction, quality of service, and performance on business objectives
Testing that covers the most used functionality, data, code paths, and configurations, with coverage measured against them
None of the above
Continuous Integration and Continuous Delivery (CI/CD)

Describe how your team runs tests on a built code package?
While most testing should occur within the testing and staging environments, it's beneficial to run a subset of tests against the production system.*
Perform regular disaster recovery (DR) and business continuity drills. Are you testing your high availability (HA) and DR processes to ensure your workload is available in the case of a disaster?
Automate testing for code and environment configuration deployments. Automating tests is the best way to ensure that they are repeatable, comprehensive, and exhaustive.
We use manual testing when necessary. Some processes can't be automated. How do you ensure that those manual processes are still adequately tested?
We create unit tests during development and run them as part of our build process.
None of the above
Continuous Integration and Continuous Delivery (CI/CD)

Describe how your team is testing and validating your applications?
Regular testing should be conducted as a part of every major change and, if possible, on a recurring basis to validate existing thresholds, targets, and assumptions. This also ensures the validity of the health model, capacity model, and operational procedures.*
The application is tested for performance, scalability, and resiliency
At least a subset of tests is also performed in the production environment
Tests for performance, scalability, and resiliency are conducted as part of each major change
Fault injection tests are being utilized
Smoke tests are performed during application deployments
Unit and integration testing is part of the application deployment process
All these tests are automated and performed periodically
Failing tests at least temporarily block a deployment and lead to a deeper analysis of the issue
Business Continuity 'fire drills' are executed to test regional failover scenarios
Regular security and penetration testing is performed
Tests are regularly updated and validated to reflect any necessary changesTests and test data should be reviewed and updated after each major application change, update, or outage.
Mocks and stubs are used to test external dependencies in non-production environmentsMocks and stubs can help validate external dependencies and increase test coverage when accessing those external dependencies is not possible, for example, due to IP restrictions.
None of the above
Continuous Integration and Continuous Delivery (CI/CD)

Describe how your team uses tests in environments other than production?
Software testing is not a new concept, but testing in a traditional environment differs significantly from testing in a DevOps environment*
We test all environments with unit, acceptance, functional, and integration tests
We use a continuous and automated process that enables ongoing testing of all our environments
We leverage test automation as much as possible
We continually revise the testing plan with an up-to-date automated testing scope
None of the above
Continuous Integration and Continuous Delivery (CI/CD)

Describe the code scanning tools used as part of the continuous integration (CI) process?
Make sure that static code scanning tools are integrated into the continuous integration (CI) process.*
Credential/Secret Scanner
Dependency Scanning
Source code analysis toolssuch as: OWASP scanners or CodeQL
Vulnerability Scanning Tools
SAST Tools
None of the above
Continuous Integration and Continuous Delivery (CI/CD)

Describe when your team conducts security testing.
Establish a minimum-security baseline that takes into account both security and compliance controls. Ensure that these controls are integrated into the DevOps process and pipeline.*
As part of the pull request and code review flow before code is committed.
Security tests are run In the continuous integration and continuous delivery pipeline.
Before any production update or Before a major release.
None of the above

How extensively is security testing conducted, and what is your team's approach to incident response in the event of a breach?
Conducting security and penetration tests, like checking for open ports or potential vulnerabilities, is crucial to ensure the overall safety and smooth operation of the system. In case prevention measures fall short, responding promptly and mitigating the security breach can help reduce harm and limit the impact within a confined area.*
Penetration testing is conducted either internally or by a third-party entity to assess the existing security defenses of this workload and ensure their validation.
Regular simulated atracks, including phishing campaigns, are executed against users of this workload to enhance preparedness and resilience.
A comprehensive security training program is established and consistently updated to keep the security personnel associated with this workload well-informed and equipped with the necessary skills.
Incident response playbooks are crafted to facilitate a swiftunderstanding of the workload and its components, enabling incident responders to efficiently mitigate atacks and conduct investigations.
None of the above.

What code scanning tools are utilized in the continuous integration (CI) workflow?
Make sure that static code scanning tools are seamlessly integrated into the continuous integration (CI) process.*
Credential Scanner
Dependency Scanner
OWASP source code analysis tools
Vulnerability Scanning Tools
SAST Tools
None of the above

How does your team make sure that there is enough of a focus on security while writing code?
Secure coding involves the creation of software that mitigates security-related vulnerabilities by adhering to industry best practices and security standards, thereby avoiding potential flaws in the development process.*
Robust authentication and authorization measures are implemented to ensure data security against unauthorized access. Examples of this are: enforcing strong password policies and incorporating twofactor authentication.
To prevent data leakage during the transmission process between sources, secure channels (HTTPS) are implemented, along with the encryption of data in transit.
Sensitive data is encrypted at rest.
Access is restricted to authenticated users only and authentication is implemented at every layer of the workload.
All communication channels are encrypted to safeguard authentication tokens.
All keys, passwords, and certificates are properly stored and protected. Proper storage and protection of keys, passwords, and certificates are imperative to maintain the integrity of the security measures in place.
Tools that support secure development (such as GitHub Advanced Security and GitHub Copilot) are used throughout the inner and outer development loops.
None of the above

How frequently does your team conduct security assessments on the code?
Security holds utmost importance in all applications; thus, it is essential to incorporate frequent security assessment activities into your development lifecycle.*
Security reviews on code changes occur sporadically.
Certain code undergoes security scrutiny, and we document the review history through a pull request workflow or a comparable method.
We ensure that all modifications to the code undergo security peer-review before being commited to the master or trunk, utilizing a pull request workflow, branch policies, or equivalent mechanisms.
None of the above

How does your team handle the management of passwords and other credentials?
It is essential to perform scans for credentials and other sensitive information in source files before commiting, as this practice minimizes the risk of unintentionally including such confidential data in your team's CI/CD process.*
Uncover and categorize all forms of passwords, keys, and other confidential information throughout your entire IT infrastructure, centralizing their management. Continuously identify and integrate new secrets into the centralized system as they are generated.
Remove hardcoded or embedded secrets from configurations in DevOps tools, build scripts, code files, test builds, production builds, and applications.
Enforce best practices for password security, covering aspects like password length, complexity, uniqueness, expiration, rotation, and more, across all categories of passwords.
Implement privileged session monitoring to record, audit, and supervise all privileged sessions, including accounts, users, scripts, and automation tools, enhancing oversight and accountability.
Expand secrets management to include third-party entities, ensuring that partners and vendors adhere to best practices when using and handling secrets.
Utilize threat analytics to continually assess the usage of secrets, detecting anomalies and potential threats.
None of the above

Explain the approach your team takes in conducting threat analysis.
Threat modeling, as an engineering approach, aids in recognizing potential threats, atacks, vulnerabilities, and corresponding countermeasures that might impact an application. The steps involved in threat analysis encompass defining security requirements, recognizing threats, implementing measures to mitigate threats, and validating the effectiveness of threat mitigation. These elements collectively contribute to ensuring comprehensive security for a workload, covering both proactive prevention and reactive responses.*
The organization follows threat modeling processes wherein identified threats are prioritized according to their impact on the organization. These threats are then associated with corresponding mitigations and communicated to relevant stakeholders.Threat modeling, as an engineering technique, serves to identify potential threats, atacks, vulnerabilities, and countermeasures that might impact an application. The process involves defining security requirements, recognizing threats, implementing threat mitigations, and validating the effectiveness of these measures. Microsoft employs the STRIDE model for threat modeling, and tools like the Microsoft Threat Modeling Tool can be valuable in this context.
There is a systematic procedure for monitoring, prioritizing, and resolving security threats throughout the application development lifecycle.A threat modeling tool generates a comprehensive report listing all identified threats. Typically, this report is uploaded into a tracking tool or work items, which developers then validate and address. Cybersecurity teams leverage the report to identify atack vectors during penetration tests. As the solution evolves with new features, the threat model should be regularly updated and seamlessly integrated into the code management process. In the event of discovering a security issue, a structured process is in place to triage the problem either into the next release cycle or a expedited release, depending on its severity
Establishing timelines and procedures is essential for deploying security fixes to address identified threats.Promptly addressing identified vulnerabilities is crucial for maintaining security and preventing the emergence of additional attack vectors.
Clear security requirements are outlined for all applications.Applications failing to meet the specified security requirements during service enablement should be restricted.
Comprehensive threat protection measures have been implemented for all applications.Enterprise applications face numerous threats that can compromise confidentiality, availability, or integrity, necessitating the use of advanced security solutions for protection.
Business-critical workloads are identified and categorized appropriately. This is essential as their compromise or unavailability could significantly impact operations.Enterprise organizations commonly possess an extensive application portfolio. Have key business applications been recognized and categorized? This encompasses applications with substantial business implications if disrupted, such as those involving critical data, regulated information, or essential availability. Additionally, these applications may encompass those particularly vulnerable to atacks, such as pivotal public-facing websites crucial to the organization's success.
None of the above

What factors related to compliance and governance are taken into account when building apps?
Organizations face limitations in terms of resources, including finances, personnel, and time. To ensure a meaningful return on investment (ROI), organizations must prioritize their investments wisely. This constraint also applies to the implementation of security measures throughout the organization. To atain a suitable ROI on security, it is crucial for the organization to comprehend and clearly define its security priorities.*
Regulatory and governance requirements are well understood and implemented.Operational data, such as application logs and metrics, may be required by regulatory mandates to remain within specific geopolitical regions. This imposes clear implications on the operationalization approach for the application.
The Landing Zone concept is applied to workloads.This concept entails predefined components, like a network topology with the Hub/Spoke model, already in place before workload deployment. The purpose of the Landing Zone is to ensure that necessary infrastructure is established upon the workload's arrival in Azure, enhancing agility and compliance with enterprise security and governance standards. It is essential to hand over a Landing Zone to workload owners with deployed security guardrails
Security and organizational standards are enforced and controlled through policies.
A Root Management Group is utilized, and any modifications applied using this group undergo careful consideration.
Systematic monitoring and maintenance of compliance for applications are conducted, with regular compliance atestations.
Periodic external or internal audits of this workload are conducted.
A security plan for this workload was formulated and is actively maintained.
Proactive review and application of best practices and guidelines, based on industry recommendations, are undertaken.
When implementing defenses, considerations are given to the costs associated for atackers and defenders. Preventing accessible and inexpensive attack methods is always prioritized.
None of the above

Describe how your team monitors applications?
In order to successfully maintain applications, it's important to 'turn the lights on' and have clear visibility of important metrics both in real-time and historically.*
An Application Performance Management (APM) tool like Azure Application Insights is used to collect application level logsIs an Application Performance Management (APM) tool used to collect application-level logs?
Application logs are collected from different application environments. Are application logs collected from different application environments?
Log messages are captured in a structured format and can be indexed and searched Are log messages captured in a structured format?
Application events are correlated across all application components Events coming from different application components or different component tiers of the application should be correlated to build end-to-end transaction flows. For instance, this is often achieved by using consistent correlation IDs transferred between components within a transaction.
It is possible to evaluate critical application performance targets and non-functional requirements based on application logs and metrics Is it possible to evaluate critical application performance targets and non-functional requirements (NFRs)?
End-to-end performance of critical system flows is monitored. Is the end-to-end performance of critical system flows monitored?
Black-box monitoring is used to measure platform services and the resulting customer experience. Blackbox monitoring tests externally visible application behavior without the knowledge of the internals of the system. This is a common approach to measuring customer-centric SLIs/SLOs/SLAs.
None of the above

Describe how your team visualizes application data and then alert relevant teams when issues occur?
Dashboarding tools should be used to visualize metrics and events collected at the application and resource levels to illustrate the health model and the current operational state of the workload.*
Application and resource level logs are either aggregated in a single data sink, or it is possible to crossquery events at both levels Are application and resource level logs aggregated in a single data sink, or is it possible to cross-query events at both levels?
Application level events are automatically correlated with resource-level metrics to quantify the current application stateAre application-level events automatically correlated with resource-level metrics to quantify the current application state?
A health model is used to qualify what 'healthy' and 'unhealthy' states represent for the workloadIs a health model used to qualify what 'healthy' and 'unhealthy' states represent for the application?
Critical system flows are used to inform the health modelAre critical system flows used to inform the health model?
The health model can distinguish between transient and non-transient faults Can the health model distinguish between transient and non-transient faults?
Long-term trends are analyzed to predict operational issues before they occur Are long-term trends analyzed to predict operational issues before they occur?
Retention times for logs and metrics have been defined and with housekeeping mechanisms configured Have retention times for logs and metrics been defined and with housekeeping mechanisms configured?
None of the above

Describe how does your team get insights into metrics of production systems?
We don’t, Ops will contact us when something is wrong*
We receive a monthly report detailing availability and average response times and trends
We receive a daily report detailing workload with availability, response times, numbers of requests and load on the systems
Ops has published a live metrics dashboard for us and sends us a roll up report with day-to-day comparison
We have full self service access to live and aggregated data through a portal
None of the above

Describe the instrumentation your team uses to monitor applications running in production?
Availability monitoring via pinging or synthetic transactions*
Performance monitoring of the servers and infrastructure
Real user monitoring
Multi-tier views of end-to-end transactions including processing and network combined
None of the above

Describe how your team interprets the collected data to inform relevant teams about application health?
Log aggregation technologies should be used to collate logs and metrics across all application components for later evaluation. Resources that logs are captured for may include Azure IaaS and PaaS services as well as 3rd-party appliances such as firewalls or anti-malware solutions used in the application.*
A log aggregation technology, such as Azure Log Analytics or Splunk, is used to collect logs and metrics from Azure resourcesWhich log aggregation technology is used to collect logs and metrics from Azure resources?
Azure Activity Logs are collected within the log aggregation tool Are you collecting Azure Activity Logs within the log aggregation tool?
Resource-level monitoring is enforced throughout the application Is resource-level monitoring enforced throughout the application?
Logs and metrics are available for critical internal dependencies Are logs and metrics available for critical internal dependencies?
Log levels are used to capture different types of application events.Different log levels, such as INFO, WARNING, ERROR, and DEBUG should be pre-configured and applied within relevant environments. The approach to change log levels should be simple configuration change to support operational scenarios where it is necessary to elevate the log level within an environment.
Critical external dependencies are monitored It's common for applications to depend on other services or libraries. Despite these are external, it is sell possible to monitor their health and availability using probes
There are no known gaps in application observability that led to missed incidents and/or false positives. What you cannot see, you cannot measure. What you cannot measure, you cannot improve.
The application is instrumented to measure customer experience. Effective instrumentation is vital to detecting and resolving performance anomalies that can impact customer experience and application availability.
None of the above

Describe how your team uses tools to be notified and alerted about application health?
Alerts can proactively notify or respond to operational states that deviate from the norm. Alerts can also enable cost-awareness by watching budgets and limits and helping workload teams to scale appropriately*
A tool such as Azure Monitor or Grafana is used to visualize the application health model and encompassed logs and metricsWhat technology in used to visualize the application health model and encompassed logs and metrics?
Dashboards are tailored to a specific audience such as developers, security or networking teams
A tool such as Azure Monitor or Splunk is used for alerting
Specific owners and processes are defined for each alert type
Operational events are prioritized based on business impact
Alerting is integrated with an IT Service Management (ITSM) system such as Service Now
Push notifications are used to inform responsible parties of alerts in real time
None of the above

Describe how your team's applications are engineered towards providing information for operations? (logging, instrumentation)
Effective application instrumentation is an important practice to help identify and understand possible issues. Efficient instrumentation of your environment and applications enable engineering and operations teams to identify and resolve potential issues more efficiently.*
We implement custom counters in our production code that stream service health, up-time, and code invocation and execution to a central repository
We poll our production system at regular intervals with a monitoring solution such as IpSwitch, SolarWinds, Quest, etc... and log the data to a central repository
We use AGENTLESS technology to conduct PING tests and verification of services. We log this data to a central repository that allows us to build and visualize trends over time
We use AGENT technology to conduct PING tests and verification of services. We log this data to a central repository that allows us to build and visualize trends over time
None of the above

Which of these DevOps practices are commonplace in your organization or team?
The merging of "Dev" and "Ops" entails the integration of previously isolated Development and Operations functions, resulting in the formation of cross-functional teams that collaborate using common and effective practices and tools. While a genuine DevOps approach assigns operational responsibilities to developers, some organizations choose not to fully adopt DevOps, opting instead to maintain a certain level of team segregation between operations and development. This separation may serve to uphold a clear division of duties in regulated environments or to treat operations as a distinct business function.*
Our change management process involves stakeholders from all aspects of the software development lifecycle.
Stakeholders in different roles working on the same product communicate frequently and efficiently.
The organization operates platforms and services for cross functional teams to consume.
When we build a workload or application we understand that any new product we create will be a service that needs long-term maintenance and investment.
We seek a diversity of views when it comes to IT delivery
Our mission statement is aligned across all teams that participate in the software development lifecycle. This also includes traditional "business"-functions.
None of the above

Describe how frequently does your team tries new ideas?
New Ideas breed innovation and trust among teams. Look to drive experimentation into your team's culture to improve on new ideas.*
All the time
Frequently
Occasionally
Periodically
Not very much. / Not at all.

Explain how your team establishes and maintains a unified and clear vision and direction
For DevOps to thrive, it's essential for both technical and non-technical teams to synchronize. Nontechnical stakeholders must actively engage, working alongside engineering teams to define realistic KPIs and SLAs. Meanwhile, technical teams should develop systems and processes that enhance software delivery efficiency and offer effective tools for conveying the value that DevOps brings to the organization. Choose the option that most closely applies to your organization.*
The overall direction is somewhat apparent but could benefit from further clarification or a clearer vision statement.
There may be a vision statement, but it may not be very broadly publicized. Not all team members are always aware of how their work contributes to a greater goal.
While there is a single vision statement, we have some more alignment work to do.
While a vision statement exists, it's not always clear how all work aligns to it.
Our organization strongly supports and aligns with a single clear vision.
Individuals can express what the mission is and how their work contributes to the vision.
There is little or no overall direction/vision.

How does your organization perceive culture change, considering it as either an ongoing, continuous effort or as a series of event-based initiatives?*
Consistently and openly monitoring your DevOps process enables teams to pinpoint potential areas for improvement. Choose the option that most closely aligns to your team's or organization's situation.
Our organization embraces DevOps throughout and is seeing benefits from having adopted a DevOps model.
While we have implemented many DevOps culture changes, we still have more work to do.
We embraced some DevOps culture changes but we have a long way to go and further changes to make.
Our organization has not embraced DevOps culture changes and our culture needs to change.

Explain how your team communicates and shares risks with other departments within the organization
DevOps involves not only experimentation but also fostering a culture of transparency, sharing, and collaboration. Inherent to experimentation are risks, and sharing these risks ensures that everyone is actively involved. This shared risk-taking fosters a deeper understanding between the business and IT, aligning their goals and facilitating collaboration.*
Our team jointly bears risks with various business teams.
Our team bears certain risks alongside different business teams.
Our team refrains from sharing risks with different business teams.

Does your team allocate time for innovation and learning activities?
Learning and innovation are interconnected. Without both happening, the organization becomes stagnant and vulnerable to competition and employee turnover.*
We promote a mindset of continuous growth.
We embrace failure as an opportunity for learning and integrate insights into our processes.
Employees have time to develop experimental projects to foster innovation.
Team members take a data-driven development approach.
None of the above

How seamless is the transition for your team to embrace the next innovation after facing a setback with a previous one?
The desire to learn can serve as a powerful motivator for many individuals. One of the key factors driving the team to embrace a DevOps mindset is their curiosity to consistently learn, adapt, and enhance their skills and knowledge through experiences, including failures. Review the below scenarios and pick the one that is most common in your team or organization.*
Consequences ensued, prompting us to return to the program.An example of this might be layoffs that are directly connected to a momentary setback.
We encounter significant resistance and are reminded of previous mishaps.
We face some resistance and are advised to improve in future attempts.
Presenting lessons learned allows us to receive the benefit of the doubt.
We are motivated to explore the impact through non-fatal experiments.

"*" indicates required fields

Step 1 of 40

Planning Cloud Journey Assessment Questionnaire
Digital transformation often requires skills across multiple roles and departments. This Cloud planning assessment questionnaire will walk you through a series of questions to evaluate your company’s readiness for moving to cloud & strategy.
Please take a moment to complete the questionnaire

Did you select a cloud provider but haven't deployed anything yet?
Did you select a cloud provider but haven't deployed anything yet?*
Deployed VMs or PaaS services but not a workload (or a list of IT assets that support specific business functions).
Deployed a workload (or a list of IT assets that support specific business functions.
Deployed multiple workloads (or a list of IT assets that support specific business functions.

What areas interest you?*
Estimating the cost of operating in the cloud.
Architecting your current environment in the cloud.
Getting the cloud infrastructure ready in preparation for deploying a workload to the cloud.
Deploying a workload to the cloud.
Managing operations.
Operational fitness.
Process improvement.

What are the motivations for your cloud transformation?*
Estimating the cost of operating in the cloud.
Architecting your current environment in the cloud.
Reduce capital expenses.
Scale to meet geographic or market demands.
Increase business agility.
Optimize internal operations.
Build new technical capabilities.
Modernize security posture and controls.
Improve customer experiences and engagements.
None of the above.
Don't know.

Do your developers understand cloud-computing concepts and general cloud computing models and services, such as public, private and hybrid cloud services, like IaaS, PaaS, and SaaS?*

Are you responding to any critical business events, mergers, and acquisition, end of support for mission-critical technologies, or response to regulatory compliance change?*

Have you got any plan for the business outcomes that you want when you move to the cloud?*

Do these outcomes have associated business drivers, KPIs, and necessary technical capabilities?*

Have you developed a business case or performance economic assessment that could help provide business justification for moving to the cloud?*

Have you selected an initial cloud workload?*

Does your organization use a financial model to account for IT costs, for example a cost-center, chargeback, or profit-center model?*

Do you understand how to manage costs with Cloud planning journey?*

Does your organizaton need to run workloads across public cloud and on premises (hybrid cloud)?*

Do assets within your workload require connectivity to an on-premises servers/ datacenter?*

Does your organization need to run workloads across multiple cloud providers, for example Azure and Amazon Web Services or Google Cloud Platform?*

Do you have an approved and comprehensive project plan to drive your organization through transformation?*

Do you have a thorough inventory of assets, including applications, software, hardware, operating systems, and system performance metrics in place?*

Have you assessed the inventory of your current digital estate, such as apps, data, infrastructure, and process?*

What are you doing to create a skills readiness plan? Are you willing to work with Services provider like us for IT Talent?*

Are you moving apps to the cloud without making any modifications and without the risk and cost associated with code changes?*

Are you making major revisions to incorporate new capabilities, meet scalability requirements, apply innovative DevOps practices, or minimize the use of virtual machines to work effectively on a cloud platform?*

Are you rebuilding an app from scratch by using Microsoft/AWS cloud technologies to expedite business innovation, use cloud-native technologies, and take advantage of advancements in services, such as AI and containerization?*

If you decide to migrate/innovate, have you identified the minimum viable product for migration/innovation and corresponding tools?*

Have you thought about the order and relevance of processes that are used in relocating workloads ? The processes are migrate, modernize, innovate, and relocate.*
Align to different phases in the cloud adoption journey and find the right guidance.

Have you done a migration readiness assessment?*

Have you categorized your workloads for migrate, modernize, innovate, and relocate?*

Have you categorized your workloads for migrate, modernize, innovate, and relocate?*

How are you governing your cloud environments?*
Identify business risks and your risk tolerance. Mitigate those risks with governance and compliance policies. Execute recurring governance processes to monitor policy adherence.

Have you documented the evolving business risks and the business tolerance for risks?*

Do you have policies and security settings in place that ensure you adhere to compliance requirements?*

Have you implemented processes to monitor violations and adherence to corporate policies?*

Do you have a clear inventory of assets across multiple clouds and have visibility into the run state of each asset?*

Have you documented the criticality and business value of each workload?*

Have you established clear performance expectations and business interruptions time/value metrics?*

Have you established controls and processes to ensure each state is properly configured and running in a well-governed environment?*

Are all your managed assets protected and able to be recovered by using baseline management tooling?*

Do you have monitoring strategy in place for each of the cloud deployment models? The models are infrastructure (compute, storage, and server workloads), application (end-user, exceptions, and client), and network resources.*

Have you aligned your strategy, plan, and architecture with the Zero Trust principles?*

Has your organization modernized security strategies, architectures, and technologies as you've adopted and operated in the cloud?*

Have you selected and implemented the security benchmark that's aligned with your organization's needs, regulatory compliances, and controls?*

"*" indicates required fields

Step 1 of 12

Power Platform Adoption Assessment Questionnaire
This assessment questionnaire will walk you through a series of questions to evaluate your company’s readiness for Power Platform suite of tools to automate and enhance your company’s productivity. Please take a moment to complete this questionnaire.
Please take a moment to complete the questionnaire

How does the organization promote collaboration and knowledge sharing among Power Platform makers?
Promoting collaboration and knowledge sharing is important to keep employees up-to-date, increase innovation and creativity, boost employee engagement, atract and retain talent and improve the overall performance of the organization.*
Hosting regular virtual or in-person meetups
Creating a knowledge sharing platform or community
Encouraging makers to work together in cross-functional teams
Developing a mentorship program
Organizing hackathons or other events that promote collaboration
The organization does not promote collaboration or knowledge sharing

Do app makers have a way to provide feedback? Is user feedback gathered to address any issues?
Providing feedback is important for improving the user experience, enhancing functionality, promoting adoption, encouraging innovation and driving accountability within an organization.*
Yes, app makers can provide feedback which is reviewed.
Yes, app makers can provide feedback but the extent to which it is addressed varies
No, app makers do not provide feedback

How does the Power Platform fit into the overall technology strategy of the organization?
The Power Platform plays a strategic role in an organizations technology strategy. Having a clear view on how this fits into your organizations overall technology strategy is key.*
Undefined, or unclear
Empowering users
Replacing legacy systems
Improving efficiency
Fostering innovation
Enhancing existing systems

Is there an executive sponsoring the adoption of the Power Platform?
Having an executive sponsor can bring several valuable benefits including visibility and commitment, leadership and guidance, and overcoming roadblocks.*

Yes.

No.

What strategies have been put in place for the assignment of licenses?
Having a strategy for assigning licenses can help your organization become more efficient, manage costs, enhance compliance, improve security and provide greater accountability and accountability.*
All users will get licenses
Assigned by job requirements
Pooled assignment (by group/ department, application or project)
Upon request
No license assignment strategy

Have resources, such as budget and personnel been allocated to support the implementation and use of the Power Platform?
Allocating personnel to support and drive adoption of the Power Platform is important to align with business goals, provide resources to effectively use the platform and ensure there is a dedicated team to implement and use the platform.*
No resources or budget allocated
Administration and support team
Developers
Trainers
Change managers
Project managers
Security and governance team(s)

How does the organization communicate the Power Platform strategy to employees and stakeholders?
Communicating the strategy is important to ensure broad alignment and that all employees and stakeholders are working towards the same goals, which can lead to improved performance, increased motivation and beter decision making.*
Clearly and frequently through various channels (company meetings, intranet, newsletters)
Communicated, but could be more effective and consistent.
Is not communicated to employees

How will the organization measure the success and ROI of the Power Platform investment?
Measuring the success and return on investment is critical for improving decision-making, demonstrating the value and driving business outcomes.*
Adoption rate
User satisfaction
Time savings
Cost savings
Not measured

How will the adoption and usage of the Power Platform be monitored and evaluated?
Monitoring and evaluating the adoption of Power Platform brings several benefits to an organization, including: improving user adoption, driving business outcomes and ensuring alignment with strategy.*
User surveys
Usage analytics
User feedback
Not measured

What kind of business problems that the Power Platform can help solve have been identified?
It is important to have business problems that the Power Platform can help solve because this powerful set of tools offers a wide range of capabilities to help organizations streamline operations and optimize workflows.*
Retiring legacy systems
Replacing 3rd party systems with in-house systems
Business process improvements
App modernization
New innovation
Reduced development and maintenance costs
No business problems

Are there quantifiable measures for tracking the value of solving business problems with the Power Platform?
Tracking the value of the problems you solve with the Power Platform is important for several reasons including: enabling data-driven decisions, demonstrating the return on investment, identifying areas of improvement, justifying ongoing investment and benchmarking.*
Retiring legacy systems
Replacing 3rd party systems with in-house systems
Increase in revenue
Decrease in cost
Time savings
Employee/ customer satisfaction
Reduction in error
Increase in employee engagement
No measures

"*" indicates required fields

Step 1 of 17

Cloud Migration Assessment Questionnaire
This Migration assessment questionnaire will walk you through a series of questions to evaluate your company’s readiness for cloud migration in various areas.
Please take a moment to complete the questionnaire

Has your company identified a compelling business reason for moving to the cloud?*

Yes.

No.

Do you have executive and stakeholder sign-off for your migration project, including committed funding?
Choose one that applies to you*
We have limited or no executive commitment to migrate
We've secured executive commitment, and a funding commitment is in progress.
We have both executive commitment and funding.

Have you created a business case in your org that's based on your on premises inventory and the scope of your migration project?
Choose one that applies to you*
We have no business case, or we're still working from high-level estimates.
We're in the process of refining a business case
We have a detailed business case that's been presented to the executive sponsor.

Have you identified the applications or workloads that you're migrating as part of this initiative?*

Yes.

No.

Do you have a data and workload classification strategy in place to identify sovereign data and workloads that use this data?*

Yes.

No.

Do you have a cloud data sovereignty and governance plan for performing tasks like encrypting data in transit and data at rest?*

Yes.

No.

Have you established a process to determine when to migrate versus when to modernize a workload?*

Yes.

No.

Have you determined if there are any specific workloads, that you need to migrate or that will remain on-premises, that might affect a financial service-level agreement (SLA)?*

Yes.

No.

Have you evaluated and documented business-critical dates that you need to consider for migration activities, such as license renewals or lease expirations?*

Yes.

No.

Which aspects related to securing your workloads do you plan to design? OR did you already design?*

Yes.

No.

Do you have a landing zone ready for migration, in accordance with the Cloud Adoption Framework migration guidance?*

Do you have people assigned to work on the migration who will be coordinating with our team, including a project manager, a cloud migration team, and application owners?*

Yes.

No.

Select the ones you have already designed

Do you have a plan for using cloud service provider Policy to ensure that resources are deployed in a consistent and repeatable way?*

Yes.

No.

Have you determined whether any regulatory or compliance requirements might affect your migration plans?*

Yes.

No.

For all workloads, have you determined the need for baseline objectives to ensure workload recovery and the backup of critical data if there's a disaster?*

Yes.

No.

Recent Post

Data, Privacy, and Security for Microsoft 365 Copilot

Banco Ciudad accelerates innovation and reduces time to market with AI, powered by Microsoft 365 Copilot, Copilot Studio, and Azure | Microsoft Customer Stories

Ransomware trends targeting storage systems

Carhartt gears up for growth with Azure VMware Solution | Microsoft Customer Stories

Schedule a consultation

Feel free to shoot us a message anytime!

Oh j uh s v ee

US OFFICE

Global Technology Delivery

Recent Post​