Cloud Maturity Assessment — Oasis Stack Insights

The five levels

Where most estates sit, and what comes next.

No level is a verdict. Most organisations sit at different levels in different domains, and the gaps between them are the useful part.

1Traditional infrastructurePhysical servers and manual provisioning. Start with visibility: know what you run, where it runs and who owns it.
2VirtualisedWorkloads are virtualised and centrally managed, but provisioning and governance still depend on people doing things by hand.
3Hybrid-cloud enabledOn-premises and cloud work together under central management. Consistency across them is the next gap to close.
4Optimised multi-cloudSeveral environments run under one catalogue and one policy model. Automation and cost ownership decide the next step.
5AutonomousPolicy, recovery and scaling are automated. The work now is keeping it that way as the estate grows.

The self-check

Answer for how it works today.

If two statements are both partly true, choose the lower one. The result is only as honest as the answers.

01Cloud strategy & governanceHow are cloud decisions made and governed?

Level 1There is no written cloud strategy; infrastructure is decided project by project. Level 2A strategy exists on paper, but ownership and funding sit with individual teams. Level 3A strategy and operating model are agreed, with an executive sponsor and written policies. Level 4Policies apply to every platform we run, and spend is tied to named business owners. Level 5Policy is checked automatically before anything is provisioned, and reported continuously.

02Infrastructure & platformWhat does your infrastructure look like today?

Level 1Mostly physical servers, provisioned by hand. Level 2Most workloads are virtualised; compute and storage are centrally managed. Level 3On-premises and cloud run under central management, and teams can self-serve some resources. Level 4Several environments are managed through one catalogue, with capacity planned from real usage. Level 5The platform scales, heals and rebalances itself; people handle exceptions, not routine.

03Security & riskHow is access controlled and how are threats handled?

Level 1Perimeter firewall and antivirus; access is granted manually and rarely reviewed. Level 2Central identity and multi-factor login for administrators; patching runs on a schedule. Level 3Least-privilege roles, encryption, and a SOC or SIEM watching the main systems. Level 4Users, devices and sessions are verified continuously; privileged access is recorded. Level 5Threats are detected and contained automatically, and controls are tested continuously.

04Compliance & data residencyCould you prove where your data lives and who touched it?

Level 1Not quickly — we could not say where every dataset and backup lives. Level 2Data locations are documented, and audits are prepared by hand before each review. Level 3Residency rules are defined per data class, and evidence is collected for our main frameworks. Level 4The platform enforces residency and access rules and records the evidence as work happens. Level 5Drift is detected and corrected automatically, and auditors can read the evidence directly.

05Operations & service managementHow are services run day to day?

Level 1Incidents and changes are handled by email and phone. Level 2A service desk records incidents and changes; monitoring covers the main systems. Level 3Every service has an owner, agreed service levels and a capacity plan. Level 4One operations view covers every environment, and service quality is reviewed with data. Level 5Issues are predicted and often fixed before users notice.

06Automation & DevOpsHow are environments and releases built?

Level 1Servers and environments are built by hand. Level 2Scripts automate some builds, but deployments still need manual steps. Level 3Some teams use infrastructure as code and CI/CD pipelines. Level 4Most environments and releases are automated from shared templates. Level 5Provisioning, release and rollback are automated and self-service for every team.

07Cost optimisation & FinOpsWho sees and owns infrastructure cost?

Level 1Infrastructure is one budget line; nobody sees cost by service. Level 2Bills are reviewed monthly, after the money is spent. Level 3Costs are tagged by team or project and reported regularly. Level 4Showback or chargeback is in place, and teams own their consumption. Level 5Spend is forecast and governed continuously, and idle capacity is reclaimed automatically.

08Business continuity & DRWhat happens if a site or a system fails?

Level 1Backups exist, but restores are rarely tested. Level 2A disaster recovery plan exists for key systems and is tested occasionally. Level 3Recovery objectives are agreed per service, and recovery is tested on a schedule. Level 4Recovery runs from the same platform as production, tiered per workload and tested regularly. Level 5Failover is automated and rehearsed; continuity is designed in, not bolted on.

0 of 8 answered

Your overall maturity

0.0/ 5

Scorecard by domain
Domain	Score	Score out of 5	Level

Where to start

Your two lowest domains.

Talk through the result

Go deeper

The reference behind the questions.

The Cloud Migration Playbook

Readiness, the 6 Rs, waves and the checklist for moving without breaking things.

Cloud Maturity
Assessment.

Where most estates sit, and what comes next.

Answer for how it works today.

Your two lowest domains.

The reference behind the questions.

A scorecard is a starting point.

Cloud MaturityAssessment.

Where most estates sit, and what comes next.

Answer for how it works today.

Your two lowest domains.

The reference behind the questions.

A scorecard is a starting point.

Cloud Maturity
Assessment.