WHERE DO YOU STAND · TWELVE QUESTIONS

Twelve questions.
One honest reading.

One question for each service area of the method, answered on the same ladder the courses teach, from 0 (reactive) to 4 (automated). It takes about four minutes. The result is drawn here and kept nowhere: nothing is stored or sent.

Start How the ladder works

HOW TO ANSWER

Pick the line that is true today, not the one you are working toward.

A higher level is not "more compliant". The right target for an area depends on what the requirement asks for and how fast that part of the estate changes. In the method, a person assigns every level from evidence the organization already holds; here, you are the person, and your honesty is the evidence.

THE READING

Twelve areas, one ladder.

01Governance and strategyHow are cloud decisions made in your organization?0Whoever is loudest in the room decides, and it is not written down.1There is a strategy document somewhere; decisions still happen outside it.2A named forum decides, against a written strategy and standards, and records why.3The forum meets on its own cadence, its decisions are tracked, and the strategy is revisited on a schedule.4Decisions, exceptions and their follow-through are visible on one dashboard the sponsors read.

02Cloud foundation and platformHow well is your landing zone, identity and network boundary defined?0Accounts and networks grew one request at a time; nobody holds the whole picture.1A diagram exists; it does not match what is deployed.2A named owner attests to a written foundation design: segmentation, identity, privileged access and boundary.3The design is reviewed on a cadence and drift is found and closed through change management.4The platform is declared as code, and the evidence of its state is produced by the toolchain as it changes.

03Operations and service managementHow does a new workload get into production and stay supported?0Someone knows someone; onboarding is a favor.1There is an intake form; day-two support is whoever built it.2A service catalog, an onboarding process and support tiers are written, owned and attested.3Incident, change, problem and request run through one framework with records that show follow-through.4Operational metrics and service reporting come from the systems of record, reviewed on a cadence.

04Security, risk management and controlsWhere does your authorization package stand?0There is no current system security plan; findings live in email.1A plan exists from a past effort; the plan of action is not maintained.2The plan, control matrix, plan of action and inheritance mapping are written, owned and attested current.3Continuous monitoring runs at its stated interval and consecutive records show closure.4Vulnerability, configuration and compliance evidence is produced by the toolchain as the environment changes.

05Applications and workloadsHow well do you know what you run and what it touches?0No inventory anyone trusts.1An inventory exists; ownership and data sensitivity are blank for most entries.2Inventory, ownership, data classification and dependencies are written and attested by named owners.3Readiness assessments are performed on a cadence and the candidate list is maintained through it.4Dependency and readiness data is discovered and refreshed by tooling, and reviewed before each wave.

06Data, integration and interfacesCan you show how data moves and how it is protected?0Interfaces are discovered when they break.1A data flow drawing exists for the main systems only.2Data flows, interfaces, systems of record, encryption and key management are documented and attested.3The inventory is reviewed on a cadence; retention and lineage decisions are recorded.4Interface and data-protection evidence is generated from the platform and reconciled automatically.

07Finance, contracts and investmentHow is cloud spending planned and controlled?0Spend is discovered on the invoice.1There is a budget line; nobody can say what it bought.2A funding plan, a cost model and a contract and licensing register are written and owned.3Showback or chargeback runs monthly and the investment roadmap is revisited on a schedule.4Cost, commitment and anomaly evidence is produced continuously and read by the people who decide.

08Roadmap, risks and decisionsIs there a road, and does it name its gates?0A slide with dates on it.1A plan that does not show the authorization lead time or who decides.2A written road with horizons, decision gates, a risk register and a decision log, owned and attested.3Gates are reviewed as scheduled; blockers and decisions are tracked to closure.4The road, its risks and its gate status are kept current from the systems of record and read on the sponsors' cadence.

09Zero trust and cyber defenseHow far along is zero trust, in practice rather than in product names?0Zero trust is a vendor conversation.1Pillars have been named; there is no current target state or roadmap.2A pillar-by-pillar maturity reading and target roadmap are written and owned; device trust is defined.3Progress against the roadmap is measured on a cadence and device compliance is enforced through the framework.4Pillar evidence is produced by the control plane and reviewed as the estate changes.

10DevSecOps, pipeline and reliabilityHow does software reach production, and how do you know it is healthy?0Builds are run by hand; nobody can say what is in production.1A pipeline exists for some teams; promotion gates and scanning are optional.2An authorized pipeline with scanning, gated promotion, infrastructure as code and service objectives is written and owned.3Supply-chain integrity (images, SBOM, signing) and objectives are measured and reviewed on a cadence.4Pipeline, provenance and reliability evidence is produced on every change and admission is enforced.

11Workforce and adoptionDo you have the people, and a plan for the ones you do not?0Cloud skills are whoever learned on the side.1Training was bought once; there is no inventory of who can do what.2A skills inventory, gap assessment and development plan are written and owned.3The plan is executed on a schedule, and hiring and upskilling are tracked against it.4Skills, certifications and role coverage are kept current in the systems of record and reviewed each quarter.

12Migration execution and wavesIf a wave started Monday, what would happen?0Nobody has moved anything yet, and the plan assumes it will go well.1A wave plan exists without gate criteria, factory tooling or a tested rollback.2Wave plan, gate criteria, factory tooling and rollback are written, owned and rehearsed once.3Waves run through the framework on their cadence; each one records its gate decisions and lessons.4Wave readiness, cut-over and rollback evidence is produced by the tooling and reviewed before each gate.

NOVEMBER LAUNCH

The courses open in November 2026.

Foundations first, then the specialty for your sector. See the courses.

Twelve questions.
One honest reading.

Pick the line that is true today, not the one you are working toward.

Twelve areas, one ladder.

Where you stand today.

Start here

The courses open in November 2026.

Twelve questions.One honest reading.

Pick the line that is true today, not the one you are working toward.

Twelve areas, one ladder.

Where you stand today.

Start here

The courses open in November 2026.

Twelve questions.
One honest reading.