TuskerGauge Quick DevOps & DevSecOps Maturity Guide : 24-Question Self‑Assessment

DevOps and DevSecOps Maturity: The 24-Question Guide

We put this guide together to share the exact 24 questions we use during Stonetusker delivery audits. Each question covers a core engineering capability, scored from Not doing up to Visionary.

If you want to skip scoring this by hand, you can run through our free interactive assessment at TuskerGauge. We keep it updated with current industry shifts, covering everything from GitOps and Internal Developer Platforms to AI coding workflows and cloud cost governance. You get the complete questionnaire and a clear report on what to prioritize in about five minutes.

Get Your Quick DevOps Report with these 24 questions

Integration

Q1. Shared CI/CD Pipeline

Do all your teams build and deploy using a shared, standardised CI/CD pipeline?

Evaluates consistency and reuse of CI/CD tooling.

Low scores indicate fragmented pipelines; high scores indicate shared, automated paths.
Not doingNoviceIntermediateAdvancedExpertVisionary

Q2. Automated Testing on Every Change

Does automated testing, unit, integration, and security, run on every code change, including AI-generated ones?

Checks whether automation connects tools or humans act as glue.

Low scores rely on manual handoffs; high scores use APIs, events, and webhooks.
Not doingNoviceIntermediateAdvancedExpertVisionary

Testing

Q3. Deployment Confidence

Can you deploy to production any time you want, confidently, without a war room?

Measures depth of automated testing.

Low scores depend on manual QA; high scores validate changes automatically.
Not doingNoviceIntermediateAdvancedExpertVisionary

Q4. Progressive Delivery

Do you use canary releases or feature flags to control who sees new changes before full rollout?

Focuses on when defects are detected.

Low scores find issues late; high scores block issues early.
Not doingNoviceIntermediateAdvancedExpertVisionary

Culture

Q5. Infrastructure as Code

Is your infrastructure fully defined in code, no manual console changes, no click-ops?

Assesses cross-functional teamwork.

Low scores show silos; high scores show shared accountability.
Not doingNoviceIntermediateAdvancedExpertVisionary

Q6. Automated Security

Is security automated in your pipeline, SAST, dependency scanning, container checks, not just a manual review at the end?

Checks accountability clarity.

Low scores indicate blame culture; high scores indicate end-to-end ownership.
Not doingNoviceIntermediateAdvancedExpertVisionary

Infrastructure

Q7. Secrets Management

Are passwords, API keys, and certificates managed centrally, never hardcoded, pasted into an AI chat, or stored in plain text?

Evaluates repeatability and versioning.

Low scores rely on consoles; high scores rely on code and reviews.
Not doingNoviceIntermediateAdvancedExpertVisionary

Q8. Supply Chain Visibility

Do you know exactly what is in your software, an SBOM, and get alerted the moment something in it has a known vulnerability?

Checks configuration drift.

Low scores show snowflake environments; high scores recreate environments from code.
Not doingNoviceIntermediateAdvancedExpertVisionary

Leadership

Q9. Observability Maturity

Do you find out about production problems from your own monitoring, or from customer complaints?

Measures leadership commitment.

Low scores indicate ad-hoc support; high scores show strategic investment.
Not doingNoviceIntermediateAdvancedExpertVisionary

Q10. SLOs and Error Budgets

Have you defined SLOs for your critical services, and do you use error budgets to guide trade-offs between features and reliability?

Checks data-driven leadership.

Low scores rely on intuition; high scores use operational metrics.
Not doingNoviceIntermediateAdvancedExpertVisionary

SRE

Q11. Incident Learning

When an incident happens, do you run blameless postmortems and actually fix the root cause, not just the symptom?

Measures reliability maturity.

Low scores lack targets; high scores balance reliability and delivery.
Not doingNoviceIntermediateAdvancedExpertVisionary

Q12. GitOps Practice

Is Git the single source of truth for your infrastructure and application config, with no out-of-band manual changes?

Evaluates learning culture.

Low scores repeat incidents; high scores fix systemic causes.
Not doingNoviceIntermediateAdvancedExpertVisionary

Deployment

Q13. Platform Self-Service

Can a developer get a new environment, a database, or access to a service without raising a ticket and waiting days?

Measures release confidence.

Low scores mean stressful releases; high scores mean routine deployments.
Not doingNoviceIntermediateAdvancedExpertVisionary

Q14. AI Adoption Strategy

Are you using AI coding agents and AIOps tools with a real adoption strategy, and can you show the productivity gain, not just the seat count?

Checks blast-radius control.

Low scores deploy all-or-nothing; high scores deploy progressively.
Not doingNoviceIntermediateAdvancedExpertVisionary

Innovation

Q15. Cloud Migration Outcomes

If you are migrating workloads to cloud, do you have a clear plan, and are you actually realising the cost and performance benefits after migration?

Measures experimentation enablement.

Low scores fear change; high scores use guardrails.
Not doingNoviceIntermediateAdvancedExpertVisionary

Q16. Legacy Modernization

Are you modernising legacy systems incrementally, strangler fig style, rather than planning a big-bang rewrite?

Checks innovation scalability.

Low scores create chaos; high scores scale proven ideas.
Not doingNoviceIntermediateAdvancedExpertVisionary

Observability

Q17. Resilience Testing

Do you deliberately break things in controlled conditions to find weaknesses before they cause real outages?

Measures system insight.

Low scores struggle to debug; high scores diagnose quickly.
Not doingNoviceIntermediateAdvancedExpertVisionary

Q18. Compliance Automation

Are compliance checks automated and continuous, rather than a manual scramble before each audit?

Checks early-warning capability.

Low scores react to complaints; high scores detect early.
Not doingNoviceIntermediateAdvancedExpertVisionary

Design

Q19. Cloud Cost Ownership

Do engineering teams see the cloud and AI costs their services generate, and feel real ownership over reducing waste?

Measures design maturity.

Low scores bolt-on quality; high scores design for it.
Not doingNoviceIntermediateAdvancedExpertVisionary

Q20. DORA Metrics

Do you track the four DORA metrics, deploy frequency, lead time, change failure rate, and MTTR, and use them to make decisions?

Checks architectural hygiene.

Low scores rely on tribal knowledge; high scores use ADRs.
Not doingNoviceIntermediateAdvancedExpertVisionary

Security

Q21. Shared Ownership

Do your developers, ops, and security people work as one team, or do they still throw work over the wall to each other?

Measures DevSecOps maturity.

Low scores are manual; high scores are continuous.
Not doingNoviceIntermediateAdvancedExpertVisionary

Q22. Leadership Protection

Does leadership actively protect engineering time for reliability and technical improvement, not just feature delivery?

Checks follow-through.

Low scores lose findings; high scores close them.
Not doingNoviceIntermediateAdvancedExpertVisionary

Cost Optimization

Q23. Developer Experience

How much of your developers' day is spent on actual building, versus fighting tools, waiting for environments, or doing repetitive manual work?

Measures financial transparency.

Low scores see surprise bills; high scores review costs regularly.
Not doingNoviceIntermediateAdvancedExpertVisionary

Q24. Innovation Time

Do your teams have dedicated time to experiment, improve their tools, and explore new approaches, or is it all delivery, all the time?

Checks proactive cost control.

Low scores react to overruns; high scores optimize continuously.
Not doingNoviceIntermediateAdvancedExpertVisionary

Turn Your Answers Into an Actionable Roadmap

Complete the assessment to receive a clear maturity profile and prioritized recommendations for your next 90 days.

Book a Free 30-Minute Review
Copyright 2026 Stonetusker Systems Private Limited. Built by engineers, for engineers.