research-document

Software-company assessment portfolio recommendations

Research Area: General Research
Status: draft
Version: 0.1
Priority: medium
Updated: 2026-07-22
Source: assessments/revised/ASSESSMENT-PORTFOLIO-RECOMMENDATIONS.md

Software-company assessment portfolio recommendations

Purpose

This catalog proposes additional assessments that fit the general structure of the existing JSON files: a named assessment containing sections, observable statements, response options, and score direction. It expands the portfolio from team-level Agile practices into a balanced evaluation of a software company's product, engineering, operational, commercial, governance, and people systems.

The catalog is intentionally broad. It is a menu, not a recommendation to administer every assessment to every company. Applicability gates should remove irrelevant modules before scoring.

Priority and scope

P0 — foundation: broadly useful to almost every software company and materially missing from the current portfolio
P1 — important: high-value for most product and engineering organizations
P2 — situational: important for a particular operating model, technology, scale, or risk profile
P3 — specialist: valuable for deep diligence, regulated contexts, or targeted improvement
Level: company, portfolio, product, platform, team, or individual

Current coverage and major gaps

The existing files cover team structure, workflow, working agreements, planning, goals, stories, Scrum events, learning, several engineering practices, psychological safety, customer centricity, leadership, scaling, UX integration, distributed work, and Scrum Master feedback.

They do not yet provide a balanced company view. In particular:

delivery activities are measured more often than customer or business outcomes;
security, privacy, reliability, accessibility, data, AI, architecture, and technology economics are largely absent;
there is little coverage of product strategy, pricing, portfolio allocation, organizational design, talent systems, or commercial execution;
several important lenses need both capability and outcome measures to avoid rewarding process adoption without results;
company-level assessments need applicability, evidence, confidence, and respondent-segmentation fields that the current schema does not contain.

Recommended assessments

1. Strategy, governance, and operating model

Priority	Assessment	Level	Primary respondents	What it should evaluate
P0	Technology strategy alignment	Company	Executives, product and technology leaders	Whether technology choices, investments, and capabilities support explicit company strategy and differentiators.
P0	Product operating model	Company	Executives, product, design, engineering	Durable product ownership, outcome accountability, discovery-delivery integration, funding, and decision rights.
P0	Decision effectiveness	Company	Cross-functional sample	Decision clarity, participation, speed, evidence, reversibility, escalation, and follow-through.
P0	Organizational design for flow	Company	Executives and delivery groups	Whether boundaries, accountabilities, and dependencies enable end-to-end value flow.
P0	Portfolio investment and prioritization	Portfolio	Executives, finance, product, technology	Strategy-to-investment traceability, opportunity cost, capacity allocation, stopping rules, and rebalancing.
P1	Governance fitness	Company	Legal, risk, security, product, engineering	Whether controls are proportionate, automated where appropriate, outcome-oriented, and timely.
P1	Transformation readiness and change capacity	Company	Leaders and representative teams	Case for change, sponsorship, capacity, sequencing, local ownership, feedback, and change fatigue.
P1	Organizational learning system	Company	Broad sample	Experimentation, review quality, knowledge propagation, double-loop learning, and verified improvement.
P1	Strategy communication and coherence	Company	Broad sample	Whether people understand strategic choices, tradeoffs, boundaries, and how their work contributes.
P1	Accountability and decision-right clarity	Company	Cross-functional sample	Clear ownership without centralized bottlenecks; explicit consult, approve, and escalation paths.
P2	Merger, acquisition, and integration readiness	Company	Executives, architecture, security, operations	Technical diligence, integration thesis, systems/data mapping, talent retention, and synergy validation.
P2	Geographic and legal-entity operating readiness	Company	Operations, legal, security, finance	Cross-border data, employment, tax, service, support, and operational dependencies.
P2	Business continuity governance	Company	Executives, risk, operations	Critical-service ownership, continuity priorities, exercises, dependencies, and executive decisions.
P3	Board technology oversight	Company	Board and executives	Board fluency, risk appetite, investment oversight, leading indicators, and challenge quality.
P3	Regulatory change readiness	Company	Legal, compliance, product, technology	Horizon scanning, applicability decisions, control change, evidence, and product impact management.

2. Product strategy, discovery, and customer value

Priority	Assessment	Level	Primary respondents	What it should evaluate
P0	Product strategy quality	Product	Product, design, engineering, executives	Target customer, differentiated value, strategic choices, coherent advantage, and testable assumptions.
P0	Product discovery effectiveness	Product	Product trio and researchers	Continuous discovery, problem validation, assumption testing, evidence quality, and learning speed.
P0	Outcome measurement	Product	Product, analytics, finance	Clear outcome models, baseline quality, leading/lagging measures, countermetrics, and decision use.
P0	Product-market fit evidence	Product	Executives, product, sales, customer success	Retention, pull, willingness to pay, segment consistency, alternatives, and evidence uncertainty.
P0	Customer feedback system	Product	Product, research, support, sales	Representative listening channels, synthesis, closed loops, prioritization influence, and bias controls.
P1	Roadmap quality and adaptability	Product	Product and stakeholders	Outcome orientation, uncertainty, options, dependencies, communication, and response to evidence.
P1	Product experimentation	Product	Product, data, engineering, legal	Hypothesis quality, experiment design, ethics, statistical/qualitative rigor, and decision rules.
P1	User research operations	Company	Research, design, legal, product	Recruitment, consent, representation, repository quality, privacy, access, and insight reuse.
P1	Product analytics maturity	Product	Product, data, engineering	Instrumentation quality, metric definitions, identity, funnels, cohorts, causal limits, and actionability.
P1	Voice-of-customer integration	Company	Product, support, sales, success	Unification of qualitative and quantitative signals across the customer lifecycle.
P1	Product portfolio coherence	Portfolio	Executives and product leaders	Product roles, overlap, shared capabilities, cannibalization, lifecycle stage, and investment logic.
P1	Product lifecycle management	Product	Product, finance, support, engineering	Introduction, growth, maintenance, deprecation, migration, and end-of-life discipline.
P2	Internationalization and localization readiness	Product	Product, design, engineering, support	Locale design, translation operations, cultural adaptation, formats, expansion testing, and support.
P2	Marketplace or ecosystem health	Product	Product, partnerships, developer relations	Participant value, liquidity, governance, quality, incentives, trust, and ecosystem concentration.
P2	API product management	Product	Product, architecture, developer relations	Consumer discovery, contract quality, lifecycle, documentation, reliability, pricing, and adoption.
P2	Mobile product quality	Product	Mobile product and engineering	Store operations, device coverage, offline behavior, release constraints, telemetry, and accessibility.
P2	Enterprise product readiness	Product	Product, sales, security, support	Administration, identity, auditability, integrations, procurement evidence, deployment, and supportability.
P3	Product ethics and harmful-use review	Product	Product, legal, trust, research	Affected parties, foreseeable misuse, vulnerable groups, mitigations, monitoring, and appeal.

3. Customer experience, service, and commercial execution

Priority	Assessment	Level	Primary respondents	What it should evaluate
P0	End-to-end customer journey	Company	Product, marketing, sales, support, success	Friction and continuity from awareness through purchase, onboarding, use, renewal, and exit.
P0	Customer onboarding effectiveness	Product	Product, success, support, analytics	Time to first value, setup burden, guidance, activation, accessibility, and early failure recovery.
P0	Customer support capability	Company	Support, product, engineering	Access, responsiveness, resolution, knowledge, escalation, learning loops, and vulnerable customers.
P0	Customer retention and expansion system	Company	Success, product, sales, finance	Health signals, realized value, risk detection, renewal integrity, expansion, and churn learning.
P1	Service design maturity	Company	Design, operations, product	Frontstage/backstage coherence, handoffs, failure demand, policies, and service recovery.
P1	Pricing and packaging quality	Company	Product, finance, sales, marketing	Value metric, segment fit, simplicity, fairness, experimentation, margins, and change management.
P1	Sales-to-delivery integrity	Company	Sales, product, services, engineering	Promise quality, feasibility, exception control, handoff, customization debt, and feedback.
P1	Implementation and professional-services health	Company	Services, product, sales, success	Repeatability, time to value, scope control, knowledge transfer, margins, and product feedback.
P1	Developer experience for external users	Product	Developer relations, API users, product	Discoverability, time to first success, docs, tooling, error quality, support, and community.
P2	Partner and channel readiness	Company	Partnerships, sales, product, legal	Partner value, enablement, incentives, conflict, quality, data, and performance governance.
P2	Trust-center and buyer-assurance readiness	Company	Security, legal, sales, marketing	Accurate reusable evidence, questionnaire operations, transparency, commitments, and update cadence.
P2	Community health	Product	Community, developer relations, support	Participation, inclusion, moderation, responsiveness, contributor pathways, and community value.
P3	Digital commerce integrity	Product	Product, legal, finance, support	Consent, cancellation, refunds, pricing transparency, dark-pattern avoidance, and dispute handling.

4. Software delivery and developer effectiveness

Priority	Assessment	Level	Primary respondents	What it should evaluate
P0	Software delivery performance	Team/product	Engineering and delivery leaders	Lead time, deployment frequency, failed-deployment recovery, change failure, rework, context, and trends.
P0	Developer experience	Company/team	Engineers and enabling teams	Feedback loops, cognitive load, flow, tools, documentation, interruptions, satisfaction, and local context.
P0	Code maintainability	Product	Engineers and architecture	Understandability, modularity, change risk, duplication, dependency health, ownership, and maintainability evidence.
P0	Continuous delivery capability	Product	Engineering, QA, operations	Deployability, build/test feedback, release safety, environment consistency, rollback, and routine releases.
P0	Test strategy and quality engineering	Product	Engineering, QA, product	Risk-based coverage, test layers, reliability, data, environments, exploratory testing, and escaped defects.
P1	Continuous integration effectiveness	Product/team	Engineers	Integration frequency, branch life, build health, feedback time, repair, and merge risk.
P1	Engineering planning and predictability	Team/product	Engineering and product	Forecast calibration, uncertainty, throughput/flow, dependencies, risk, and learning—not estimate compliance.
P1	Technical debt management	Product/portfolio	Engineering, product, finance	Debt definition, impact evidence, prioritization, prevention, repayment outcomes, and strategic tradeoffs.
P1	Documentation and knowledge health	Company/product	All technical roles	Discoverability, accuracy, ownership, freshness, decision records, onboarding value, and retirement.
P1	Engineering standards effectiveness	Company	Engineers, security, architecture	Minimum standards, local flexibility, automated enforcement, exception paths, outcomes, and evolution.
P1	Inner-source and code reuse	Company	Platform, architecture, engineers	Discoverability, contribution model, stewardship, reuse economics, support, and dependency risk.
P1	Release management	Product	Product, engineering, operations, support	Readiness, coordination, communication, rollout, rollback, evidence, and post-release verification.
P1	Environment and test-data management	Product	Engineering, QA, security	On-demand access, fidelity, isolation, privacy, reset, ownership, cost, and bottlenecks.
P2	Legacy modernization readiness	Product/portfolio	Architecture, engineering, product, finance	Business case, system knowledge, strangulation options, data migration, risk, and incremental validation.
P2	Mainframe or packaged-system delivery	Product	Relevant engineering groups	Versioning, automation, testing, environment constraints, integration, deployment, and vendor dependencies.
P2	Firmware and embedded delivery	Product	Hardware/software engineering	Hardware-in-loop testing, traceability, safety, updateability, compatibility, and field recovery.
P2	Open-source consumption and contribution	Company	Engineering, legal, security	Selection, licensing, provenance, maintenance, vulnerability response, contribution, and community health.
P2	Remote and distributed engineering	Company/team	Broad sample	Time-zone design, inclusion, asynchronous clarity, synchronous access, tooling, social connection, and progression equity.
P3	Software estimation system	Company/team	Product and engineering	Estimate purpose, calibration, uncertainty ranges, aggregation errors, incentives, and decision usefulness.

5. Architecture, platforms, and technical strategy

Priority	Assessment	Level	Primary respondents	What it should evaluate
P0	Architecture fitness and evolvability	Product	Architecture and engineering	Changeability, boundaries, coupling, fitness functions, decision records, reversibility, and evolutionary path.
P0	Platform engineering product maturity	Platform	Platform teams and internal users	User research, paved paths, self-service, adoption, task success, reliability, satisfaction, and platform outcomes.
P0	Service ownership	Product	Engineering and operations	Named ownership, lifecycle responsibility, operational readiness, documentation, dependencies, and escalation.
P1	API and integration architecture	Company/product	Architecture, engineers, consumers	Contract design, compatibility, discovery, lifecycle, resilience, security, observability, and ownership.
P1	Cloud architecture fitness	Product	Architecture, SRE, security, FinOps	Reliability, security, performance, portability choices, operability, cost, and sustainability tradeoffs.
P1	Data architecture	Company/product	Data and application architecture	Ownership, contracts, lineage, interoperability, quality, privacy, retention, and evolution.
P1	Dependency and component health	Product	Engineering, security, architecture	Inventory, freshness, support, criticality, upgradeability, provenance, concentration, and removal.
P1	Technical strategy and roadmapping	Company	CTO staff, architecture, product	Capability gaps, strategic bets, sequencing, evidence, options, investment, and retirement plans.
P1	Build-versus-buy decision quality	Company	Product, technology, finance, procurement	Differentiation, total cost, risk, exit, integration, data, talent, and decision review.
P2	Distributed-systems resilience	Product	Architecture, SRE, engineering	Failure modes, timeouts, retries, idempotency, consistency choices, backpressure, isolation, and testing.
P2	Multi-tenancy architecture	Product	Architecture, security, operations	Isolation, noisy-neighbor control, customization, data boundaries, observability, and unit economics.
P2	Edge and offline architecture	Product	Architecture and product engineering	Synchronization, conflict resolution, local security, degraded operation, observability, and updates.
P2	Architecture governance	Company	Architecture and engineering	Decision proximity, standards, exceptions, review latency, evidence, enablement, and outcomes.
P3	Cryptographic agility	Company/product	Security and architecture	Algorithm inventory, key lifecycle, dependency mapping, rotation, migration, and future threat readiness.

6. Reliability, operations, and resilience

Priority	Assessment	Level	Primary respondents	What it should evaluate
P0	Reliability engineering	Product	SRE, engineering, product	User-centered SLIs/SLOs, error budgets, reliability work, ownership, and tradeoffs.
P0	Observability and production insight	Product	Engineering and operations	Signals, context, correlation, cardinality, diagnostic workflows, ownership, cost, and decision usefulness.
P0	Incident management	Company/product	Operations, engineering, support, leadership	Detection, command, communication, mitigation, customer care, evidence preservation, and learning.
P0	Operational readiness	Product	Engineering, operations, security, support	Runbooks, capacity, telemetry, alerts, dependencies, recovery, ownership, and launch criteria.
P1	Post-incident learning	Company	Broad incident participants	Psychological safety, causal depth, contributing conditions, actions, verification, and pattern learning.
P1	On-call health	Company/team	On-call staff and leaders	Load, fairness, readiness, compensation, interrupt quality, escalation, recovery, and burnout risk.
P1	Capacity and performance engineering	Product	Engineering, SRE, product	User-relevant budgets, load models, headroom, testing, bottleneck analysis, forecasting, and regression control.
P1	Backup, restore, and disaster recovery	Product/company	Operations, security, business owners	Data criticality, RPO/RTO, isolation, restore testing, failover, dependencies, and exercise learning.
P1	Change and production-risk management	Product	Engineering, operations, risk	Change risk classification, safeguards, progressive delivery, emergency paths, rollback, and learning.
P1	Alerting effectiveness	Product	On-call teams	User impact, actionability, precision, routing, deduplication, ownership, and continuous tuning.
P2	Chaos and resilience testing	Product	SRE and engineering	Hypotheses, blast-radius control, steady-state measures, recovery validation, learning, and follow-up.
P2	Major-incident executive readiness	Company	Executives, communications, legal, security	Decision roles, communications, materiality, customer/regulator duties, exercises, and continuity.
P2	Service dependency resilience	Portfolio	Architecture, SRE, vendors	Critical dependency mapping, failure behavior, concentration, contractual recovery, and alternatives.
P3	Safety-critical software assurance	Product	Safety, engineering, quality, legal	Hazard analysis, traceability, independence, verification, change control, evidence, and field monitoring.

7. Cybersecurity, privacy, trust, and compliance

Priority	Assessment	Level	Primary respondents	What it should evaluate
P0	Cybersecurity governance	Company	Executives, security, risk	Risk appetite, ownership, inventory, policy, resources, metrics, third parties, and oversight.
P0	Secure software development lifecycle	Company/product	Security and engineering	Governance, threat-informed design, secure implementation, verification, and operational response.
P0	Identity and access management	Company/product	Security, IT, engineering	Identity lifecycle, least privilege, strong authentication, service identities, review, and recovery.
P0	Vulnerability management	Company/product	Security, engineering, operations	Discovery, asset context, prioritization, remediation, exceptions, verification, and trends.
P0	Privacy engineering and data protection	Company/product	Privacy, legal, security, product, data	Purpose, minimization, consent/lawful basis, rights, retention, sharing, security, and impact assessment.
P1	Application security architecture	Product	Security and architecture	Threat modeling, trust boundaries, abuse cases, secure patterns, secrets, and design verification.
P1	Security testing effectiveness	Product	Security, QA, engineering	Risk-based SAST/DAST/SCA/manual testing, signal quality, coverage, remediation, and validation.
P1	Secrets and key management	Company/product	Security, platform, engineering	Generation, storage, access, rotation, revocation, audit, and developer usability.
P1	Security incident response	Company	Security, legal, operations, communications	Detection, containment, forensics, decisions, notification, recovery, and lessons.
P1	Software supply-chain security	Company/product	Security, build/platform, procurement	Provenance, SBOM, trusted builds, dependencies, signing, tamper resistance, and response.
P1	Third-party and vendor risk	Company	Procurement, security, legal, owners	Criticality, due diligence, contracts, monitoring, concentration, incidents, exit, and data return.
P1	Security culture and enablement	Company	Broad sample	Role-based training, usable controls, security champions, reporting, incentives, and learning.
P1	Data classification and handling	Company	Data owners, security, privacy, users	Classification usability, discovery, handling controls, sharing, retention, and disposal.
P1	Compliance evidence operations	Company	Compliance, control owners, engineering	Control ownership, evidence automation, freshness, exceptions, mappings, and audit sustainability.
P2	Zero-trust architecture	Company	Security, IT, architecture	Explicit verification, identity/device posture, segmentation, policy, telemetry, and continuous evaluation.
P2	Fraud and abuse prevention	Product	Trust, security, data, support	Threat discovery, controls, detection, human review, appeals, adversarial adaptation, and user harm.
P2	Insider-risk management	Company	Security, HR, legal, privacy	Proportionate access, behavioral signals, due process, privacy, investigation, and offboarding.
P2	Security questionnaire and assurance response	Company	Security, sales, legal	Reusable accurate evidence, ownership, response time, commitments, and product feedback.
P2	Payment security	Product	Security, finance, engineering	Scope reduction, card-data flows, access, monitoring, testing, providers, and incident response.
P3	Threat intelligence and detection engineering	Company	Security operations	Relevant threat models, telemetry coverage, hypothesis-driven detections, validation, tuning, and response links.
P3	Export control and sanctions readiness	Company/product	Legal, sales, security, product	Product classification, user/location controls, screening, licensing, updates, and evidence.

8. Data, analytics, machine learning, and AI

Priority	Assessment	Level	Primary respondents	What it should evaluate
P0	Data governance	Company	Data, privacy, security, business owners	Ownership, catalog, definitions, access, quality, lineage, retention, sharing, and accountability.
P0	Data quality management	Company/product	Data producers and consumers	Critical data, contracts, validation, observability, issue ownership, impact, and improvement.
P0	Responsible AI governance	Company	Executives, legal, risk, data/AI, security	Inventory, risk tiering, roles, policy, affected parties, approval, monitoring, incidents, and retirement.
P0	AI-assisted software development	Company/team	Engineers, security, legal, leaders	Use-case fit, policy clarity, data/code protection, review, testing, skill, productivity, quality, and risk.
P1	Analytics engineering	Company	Data and analytics teams	Versioning, testing, lineage, definitions, review, deployment, observability, and consumer trust.
P1	Data platform maturity	Platform	Data platform and users	Self-service, reliability, discoverability, governance, task success, adoption, cost, and satisfaction.
P1	Machine-learning lifecycle	Product	ML, data, product, operations	Problem fit, data, experiments, validation, deployment, monitoring, retraining, rollback, and retirement.
P1	Model evaluation and validation	Product	ML, domain experts, risk	Baselines, representativeness, performance slices, uncertainty, robustness, independent review, and limits.
P1	Model monitoring and AI observability	Product	ML operations, product, risk	Drift, quality, safety, cost, latency, incidents, feedback, and change detection.
P1	Generative-AI application quality	Product	Product, AI, security, domain experts	Task success, grounding, hallucination, robustness, safety, latency, cost, fallback, and human oversight.
P1	AI red teaming and abuse testing	Product	Security, AI safety, product	Threat actors, harmful capabilities, prompt attacks, data leakage, tool abuse, mitigations, and retesting.
P1	AI data and knowledge readiness	Company/product	Data, knowledge owners, AI teams	Authority, quality, permissions, retrieval fitness, freshness, provenance, and feedback.
P1	Human-AI interaction	Product	Design, research, product, risk	User understanding, calibration, control, disclosure, override, contestability, accessibility, and failure recovery.
P1	AI vendor and foundation-model risk	Company/product	AI, procurement, legal, security	Data use, model changes, availability, security, rights, concentration, evaluation, portability, and exit.
P2	Fairness and impact assessment	Product	Domain experts, research, legal, AI	Affected groups, allocation/quality harms, measurement limits, mitigations, monitoring, and recourse.
P2	MLOps platform maturity	Platform	ML platform and users	Reproducibility, feature/data lineage, deployment, environments, registry, monitoring, security, and usability.
P2	Decision-automation controls	Product	Product, risk, operations, AI	Materiality, automation boundaries, human review, reasons, appeals, override, audit, and incidents.
P2	Synthetic data governance	Company/product	Data, privacy, AI, risk	Purpose, fidelity, disclosure risk, bias, provenance, validation, and downstream restrictions.
P2	AI agent safety and control	Product	AI, security, product, operations	Tool permissions, identity, action bounds, approval, state, observability, rollback, and containment.
P3	Scientific and causal inference rigor	Product/company	Data science and decision-makers	Identification, assumptions, power, uncertainty, multiplicity, reproducibility, and decision relevance.

9. Accessibility, inclusion, ethics, and human impact

Priority	Assessment	Level	Primary respondents	What it should evaluate
P0	Digital accessibility capability	Company/product	Product, design, engineering, QA, legal	Ownership, standards, design, implementation, testing, procurement, feedback, and remediation.
P0	Inclusive product design	Product	Research, design, product	Representative participation, exclusion analysis, language, context, affordability, and adaptive use.
P1	Accessibility conformance verification	Product	Accessibility specialists and QA	Testable criteria, full-page/journey scope, assistive technology, defects, evidence, and claims.
P1	Inclusive research operations	Company	Research and legal	Accessible participation, compensation, accommodations, consent, representation, and safe data handling.
P1	Workplace inclusion and belonging	Company	Broad workforce sample	Voice, fairness, access, advancement, accommodations, retaliation, and intersectional experience.
P1	Ethical product decision-making	Company/product	Product, legal, research, executives	Stakeholder harms, rights, dark patterns, tradeoffs, review, transparency, and remediation.
P1	Content design and plain language	Product	Content, design, support, legal	Comprehension, consistency, translation, error recovery, accessibility, and testing.
P2	Algorithmic transparency and recourse	Product	Product, AI, legal, support	Meaningful notice, explanation, contestability, appeal, correction, and human escalation.
P2	Child and vulnerable-user safety	Product	Trust, legal, research, product	Age-appropriate design, consent, safeguarding, contact, content, defaults, reporting, and response.
P2	Well-being and persuasive-design review	Product	Design, research, ethics, product	Compulsion, manipulation, interruption, user control, vulnerable users, metrics, and mitigations.
P3	Human-rights impact assessment	Company/product	Legal, policy, research, executives	Salient rights, affected groups, leverage, prevention, monitoring, remedy, and reporting.

10. People, leadership, culture, and talent systems

Priority	Assessment	Level	Primary respondents	What it should evaluate
P0	Engineering leadership effectiveness	Company	Engineers, managers, peers, executives	Direction, context, system improvement, technical judgment, people development, and trust.
P0	Manager effectiveness	Company	Reports, peers, managers	Clarity, coaching, feedback, fairness, workload, growth, inclusion, and escalation.
P0	Team health and sustainability	Team	Team members	Workload, focus, conflict, support, autonomy, recovery, belonging, and intent to stay.
P0	Talent retention risk	Company	Workforce sample and HR	Role clarity, growth, compensation fairness, management, workload, belonging, and labor-market risk.
P1	Hiring quality and fairness	Company	Candidates, interviewers, managers, HR	Job relevance, structured evaluation, accessibility, bias control, candidate experience, and outcome validation.
P1	Onboarding effectiveness	Company/team	New hires and managers	Time to contribution, role clarity, access, relationships, product context, feedback, and inclusion.
P1	Career architecture and progression	Company	Workforce and leaders	Levels, expectations, evidence, consistency, mobility, sponsorship, and technical/management paths.
P1	Performance management	Company	Workforce and managers	Goal quality, evidence, feedback cadence, calibration, fairness, collaboration, and unintended incentives.
P1	Learning and capability development	Company	Workforce and leaders	Skill strategy, protected learning, practice, mentoring, mobility, application, and outcome evidence.
P1	Workforce planning	Company	Executives, finance, HR, technology	Capability demand, scenarios, constraints, succession, build/buy/partner choices, and leading indicators.
P1	Burnout and work-design risk	Company/team	Workforce	Demand, control, support, fairness, values, recovery, interruptions, and chronic overload.
P1	Knowledge concentration and succession	Company/product	Managers and teams	Bus-factor risk, critical roles, documentation, rotations, succession, and transition rehearsal.
P1	Cross-functional collaboration	Company	Product, design, engineering, commercial groups	Shared outcomes, role clarity, conflict, handoffs, trust, and decision quality.
P2	Executive-team effectiveness	Company	Executives and direct reports	Strategic coherence, constructive conflict, enterprise decisions, accountability, and communication.
P2	Compensation and reward-system alignment	Company	HR, finance, leaders, workforce	Internal fairness, market logic, transparency, incentives, collaboration effects, and retention.
P2	Contractor and contingent-workforce health	Company	Contractors, managers, legal, security	Integration, access, knowledge transfer, fairness, dependency, classification, and exit.
P2	Remote-work equity	Company	Remote, hybrid, and colocated staff	Access to information, influence, advancement, inclusion, equipment, time zones, and surveillance risk.
P3	Culture-risk assessment	Company	Broad sample and risk leaders	Gaps between stated and rewarded behavior, fear, normalization of deviance, incentives, and escalation.

11. Financial stewardship, economics, and business health

Priority	Assessment	Level	Primary respondents	What it should evaluate
P0	Technology value and FinOps	Company	Engineering, finance, product, executives	Cost allocation, unit economics, forecasts, optimization, accountability, and value-based tradeoffs.
P0	SaaS unit economics	Company/product	Finance, product, growth, success	Gross margin, acquisition, payback, retention, expansion, cost to serve, and segment quality.
P0	Product investment economics	Portfolio	Finance, product, technology	Total investment, expected value, uncertainty, option value, lifecycle cost, and stopping decisions.
P1	Cloud cost architecture	Product	Engineering, FinOps, architecture	Cost drivers, elasticity, unit cost, waste, commitments, placement, and reliability tradeoffs.
P1	Forecasting and budget adaptability	Company	Finance and functional leaders	Driver-based forecasts, uncertainty, variance learning, rolling decisions, and strategic reallocation.
P1	Cost-to-serve transparency	Product/segment	Finance, support, operations, product	Infrastructure, support, services, third parties, variability, segment differences, and decision use.
P1	Engineering investment allocation	Company	Technology, product, finance	Balance across growth, reliability, security, debt, platform, compliance, and exploration.
P1	Vendor and SaaS-spend management	Company	Procurement, finance, IT, owners	Inventory, ownership, utilization, overlap, negotiation, renewal, security, and exit.
P1	Revenue quality and concentration	Company	Finance, sales, executives	Recurring quality, concentration, concessions, services dependence, renewal risk, and cash characteristics.
P2	Capitalization and software-cost governance	Company	Finance and engineering leaders	Policy clarity, evidence, consistency, decision incentives, auditability, and product reality.
P2	Sustainability economics	Company/product	FinOps, sustainability, engineering	Energy/carbon signals, utilization, architecture, supplier data, cost tradeoffs, and verified reductions.
P3	Technical due diligence readiness	Company	Executives, technology, finance, legal	Architecture, delivery, security, IP, talent, operations, metrics, debt, and evidence quality.

12. Quality management and product assurance

Priority	Assessment	Level	Primary respondents	What it should evaluate
P0	Product quality management	Company/product	Product, engineering, support, quality	Quality definition, ownership, leading signals, defect learning, prevention, and customer impact.
P0	Quality signal integrity	Product	Engineering, QA, support, analytics	Trustworthiness, coverage, timeliness, false signals, segmentation, and decision use.
P1	Exploratory testing capability	Product	Testers, engineers, product	Charter quality, risk focus, skills, environments, findings, collaboration, and learning.
P1	Non-functional quality	Product	Architecture, engineering, QA, product	Reliability, performance, security, accessibility, privacy, usability, compatibility, and operability.
P1	Defect management and prevention	Product	Engineering, QA, support	Severity, customer impact, triage, aging, causal learning, prevention, and verification.
P1	Release-quality evidence	Product	Product, engineering, operations	Explicit risk, test evidence, exceptions, telemetry, rollout safeguards, and acceptance authority.
P2	Compatibility and interoperability	Product	Engineering, QA, partners	Supported environments, contracts, test matrix, change notice, backward compatibility, and deprecation.
P2	Localization quality	Product	Localization, design, QA, support	Linguistic, functional, cultural, layout, accessibility, and release validation.
P2	Hardware/software systems quality	Product	Systems engineering and quality	Interface requirements, integration evidence, environmental conditions, diagnostics, and field behavior.
P3	Independent verification and validation	Product	Independent assurance and owners	Independence, risk basis, traceability, evidence quality, findings, and closure.

13. Procurement, vendors, intellectual property, and ecosystem risk

Priority	Assessment	Level	Primary respondents	What it should evaluate
P1	Technology procurement effectiveness	Company	Procurement, technology, security, legal, users	Need definition, alternatives, usability, integration, security, total cost, negotiation, and realization.
P1	Vendor lifecycle management	Company	Owners, procurement, security, finance	Selection, onboarding, performance, change, incidents, renewal, concentration, exit, and data return.
P1	Intellectual-property hygiene	Company	Legal, engineering, product	Ownership, assignments, licenses, third-party materials, inventions, records, and release checks.
P1	Open-source program maturity	Company	Engineering, legal, security	Policy, inventory, contribution, maintenance, licensing, security, community, and strategic participation.
P2	Strategic partner dependency	Company/product	Executives, product, technology, legal	Alignment, leverage, roadmap dependence, data, service levels, concentration, and alternatives.
P2	Outsourced development governance	Company/product	Product, engineering, procurement	Product ownership, quality, security, knowledge, access, incentives, continuity, and exit.
P2	License-compliance operations	Company/product	Legal, engineering, security	Discovery, obligations, notices, copyleft decisions, distribution, exceptions, and evidence.
P3	Source-code escrow and supplier failure	Product	Legal, procurement, operations	Criticality, escrow fitness, buildability, triggers, verification, continuity, and migration.

14. Sustainability and societal resilience

Priority	Assessment	Level	Primary respondents	What it should evaluate
P1	Sustainable software engineering	Company/product	Engineering, architecture, FinOps, sustainability	Demand shaping, efficiency, utilization, carbon-aware choices, lifecycle, measurement, and rebound effects.
P2	Technology carbon-accounting quality	Company	Sustainability, finance, FinOps, procurement	Boundaries, supplier data, allocation, estimation, uncertainty, comparability, and decisions.
P2	Hardware lifecycle and e-waste	Company	IT, procurement, security, sustainability	Purchase, utilization, repair, reuse, secure disposal, supplier practices, and evidence.
P2	Climate and infrastructure resilience	Company	Risk, operations, facilities, vendors	Physical hazards, regional dependencies, workforce, suppliers, recovery, and adaptation.
P3	Social-impact measurement	Company/product	Impact, research, product, executives	Theory of change, affected groups, baselines, attribution limits, harms, and learning.

Recommended first implementation wave

Building every module at once would create respondent fatigue and weak validation. The highest-value initial wave is:

Software delivery performance
Developer experience
Product strategy quality
Product discovery effectiveness
Outcome measurement
Architecture fitness and evolvability
Reliability engineering
Incident management
Secure software development lifecycle
Privacy engineering and data protection
Digital accessibility capability
Technology value and FinOps
Engineering leadership effectiveness
Team health and sustainability
Responsible AI governance, gated to organizations that build or materially use AI

This wave balances product, engineering, operations, risk, economics, and people rather than deepening only the existing Agile lens.

Suggested assessment bundles

Fast company diagnostic

Use 30–45 minutes with stratified respondents:

technology strategy alignment;
product operating model;
product strategy and outcome measurement;
delivery performance and developer experience;
architecture fitness;
reliability and incident management;
cybersecurity governance and privacy;
customer journey and retention;
talent sustainability;
technology economics.

Product due diligence

product-market fit evidence;
product strategy and portfolio coherence;
customer retention, pricing, and unit economics;
architecture, maintainability, dependencies, and technical debt;
delivery performance and developer experience;
reliability, security, privacy, accessibility, and operational readiness;
talent concentration and leadership;
vendor, IP, open-source, and regulatory exposure.

Engineering transformation baseline

organizational design for flow;
developer experience;
delivery performance;
CI/CD and test strategy;
architecture fitness and platform engineering;
reliability, observability, and incident learning;
technical debt and documentation;
leadership, learning, and workload sustainability.

AI-product readiness

responsible AI governance;
use-case and product-value fit;
data/knowledge readiness;
model evaluation and monitoring;
human-AI interaction;
security/red teaming;
fairness and impact;
vendor/foundation-model dependency;
agent controls, privacy, accessibility, and incident response.

Regulated-product readiness

governance fitness and regulatory change;
secure development and privacy engineering;
identity, supply chain, and vendor risk;
traceability and quality evidence;
reliability, recovery, and major-incident readiness;
accessibility and customer recourse;
compliance evidence operations;
specialist safety, payment, health, financial, or other sector modules.

Assessment-design recommendations

1. Separate capability, outcome, and context

Do not infer outcomes solely from practices. Each assessment should contain:

capability items: what the organization can repeatedly do;
outcome items: what customers, employees, systems, and the business experience;
context items: size, product type, risk, lifecycle, regulation, architecture, and constraints;
evidence prompts: what would substantiate the response.

For example, a team can have a deployment pipeline without achieving safe, frequent delivery. Measure both.

2. Add applicability gates

Recommended fields:

{
  "applicability": {
    "question": "Does this product use machine learning to make or materially support decisions?",
    "includeWhen": ["yes", "partially"]
  }
}

An inapplicable item should be excluded from the denominator, not scored as zero.

3. Add evidence and confidence

Self-report alone is vulnerable to optimism, role bias, and social desirability. Add:

{
  "evidenceType": ["metric", "artifact", "observation", "interview"],
  "evidencePrompt": "Name the measure or artifact and its review date.",
  "confidence": ["low", "medium", "high"],
  "evidenceAgeDays": 0
}

Evidence should increase confidence in interpretation, not mechanically inflate maturity.

4. Use anchored response options

For capability-frequency statements, prefer:

not observed;
observed rarely or in isolated cases;
repeatable in some relevant areas;
repeatable across most relevant areas;
measured and adapted based on outcomes;
insufficient evidence;
not applicable.

Use agreement scales for perceptions, frequency scales for behaviors, and objective calculations for metrics. Do not mix them in one score without an explicit model.

5. Avoid a universal maturity ladder

The current -1/1/2/3 weights can support a diagnostic, but maturity is not always linear. Some practices are:

foundational controls that should be present regardless of scale;
contextual options rather than higher maturity;
outcomes with an optimum range rather than “more is better”;
risk gates where one severe failure should not be averaged away.

Add scoringMode values such as weighted-additive, likert, metric, critical-gate, and profile-only.

6. Add critical gates and caps

Examples:

no tested restore capability caps disaster-recovery maturity;
inability to identify production systems caps cybersecurity-governance maturity;
no accessible route through a critical customer journey prevents an accessibility conformance claim;
no inventory of material AI uses caps responsible-AI governance;
repeated retaliation for speaking up should not be averaged away by positive ceremony scores.

Critical gates should be few, explicit, and evidence-backed.

7. Score by section before aggregation

Do not sum every item into a single “software company score.” Report:

section profile;
material risks and gates;
strongest evidence;
confidence and evidence freshness;
respondent dispersion;
trend since prior assessment;
target profile based on context.

If an overall index is required, publish weights and sensitivity analysis. Avoid comparing companies without controlling for size, product type, lifecycle, regulation, and operating model.

8. Segment respondents and expose disagreement

Capture role, tenure, product, location, management level, and relevant demographic categories with privacy safeguards. Compare:

leaders versus practitioners;
product versus engineering versus commercial groups;
managers versus individual contributors;
long-tenured versus new employees;
regions, products, and underrepresented groups where sample size permits.

Large disagreement is diagnostic evidence, not noise to average away.

9. Protect anonymity and minimum sample sizes

For sensitive people, culture, ethics, and leadership assessments:

suppress small groups;
avoid collecting unnecessary identifiers;
prohibit use for individual performance decisions;
communicate purpose and data retention;
give participants a safe route to add qualitative context;
never promise anonymity the implementation cannot provide.

10. Use behaviorally specific, single-claim items

Avoid:

“We are world class.”
“Leaders support Agile.”
“The team uses microservices.”
“Deployments are automated and reliable and secure.”

Prefer:

“A failed production change can usually be returned to a known-good state using a rehearsed procedure.”
“Teams can identify which customer outcome a funded initiative is expected to change.”
“People who raise delivery risks receive a timely response without retaliation.”

11. Include countermetrics

Every optimization measure needs a balancing measure:

Optimization target	Countermetrics
Deployment frequency	change failure, rework, customer impact
Lead time	quality, reliability, sustainability
Cloud cost	performance, resilience, engineering time
Feature adoption	retention, support burden, harm
AI productivity	correctness, maintainability, security, learning
Support speed	resolution quality, recurrence, employee load
Utilization	queueing, cycle time, resilience, burnout

12. Establish a validation program

Before treating a new assessment as a benchmark:

Conduct cognitive interviews to test interpretation.
Pilot with diverse roles and company contexts.
Remove ambiguous, double-barreled, and low-variance items.
Test inter-rater agreement and role-related bias.
Evaluate internal structure without assuming every section must be unidimensional.
Test whether scores relate to relevant outcomes while checking confounders.
Establish test-retest expectations.
Document missingness and applicability.
Revalidate after material wording or scoring changes.
Publish limitations; do not imply causal claims from cross-sectional correlations.

13. Recommended metadata additions

{
  "schemaVersion": "2.0",
  "assessmentVersion": "1.0.0",
  "status": "pilot",
  "construct": "incident-management-capability",
  "level": "product",
  "respondentRoles": ["engineering", "operations", "support", "product"],
  "referencePeriodDays": 90,
  "scoringMode": "weighted-additive",
  "applicability": {},
  "evidenceRequired": false,
  "critical": false,
  "tags": ["reliability", "operations"],
  "sources": [],
  "lastValidated": null,
  "limitations": []
}

At item level, add polarity, construct, evidence prompt, applicability, criticality, and stable versioned IDs. Do not derive persistent IDs from mutable question text.

14. Recommended reporting model

Each assessment report should show:

purpose, scope, reference period, and participants;
applicability and missing-data decisions;
section scores with uncertainty;
distribution rather than only averages;
evidence coverage and freshness;
critical risks and contradictory evidence;
three highest-value next actions;
owners and review dates;
changes since the previous assessment;
explicit warnings against unsupported benchmarking.

Source foundations

The catalog is original synthesis rather than a reproduction of any framework. These sources support important coverage choices:

DORA capability catalog connects technical, cultural, product, AI, and operational capabilities to delivery and organizational performance.
DORA continuous delivery guidance emphasizes safe, sustainable, on-demand delivery and fast feedback rather than ceremony adoption.
DORA platform engineering guidance recommends balancing delivery performance with developer satisfaction, adoption/retention, and task success.
NIST Cybersecurity Framework 2.0 organizes cybersecurity outcomes around Govern, Identify, Protect, Detect, Respond, and Recover.
OWASP SAMM provides a risk-driven, technology-agnostic model spanning security governance, design, implementation, verification, and operations.
NIST AI Risk Management Framework organizes AI risk work around Govern, Map, Measure, and Manage across the lifecycle.
Google SRE resources support the reliability, incident, observability, toil, and operational-readiness modules.
W3C WCAG 2.2 supplies testable accessibility criteria and cautions needed for responsible conformance claims.
FinOps Framework covers technology value through planning, forecasting, unit economics, optimization, sustainability, governance, and cross-functional accountability.

Recommended next artifact

Create a versioned assessment-catalog.json before building individual files. For each candidate, record:

catalog ID and title;
decision the assessment supports;
construct and exclusions;
applicability;
target respondent strata;
scoring mode;
evidence requirements;
critical gates;
expected completion time;
overlap with existing assessments;
development status (proposed, draft, pilot, validated, retired);
owner and review date.

This prevents duplicate assessments and makes portfolio coverage, validation status, and respondent burden visible.