Payment Platform

A worked example. Nothing here belongs to you — start your own assessment to see yours.

Coverage: 47%198 of 419 weighted scopes
Effectiveness: 61%
Maturity: 1.0 / 5

Coverage and maturity side by side. They move independently — that is the point.

Open a capability to see what it is, what its percentage is over, and what would move it.

SCA

Software composition analysis: resolving the third-party dependencies a build pulls in and checking them against known vulnerability data.

Coverage: 73%; 36 of 45 required scopes, weighted 72 of 99.
Maturity: 1.5 / 5; ≈ Available, averaged over every required scope by weight.
Gaps: 9; Closing these moves overall coverage by 6.4 points.

Where it is required

One row per required scope. A scope is covered when something you told us about acts there.

Environment	Technology	Phase	Control point	Covered by
Test	Java	Release	Release Gate	nothing
Test	React	Release	Release Gate	nothing
Test	Spring Boot	Release	Release Gate	nothing
Development	Java	Release	Release Gate	nothing
Development	React	Release	Release Gate	nothing
Development	Spring Boot	Release	Release Gate	nothing
Production	Java	Release	Release Gate	nothing
Production	React	Release	Release Gate	nothing
Production	Spring Boot	Release	Release Gate	nothing
Test	Java	Build	CI Pipeline	Trivy gate on the container build
Test	React	Build	CI Pipeline	Trivy gate on the container build
Test	Spring Boot	Build	CI Pipeline	Trivy gate on the container build
Development	Java	Build	CI Pipeline	Trivy gate on the container build
Development	React	Build	CI Pipeline	Trivy gate on the container build
Development	Spring Boot	Build	CI Pipeline	Trivy gate on the container build
Production	Java	Build	CI Pipeline	Trivy gate on the container build
Production	React	Build	CI Pipeline	Trivy gate on the container build
Production	Spring Boot	Build	CI Pipeline	Trivy gate on the container build
Test	Java	Build	CI Pipeline	Trivy dependency scan on pull requests and in CI
Test	Java	Code	Pull Request	Trivy dependency scan on pull requests and in CI
Test	React	Build	CI Pipeline	Trivy dependency scan on pull requests and in CI
Test	React	Code	Pull Request	Trivy dependency scan on pull requests and in CI
Test	Spring Boot	Build	CI Pipeline	Trivy dependency scan on pull requests and in CI
Test	Spring Boot	Code	Pull Request	Trivy dependency scan on pull requests and in CI
Development	Java	Build	CI Pipeline	Trivy dependency scan on pull requests and in CI
Development	Java	Code	Pull Request	Trivy dependency scan on pull requests and in CI
Development	React	Build	CI Pipeline	Trivy dependency scan on pull requests and in CI
Development	React	Code	Pull Request	Trivy dependency scan on pull requests and in CI
Development	Spring Boot	Build	CI Pipeline	Trivy dependency scan on pull requests and in CI
Development	Spring Boot	Code	Pull Request	Trivy dependency scan on pull requests and in CI
Production	Java	Build	CI Pipeline	Trivy dependency scan on pull requests and in CI
Production	Java	Code	Pull Request	Trivy dependency scan on pull requests and in CI
Production	React	Build	CI Pipeline	Trivy dependency scan on pull requests and in CI
Production	React	Code	Pull Request	Trivy dependency scan on pull requests and in CI
Production	Spring Boot	Build	CI Pipeline	Trivy dependency scan on pull requests and in CI
Production	Spring Boot	Code	Pull Request	Trivy dependency scan on pull requests and in CI
Test	Java	Code	Pull Request	Renovate dependency update pull requests
Test	React	Code	Pull Request	Renovate dependency update pull requests
Test	Spring Boot	Code	Pull Request	Renovate dependency update pull requests
Development	Java	Code	Pull Request	Renovate dependency update pull requests
Development	React	Code	Pull Request	Renovate dependency update pull requests
Development	Spring Boot	Code	Pull Request	Renovate dependency update pull requests
Production	Java	Code	Pull Request	Renovate dependency update pull requests
Production	React	Code	Pull Request	Renovate dependency update pull requests
Production	Spring Boot	Code	Pull Request	Renovate dependency update pull requests

Maturity, and what blocks the next level

9 scopes have nothing in place at all. An uncovered scope counts as level 0, so coverage has to move before maturity can.

Trivy dependency scan on pull requests and in CIlevel 2 · Automated
Next level needs: It can stop a release.
Left out of this level because we cannot check it yet: Somebody owns it, The control itself is verified.
Trivy gate on the container buildlevel 2 · Automated
Next level needs: It can stop a release.
Left out of this level because we cannot check it yet: Somebody owns it, The control itself is verified.
Renovate dependency update pull requestslevel 2 · Automated
Next level needs: It can stop a release, A remediation deadline exists, Exceptions go through a process.
Left out of this level because we cannot check it yet: Somebody owns it, The control itself is verified.

What is wrong

criticalNo control at allnothing covers it9 scopes · weight 27
criticalPresent, but does not stop anythingexpected blocking, actual a warning9 scopes · weight 27
mediumNo remediation deadlineexpected a remediation deadline, actual none9 scopes · weight 9

The controls that would move it

What each control is, and what acting on it would be worth.

Vulnerable Dependency Gate
9 of 18 scopes covered
What it is
A build that pulls in a dependency with a critical, fixable vulnerability is stopped rather than shipped.
Why it matters
Knowing about a critical, fixable dependency vulnerability and shipping anyway is the ordinary path by which known issues reach production.
You have it when
A build that pulls in a critical vulnerability with a fixed version available fails, and shipping it needs a recorded, time-bounded exception.
Covering the rest moves overall coverage by 6.4 points. It is recommendation 2 on the roadmap — new capability, reducing critical risk.
Automated Dependency Updates
in place everywhere it is required
What it is
Outdated or vulnerable dependencies are proposed for upgrade automatically so that remediation does not depend on someone noticing.
Why it matters
Manual upgrades happen when somebody has time, which is why dependencies fall years behind and a single upgrade turns into a project.
You have it when
Upgrade pull requests appear by themselves, run the full test suite, and are merged as routine work instead of accumulating.
Dependency Composition Scan
in place everywhere it is required
What it is
Third-party dependencies of the application are resolved and checked against known vulnerability data on every build.
Why it matters
Most of the code being shipped was not written by the team, and a dependency becomes vulnerable long after it was chosen.
You have it when
The full dependency tree including transitive dependencies is resolved on every build, matched against vulnerability data, and the result is recorded.

Change an answer — tell us about a tool or process that already covers this, or accept it as a gap.