Payment Platform

A worked example. Nothing here belongs to you — start your own assessment to see yours.

Coverage: 47%198 of 419 weighted scopes
Effectiveness: 61%
Maturity: 1.0 / 5

Nine phases, in order. The left loop is what you build, the right is what you run, and the two hand over where the shield sits. Open a phase to see what acts there and what does not.

Everything required here is covered
Some of what is required here is covered
Nothing required here is covered
Nothing is required in this phase

Operate38%

The running system: runtime protection, drift and continuous scanning.

35 of 93 required scopes are covered in this phase, 38% by weight.

Where in the phase

A phase is not one place. These are the control points this phase is actually paired with — the pairs the catalog declares, never every control point crossed with every phase.

Runtime 16 of 45 scopes covered
Continuous Scan 12 of 36 scopes covered
Manual Review 7 of 12 scopes covered

What acts here

Every implementation that covers at least one scope in this phase, heaviest first.

Argo CD reconciliation against Git12 scopes, weight 24
Drift Detection
Defender for Cloud vulnerability assessment in production5 scopes, weight 10
Vulnerability Scanning
Entra Workload Identity on AKS6 scopes, weight 6
Workload Identity
DefectDojo as the finding destination3 scopes, weight 3
Vulnerability Management
Annual third-party penetration test1 scope, weight 3
Penetration Testing
Default-deny NetworkPolicies in the cluster3 scopes, weight 3
Network Security
DefectDojo SLA policy per severity3 scopes, weight 3
Vulnerability Management
Defender for Cloud posture on the production subscription1 scope, weight 1
Cloud Configuration Security
Azure Key Vault for application secrets1 scope, weight 1
Secrets Management

What is missing

What this phase asks for and does not get, worst first.

Infrastructure Drift Detection12 scopes, weight 24
Drift Detectioncriticalnothing is doing this
Known Vulnerability Scan10 scopes, weight 20
Vulnerability Scanninghighnothing is doing this
Runtime Threat Detection6 scopes, weight 12
Runtime Securitycriticalnothing is doing this
Egress Traffic Control6 scopes, weight 6
Network Securitycriticalnothing is doing this
Periodic Penetration Test2 scopes, weight 6
Penetration Testinghighnothing is doing this
Elimination of Static Machine Credentials6 scopes, weight 6
Workload Identitycriticalnothing is doing this
API Security Scan3 scopes, weight 3
API Security Testingcriticalnothing is doing this
Cluster Benchmark Assessment3 scopes, weight 3
Kubernetes Securitycriticalnothing is doing this
Network Segmentation Policy3 scopes, weight 3
Network Securitycriticalnothing is doing this
Penetration Test Remediation Tracking3 scopes, weight 3
Penetration Testingcriticalnothing is doing this
Cloud Posture Continuous Assessment2 scopes, weight 2
Cloud Configuration Securityhighnothing is doing this
Secret Access Auditing1 scope, weight 1
Secrets Managementhighnothing is doing this
Secret Rotation1 scope, weight 1
Secrets Managementhighnothing is doing this
Infrastructure Drift Detection12 scopes, weight 24
Drift Detectionmediumruns, not doing enough
Periodic Penetration Test2 scopes, weight 6
Penetration Testingcriticalruns, not doing enough

Capabilities in this phase

Every gap, grouped by phase