Demo Organization

Start a free assessment Sign in

Payment Platform

A worked example. Nothing here belongs to you — start your own assessment to see yours.

Coverage: 47%198 of 419 weighted scopes
Effectiveness: 61%
Maturity: 1.0 / 5

Where each capability actually acts across the lifecycle. Select a cell for detail.

Capability	Plan	Design	Code	Build	Test	Release	Deploy	Operate	Monitor / Respond
Admission Control							33%
API Security Testing					0%			0%
Cloud Configuration Security							100%	33%
Code Review Security			67%
Container Security				100%
DAST					8%	0%
Drift Detection								50%
Fuzzing			0%		0%
IaC Security			50%	50%
Incident Response									100%
Kubernetes Security			0%	0%				0%
Network Security							50%	25%
Penetration Testing					33%			25%
Runtime Security								0%	0%
SAST			100%	100%
SCA			100%	100%		0%
Secrets Management				100%			100%	33%
Secret Scanning			67%
Secure Architecture		100%
Security Requirements	0%
SIEM									67%
Threat Modeling		50%
Vulnerability Management								100%	100%
Vulnerability Scanning							0%	33%
Workload Identity							100%	50%

Covered
Partially covered
Not covered
Not expected in this phase

Code Review Security · Code

2 of 3 required weight is covered, across 3 scopes. 1 scope has no implementation.

Mandatory Peer Review Before Merge
What it is
No change reaches the main branch without the review and approval of a second person.
Why it matters
One person able to put code into production unreviewed is both the easiest mistake to make and the most useful account to compromise.
You have it when
Branch protection requires an approving review from somebody other than the author, and the author cannot bypass it.
— mandatory. Required by profile rule(s): BASELINE_UNIVERSAL
Security Review of Sensitive Changes
What it is
Changes to authentication, authorization, cryptography or data handling additionally require a security-qualified reviewer.
Why it matters
Authentication, authorization, cryptography and data handling fail in ways a general reviewer is not looking for.
You have it when
Changes touching those areas need an approval from a reviewer with security knowledge, and the areas are identified by code-ownership rules rather than by memory.
— mandatory. Required by profile rule(s): PERSONAL_DATA_PROTECTION, FINANCIAL_DATA_PROTECTION

Environment	Technology	Control point	Covered by
any	any	Pull Request	Branch protection requiring a second reviewer
any	any	Pull Request	CODEOWNERS review on the payment paths
any	any	Manual Review	nothing

How good is what is in place?

Branch protection requiring a second reviewereffectiveness 41% · maturity 1 · Available
- · Enforcement is approval-required.
- · Automation is semi-automated.
- · Findings have no stated destination, so nobody is obliged to act on them.
- · No remediation deadline, so a finding can stay open indefinitely.
- · No exception process, so the control gets bypassed informally.
- · Next maturity level needs: It runs automatically.
- · Left out of this level because we cannot check it yet: Somebody owns it, The control itself is verified.
CODEOWNERS review on the payment pathseffectiveness 41% · maturity 1 · Available
- · Enforcement is approval-required.
- · Automation is semi-automated.
- · Findings have no stated destination, so nobody is obliged to act on them.
- · No remediation deadline, so a finding can stay open indefinitely.
- · No exception process, so the control gets bypassed informally.
- · Next maturity level needs: It runs automatically.
- · Left out of this level because we cannot check it yet: Somebody owns it, The control itself is verified.

Close this gap — tell us about a tool or process that already covers it, or accept it as a gap.