Skip to main content

Gap assessment

A gap assessment answers two questions per practice: how much of it are we doing, and how much does it matter? The distance between those answers is where the roadmap comes from.

Scope​

The assessment covers nine practice areas spanning the delivery lifecycle:

  1. Leadership practices
  2. Collaborative culture practices
  3. Design for DevOps
  4. Continuous integration
  5. Continuous testing
  6. Continuous monitoring
  7. Elastic infrastructure
  8. Continuous delivery
  9. Continuous security

Method​

Data collection
Surveys, interviews and workshops with development, operations and security stakeholders; review of existing tools, workflows and documentation.
Assessment criteria
Each practice is scored on two axes — current practice level and business importance — using a consistent five-point scale.
Gap identification
The gap is the distance between importance and current practice. A high-importance, low-practice area is a priority; a low-importance, high-practice area may be over-invested.
Recommendations
Actionable steps sequenced by gap score, dependency and effort.

Scoring​

Each practice is rated 1–5 on both axes.

ScorePractice levelImportance
1Not practisedNot relevant to this business
2Ad hoc, individual effortNice to have
3Partially practised, inconsistentUseful
4Consistently practisedImportant to delivery
5Automated, measured, improvingCritical to business outcome

Gap = importance − practice level. A positive gap is an investment opportunity. A negative gap means effort is going somewhere the business does not value — worth questioning, not automatically cutting.

Reading the matrix​

Low importanceHigh importance
Low practiceIgnore for nowPriority — the roadmap starts here
High practiceReview investmentProtect — do not regress while fixing elsewhere

Typical findings​

Across engagements, the highest gaps usually appear in the same places:

  • Collaborative culture. Development and operations still operate separate queues; security is consulted at the end.
  • Continuous integration. Pipelines exist but are not mandatory; some teams deploy from laptops.
  • Continuous testing. Unit tests are present; integration and performance testing are manual and pre-release only.
  • Continuous security. Scanning is a periodic exercise rather than a gate.
  • Leadership. Sponsorship is verbal; no one owns the outcome across departments.

The lowest gaps typically appear in elastic infrastructure and continuous delivery where a cloud migration has already forced some automation.

Recommendation patterns​

Address high gaps first
Prioritise where the distance between practice and importance is largest — usually collaborative culture, continuous integration and continuous testing.
Standardise then automate
Automate a practice only after it is consistently defined. Automating an inconsistent process preserves the inconsistency.
Align leadership
Leadership practice is a prerequisite, not a workstream. If decision rights do not change, delivery practice will regress.
Open the channels
Remove the structural reason for silos — shared on-call, shared metrics, shared planning — rather than scheduling more meetings.
Instrument security
Move security from periodic review to a pipeline gate, and from a gate alone to continuous detection.

Deliverable​

The assessment produces a scored matrix per practice area, a prioritised recommendation list, and a one-page summary for executives that states the three changes with the largest expected effect.