Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
The DevSecOps Capability Model helps engineering organizations assess how they build, secure, ship, and operate software. It helps them chart a path toward more mature, secure, and resilient practices. The model describes a journey across six capability areas, each progressing through five stages of maturity.
Use this model to understand where your teams are today, agree on where you want to be, and plan the incremental changes that will get you there. The model is descriptive, not prescriptive. It's intended to create shared understanding across product, development, security, and operations rather than produce a single score.
This model aligns with the goals of the Microsoft Secure Future Initiative. Most organizations are at different stages across different capability areas.
The six capability areas
The model organizes DevSecOps practices into six capability areas. Together they span the full lifecycle, from how an organization is led and governed through how software is designed, built, released, and operated.
- Organization and culture: Leadership, security mindset, collaboration, and continuous improvement across teams.
- Standards and governance: The security program, policies and standards, and the protection of engineering systems.
- Planning and design: Secure-by-design practices, data and insights, and technical architecture and design.
- Development and testing: Code security, development accelerators, and integration and testing.
- Release and deployment: Secure dependencies, secure releases, and deployment workflows.
- Operations and monitoring: Protecting tenants and production systems, monitoring and detection of threats, and incident response and remediation.
The five stages
Every capability area progresses through the same five overall stages of maturity. Each capability area also uses its own stage names to describe what maturity looks like in that specific context.
| Overall stage | What it looks like |
|---|---|
| Ad-hoc | Practices are fragmented, manual, and largely undocumented. Outcomes depend on individuals. |
| Initiating | Individual teams begin to drive consistency locally and address gaps as they surface. |
| Orchestrating | Practices are centralized and shared, aligning teams around common approaches and resources. |
| Streamlining | World-class tooling and practices reduce manual effort and make the secure path the easy path. |
| Pioneering | Practices are industry-defining, anticipatory, and continuously evolving ahead of need. |
Strategic approaches
Organizations can use the capability model in different ways depending on their business context. Some teams need flexibility, some optimize for velocity, and others prioritize strong compliance and risk controls.
- Agile DevSecOps: Emphasizes flexibility for organizations establishing, updating, or unifying DevSecOps practices while balancing speed with useful standards.
- Accelerated DevSecOps: Emphasizes velocity for organizations with established practices that want to automate, simplify, and improve delivery efficiency.
- Security-first DevSecOps: Emphasizes compliance and risk reduction for organizations that operate in highly regulated or mission-critical environments.
Assess your current practices and set future goals
Use the model to run a lightweight self-assessment with the people who do the work. The goal is a shared, honest picture of today and an agreed direction for tomorrow.
Start with the blank chart
Use the blank capability model chart to capture your current state and target state.
Use the detailed reference chart
Use the detailed chart as a reference when you discuss what each stage looks like across the capability areas.
Mark your current state
For each capability area, discuss the stage descriptions and mark the stage that best reflects your current practices.
Connect the marks
Connect the marks across the six areas to visualize your current profile.
Mark your target stage
Mark the target stage you want to reach for each capability area over your planning horizon.
Plan incremental change
Plan gradual, incremental change. Advancing one stage at a time is usually more durable than trying to leap ahead everywhere at once.
Reassess periodically to track progress and adjust targets as your organization and threat landscape evolve.
Use guiding questions to set priorities
When you choose where to invest next, use guiding questions to focus the conversation for each capability area.
- Organization and culture: How do we make security a shared responsibility and a source of pride instead of a late-stage gate owned by a few?
- Standards and governance: How do we establish clear, well-understood standards that protect engineering systems without slowing teams down?
- Planning and design: How do we make secure-by-design the default in planning and architecture, informed by data and insights?
- Development and testing: How do we shift security left so issues are found and fixed as code is written instead of after it ships?
- Release and deployment: How do we make releases secure, repeatable, and trustworthy from dependency to deployment?
- Operations and monitoring: How do we detect, withstand, and recover from threats to production systems and tenants?
Example customer profile
The following example shows how a real-world customer profile can surface uneven maturity across capability areas and help identify where to prioritize investment next.
