Assessment Categories

L1: No version control; FTP-based deployments; no code review process

L2: Git version control; basic branching strategy; some peer review

L3: Feature branches with pull requests; CI/CD pipeline; mandatory code review

L4: Trunk-based development; automated deployments with rollback; continuous integration

L1: Manual dependency management; libraries copied into repo

L2: Package manager in use (Composer/npm); manual updates

L3: Lock files committed; automated vulnerability scanning

L4: Automated dependency updates; policy-driven approval; SBOM generation

L1: No regular update schedule; updates applied reactively

L2: Quarterly updates; some testing before deployment

L3: Monthly update cadence; staging environment for testing; security patches within 1 week

L4: Automated upstream monitoring; continuous patching pipeline; zero-day response plan

L1: No automated testing; manual QA only

L2: Some unit tests; manual regression testing

L3: Automated test suite in CI; visual regression testing; accessibility checks

L4: Comprehensive coverage including performance, accessibility, and security testing; test-driven development

L1: No coding standards; inconsistent formatting

L2: Basic linting rules; documented standards exist

L3: Automated linting and formatting in CI; design system tokens used

L4: Component library; automated accessibility; performance budgets enforced

L1: Shared admin accounts; no role separation

L2: Individual accounts; basic role assignment

L3: Role-based access control; SSO integration; regular access reviews

L4: Automated provisioning/deprovisioning; MFA enforced; least-privilege policy

L1: Configuration changes made directly in production

L2: Configuration tracked but applied manually

L3: Configuration as code; environment-specific overrides; version controlled

L4: Immutable infrastructure; automated config drift detection; policy-as-code

L1: No monitoring; issues discovered by users

L2: Basic uptime monitoring; manual log review

L3: APM tooling; alerting with escalation; error tracking (Sentry/New Relic)

L4: Full observability stack; SLO/SLI tracking; anomaly detection; automated remediation

L1: Direct production edits; no approval process

L2: Staging environment exists; informal review before publish

L3: Defined content workflow with approval gates; scheduled publishing

L4: Automated content governance; A/B testing; content performance tracking

L1: No inventory of web properties; siloed ownership

L2: Basic inventory maintained; some centralized oversight

L3: Centralized portfolio with ownership mapping; standardized tech stack

L4: Automated discovery; governance dashboard; cost optimization; lifecycle management

L1: No security scanning; reactive patching only

L2: Basic WAF in place; occasional vulnerability scans

L3: Automated security scanning in CI; WAF with custom rules; incident response plan

L4: DevSecOps pipeline; penetration testing program; SOC2/compliance; bug bounty

L1: No performance measurement; unoptimized assets

L2: Basic caching; some image optimization; aware of Core Web Vitals

L3: Performance budgets; CDN caching strategy; optimized critical rendering path

L4: Automated performance testing; RUM analytics; edge computing; sub-second TTFB

L1: No CDN; origin-only serving

L2: Basic CDN for static assets; default cache headers

L3: Full-page CDN caching; custom cache rules; geographic optimization

L4: Edge logic (Fastly VCL/Compute); intelligent cache invalidation; A/B at edge

L1: Unmanaged third-party scripts; no tag governance

L2: Tag manager in use; basic analytics configured

L3: Tag governance policy; performance impact monitored; consent management

L4: Server-side tagging; privacy-by-design; automated tag auditing; performance SLAs for third-parties

L1: Single person responsible; no dedicated web team

L2: Small team with some specialization; reactive workload

L3: Cross-functional team; defined roles (dev, content, ops); proactive planning

L4: Dedicated WebOps team; embedded security and performance expertise; continuous improvement culture

L1: Static brochureware; minimal interactivity

L2: CMS-driven content; basic forms and search

L3: Personalization; integrations with marketing/CRM tools; multi-language

L4: Headless/decoupled architecture; API-first; composable DXP; real-time personalization

L1: No product thinking; site treated as a project

L2: Backlog exists; some prioritization process

L3: Product owner defined; data-driven roadmap; regular sprint cadence

L4: OKR-driven product strategy; continuous experimentation; ROI measurement on all initiatives