Assessment Criteria

Level 1.0 — Basic

No version control; FTP-based deployments; no code review process

Level 2.0 — Developing

Git version control; basic branching strategy; some peer review

Level 3.0 — Proficient

Feature branches with pull requests; CI/CD pipeline; mandatory code review

Level 4.0 — Advanced

Trunk-based development; automated deployments with rollback; continuous integration

Level 1.0 — Basic

Manual dependency management; libraries copied into repo

Level 2.0 — Developing

Package manager in use (Composer/npm); manual updates

Level 3.0 — Proficient

Lock files committed; automated vulnerability scanning

Level 4.0 — Advanced

Automated dependency updates; policy-driven approval; SBOM generation

Level 1.0 — Basic

No regular update schedule; updates applied reactively

Level 2.0 — Developing

Quarterly updates; some testing before deployment

Level 3.0 — Proficient

Monthly update cadence; staging environment for testing; security patches within 1 week

Level 4.0 — Advanced

Automated upstream monitoring; continuous patching pipeline; zero-day response plan

Level 1.0 — Basic

No automated testing; manual QA only

Level 2.0 — Developing

Some unit tests; manual regression testing

Level 3.0 — Proficient

Automated test suite in CI; visual regression testing; accessibility checks

Level 4.0 — Advanced

Comprehensive coverage including performance, accessibility, and security testing; test-driven development

Level 1.0 — Basic

No coding standards; inconsistent formatting

Level 2.0 — Developing

Basic linting rules; documented standards exist

Level 3.0 — Proficient

Automated linting and formatting in CI; design system tokens used

Level 4.0 — Advanced

Component library; automated accessibility; performance budgets enforced

Level 1.0 — Basic

Shared admin accounts; no role separation

Level 2.0 — Developing

Individual accounts; basic role assignment

Level 3.0 — Proficient

Role-based access control; SSO integration; regular access reviews

Level 4.0 — Advanced

Automated provisioning/deprovisioning; MFA enforced; least-privilege policy

Level 1.0 — Basic

Configuration changes made directly in production

Level 2.0 — Developing

Configuration tracked but applied manually

Level 3.0 — Proficient

Configuration as code; environment-specific overrides; version controlled

Level 4.0 — Advanced

Immutable infrastructure; automated config drift detection; policy-as-code

Level 1.0 — Basic

No monitoring; issues discovered by users

Level 2.0 — Developing

Basic uptime monitoring; manual log review

Level 3.0 — Proficient

APM tooling; alerting with escalation; error tracking (Sentry/New Relic)

Level 4.0 — Advanced

Full observability stack; SLO/SLI tracking; anomaly detection; automated remediation

Level 1.0 — Basic

Direct production edits; no approval process

Level 2.0 — Developing

Staging environment exists; informal review before publish

Level 3.0 — Proficient

Defined content workflow with approval gates; scheduled publishing

Level 4.0 — Advanced

Automated content governance; A/B testing; content performance tracking

Level 1.0 — Basic

No inventory of web properties; siloed ownership

Level 2.0 — Developing

Basic inventory maintained; some centralized oversight

Level 3.0 — Proficient

Centralized portfolio with ownership mapping; standardized tech stack

Level 4.0 — Advanced

Automated discovery; governance dashboard; cost optimization; lifecycle management

Level 1.0 — Basic

No security scanning; reactive patching only

Level 2.0 — Developing

Basic WAF in place; occasional vulnerability scans

Level 3.0 — Proficient

Automated security scanning in CI; WAF with custom rules; incident response plan

Level 4.0 — Advanced

DevSecOps pipeline; penetration testing program; SOC2/compliance; bug bounty

Level 1.0 — Basic

No performance measurement; unoptimized assets

Level 2.0 — Developing

Basic caching; some image optimization; aware of Core Web Vitals

Level 3.0 — Proficient

Performance budgets; CDN caching strategy; optimized critical rendering path

Level 4.0 — Advanced

Automated performance testing; RUM analytics; edge computing; sub-second TTFB

Level 1.0 — Basic

No CDN; origin-only serving

Level 2.0 — Developing

Basic CDN for static assets; default cache headers

Level 3.0 — Proficient

Full-page CDN caching; custom cache rules; geographic optimization

Level 4.0 — Advanced

Edge logic (Fastly VCL/Compute); intelligent cache invalidation; A/B at edge

Level 1.0 — Basic

Unmanaged third-party scripts; no tag governance

Level 2.0 — Developing

Tag manager in use; basic analytics configured

Level 3.0 — Proficient

Tag governance policy; performance impact monitored; consent management

Level 4.0 — Advanced

Server-side tagging; privacy-by-design; automated tag auditing; performance SLAs for third-parties

Level 1.0 — Basic

Single person responsible; no dedicated web team

Level 2.0 — Developing

Small team with some specialization; reactive workload

Level 3.0 — Proficient

Cross-functional team; defined roles (dev, content, ops); proactive planning

Level 4.0 — Advanced

Dedicated WebOps team; embedded security and performance expertise; continuous improvement culture

Level 1.0 — Basic

Static brochureware; minimal interactivity

Level 2.0 — Developing

CMS-driven content; basic forms and search

Level 3.0 — Proficient

Personalization; integrations with marketing/CRM tools; multi-language

Level 4.0 — Advanced

Headless/decoupled architecture; API-first; composable DXP; real-time personalization

Level 1.0 — Basic

No product thinking; site treated as a project

Level 2.0 — Developing

Backlog exists; some prioritization process

Level 3.0 — Proficient

Product owner defined; data-driven roadmap; regular sprint cadence

Level 4.0 — Advanced

OKR-driven product strategy; continuous experimentation; ROI measurement on all initiatives