DevSecOps · 04 of 5
Assessment & roadmap
The SECURE framework, the maturity staircase and how we roll out across many teams.
SECURE · typical durations · NGT
2–3 wksScan: assessment
1–2 wksEvaluate: roadmap
4–8 wksCollaborate: implementation
01
The SECURE framework
Six steps NGT runs with every DevSecOps client. Durations are typical for one organisation or delivery centre.
1 of 6
Scan · 2–3 weeks
Assessment: the current state and its gaps.
- Audit source repositories and CI/CD tools
- Assess secrets management and IAM
- Score maturity against NGT's checklist
02
Where are you on the staircase?
The five-stage DevOps evolution model from the State of DevOps research. We agree the next step with you.
- Placed, not guessedEach team scored against NGT's checklist during Scan.
- One step up at a timeStage 5 does not arrive organisation-wide on day one.
- Templates carry each stepStandard repos, then shared templates, then gates in every template, then GitOps and self-service.
Five stages of DevOps evolution
- 1 · Normalisationversion control, little automation
- 2 · Standardisationstandard stacks and OS
- 3 · Expansiontemplates reused, changes tested
- 4 · Shared resourceseverything versioned and automated
- 5 · Self-serviceplatform, automated response
03
Pilot one, then spread
Prove the standard in one place, measure it, then roll it out with governance.
- 01Assess every unit
- SDLC, tools, automation
- Deployment frequency
- How security is built in
- 02Roadmap
- Target state and gaps
- Reference pipeline design
- Governance that fits you
- 03Pilot in one place
- One team or delivery centre
- Reference pipeline in real use
- Adoption measured
- 04Roll out
- Other units follow
- Consultants with each unit
- Adoption tracked centrally
- 05Operate & improve
- Improvement backlog
- Templates updated once, for all
04
Who does what
NGT brings the method and the engineers; your teams own the standard at the end.
SECURE step
NGT architects & engineers
Your teams
Pipeline & tools
01Scan
NGT architects & engineers
- Interview leads; audit repos and pipelines
- Score maturity
Your teams
- Give access and context
- Name an owner per team
Pipeline & tools
- Read-only scans of repos and accounts
02Evaluate
NGT architects & engineers
- Prioritise risks
- Draft roadmap and gates
Your teams
- Agree target and budget
Pipeline & tools
- Gate definitions as code
03Collaborate
NGT architects & engineers
- Integrate tools, build templates
Your teams
- A pilot team ships on the new pipeline
Pipeline & tools
- Scanners, vault, policy checks
04Upskill
NGT architects & engineers
- Training for Dev, QA and DevOps
Your teams
- Teams adopt the guidelines
Pipeline & tools
- Docs and templates in one portal
05Respond
NGT architects & engineers
- Monitoring and playbooks
Your teams
- Join on-call and incident reviews
Pipeline & tools
- Alerts, dashboards, SIEM
06Evolve
NGT architects & engineers
- Support roll-out to other teams
Your teams
- Own the standard
Pipeline & tools
- Adoption and findings dashboards
SourcesNGT Service Offering v2.0 (Mar 2025)NGT Service Offering v3.2 (Jul 2026)NGT DevSecOps & Cloud Security Service Offering v0.4 (Jan 2025)NGT Cloud Operations Service Offering v0.2 (Jan 2025)NGT Cloud/DevOps/SRE Service Offering (Sep 2026)NGT DevOps-AI Service Offering (Oct 2026)