FPT SoftwareFHNCertificationsReference architectures
Talk to NGT
Maturity Model · 02 of 3

DevSecOps & Platform

The DevSecOps maturity evaluation and the platform-engineering spectrum.

Internal Developer Platform
01

Five Stages of DevOps Evolution

The DevSecOps evaluation places teams on the five stages of Puppet's State of DevOps research.

  1. 01Normalisation
    • Everything in version control
    • Little automation yet
  2. 02Standardisation
    • Teams converge on the same stacks
    • Same operating systems
  3. 03Expansion
    • CI/CD reused across services
    • IaC templates shared
  4. 04Automated delivery
    • Everything versioned and automated
    • GitOps
  5. 05Self-service
    • Automated incident response
    • Platform engineering
02

DevSecOps Maturity Evaluation

What the evaluation in NGT's DevSecOps Advisory package checks.

AreaWhat is checked
Repositories and CI/CDRepositories, pipelines and CI/CD tools; how code reaches production
Secrets and identityWhere secrets live; IAM for people and pipelines; MFA and SSO
Security and quality gatesSAST, DAST, SCA, image scanning; which gates block a release
ComplianceAgainst ISO 27001, NIST, SOC 2, GDPR and best practice
OperationsMonitoring, logging and incident response, with security inside
PeopleSecurity awareness of developers, QA and DevOps engineers
03

Platform Engineering Is a Spectrum

Not every organisation needs a full portal on day one. Start at the step that removes the worst friction.

  • Reusable assetsShared modules and templates, so new projects start from a kit, not from zero.
  • Standardised environmentSystems in one catalogue; one-click golden-path templates for the common stacks.
  • Self-service IDPPick a template, fill a short form; the platform provisions and guardrails check.
  • AI-native platformAgents draft environments and changes inside platform guardrails; engineers approve.
Internal Developer Platform
pick a templateSSO · rolessynctelemetrystatusscanevery changePeople & identity1 · Developer portal2 · Orchestration & control plane3 · Pipelines & delivery4 · Infrastructure & runtime5 · Observability & securityEnvironments · approvals from one configuration databaseDevelopersKeycloaksingle sign-onBackstage portalService catalogueowners · systemsGolden pathsapp + IaC + pipelineDocs · runbooksApp statuspipelines · costPlatform APIworkflowsApprovalsper environmentKubeVelaapp modelCrossplanecloud resourcesConfiguration DBsource of truthGitLab CIbuild · test · scanArgo CDGitOpsJenkinsVM releasesGitHub ActionsHarbor · Nexussigned imagesTerraformlanding-zone modulesAWS CDKHelmchartsEC2 · ECSVMs · containersAmazon EKSmicroservicesGrafanadashboardsLoki · Tempologs · tracesAudit logimmutablePolicy as codeguardrailsTrivyimage scan · SBOMSonarQubequality gatePrometheusmetricsCost per teambudgets · alertsDevelopmentdeploy freelyStagingmanager approvalProductionticket + admin approval

Point at a component to light its links; select it for what it does here and the practice that makes it right.

Point at a component to see what it does; select it for the best practice.Open the architecture
SourcesNGT Cloud, DevOps and AI Service Offerings v2.0 (Mar 2025)NGT DevSecOps Service Offering (Jan 2025)Puppet, State of DevOps research (five stages of DevOps evolution)NGT Platform Engineering v1.2 (Sep 2026)NGT DataOps Service Offering drafts (Sep 2026)FPT Software Hanoi AI Service Introduction v0.9.3 (Mar 2026)