Overall coverage
Modern
84%
115 / 140 points
Coverage = unweighted mean of the 10 dimension coverages (not points ÷ max)
Maturity distribution
Modern 9Transitional 1Tech Debt 0
Headline finding
Adopt Arvados as a Reliability, Resilience, and Recovery blueprint for other critical applications. Replicate its good practice of defining clear RTO and RPO targets, ensuring each application has documented recovery expectations aligned to business criticality, SLAs, and SLOs, and that these targets are validated through regular recovery testing.
Primary modernization lever: Architecture & Interoperability
Coverage vs. portfolio
app vs. avg (dashed)Score vs. gap by dimension
Prioritized remediation
Map each existing SLA and SLO to clearly defined SLIs, document how they are calculated, and publish them in stakeholder-facing dashboards with assigned ownership and regular review cadence.
Define and maintain Level 1 Support SLAs and SLOs for all critical services, covering incident intake, prioritization, initial response, resolution where applicable, and escalation to higher support tiers.
Per-question assessment
click a dimension to expand · colored answer chips▸ FAIR & Discoverability 1 gap 90%
The dataset or system is findable in a searchable catalog or inventory (e.g., ).
YesA named data owner or steward is formally assigned and documented.
YesAccess and usage conditions, including legal and compliance constraints, are documented and available to users.
PartialWhat is the percentage of the data uses standardized terminologies such as RTiS.
>90%Data lineage is captured for key data flows and is maintained over time.
Automated▸ IAM, Privacy & Security 3 gaps 67%
The system uses the approved corporate identity provider for user authentication (e.g., Roche SSO via PingFederate, OAuth 2.0, OpenID Connect).
YesData is encrypted in transit.
YesData is encrypted at rest.
PartialSecrets are managed in an approved central vault (e.g., HashiCorp Vault or AWS Secrets Manager).
YesAccess rights and permissions are reviewed and formally certified at defined intervals.
PartialNo shared or generic privileged accounts exist in the production environment.
No▸ Platform / Hosting / Infrastructure 0 gaps 100%
Infrastructure is provisioned declaratively using Infrastructure as Code.
YesThe system uses approved shared internal platforms or Golden Paths, where applicable. (e.g., Minerva Application Blueprint)
Yes▸ Architecture & Interoperability 2 gaps 62%
Can we swap in and out components without modifying the system.
PartialAll application services are exposed through clear and defined interfaces.
YesData contracts are documented and governed.
YesAPI lifecycle management is actively implemented using Gravitee.
No▸ Reliability 1 gap 67%
All critical services have defined SLAs and SLOs.
YesMajor incidents are followed by systematic postmortems, and resulting corrective actions are tracked to closure in the backlog.
YesSLIs are defined and calculated for all established SLAs and SLOs, and are visible to stakeholders and system owners.
No▸ Scalability & Performance 1 gap 75%
The system supports automated vertical and horizontal scaling based on real-time demand, where applicable.
PartialLoad and performance testing are performed routinely and included in major release cycles.
Yes▸ Deployment Automation 0 gaps 100%
Core workloads are supported by a complete CI/CD pipeline.
YesBuilds, tests, and deployments are executed through fully automated processes.
YesAutomated quality gates are enforced before production deployment. (e.g., SonarQube)
YesProduction rollback or deployment occurs regularly and within the last 6 months.
YesBuild artifacts and dependencies are managed in a traceable and controlled manner.
Yes▸ Observability 0 gaps 100%
All critical services generate standard telemetry, including logs, metrics, and traces.
YesObservability data is available through approved central monitoring and observability tools.
YesIncident analysis can be performed across upstream and downstream dependencies.
Yes▸ Resilience & Recovery 0 gaps 100%
Critical services and data have defined Recovery Time Objective (RTO) and Recovery Point Objective (RPO) targets.
YesBackup, restore, and recovery procedures, including assigned roles and responsibilities, are documented and tested.
Yes▸ Cost Transparency & FinOps 1 gap 75%
Cost visibility is available at component, system, product family, or domain level.
SystemCost is reviewed regularly together with usage and business value by the owning team.
YesArchitectural decisions explicitly consider cost as a primary decision variable.
Partial