Modernization Matrix

Content owner: orlando.pereira@roche.com

The Landscape Modernization Matrix provides a common framework for assessing the maturity of applications across key modernization dimensions. It helps teams create a shared baseline, identify gaps, compare modernization needs consistently, and prioritize improvement actions across the application landscape.

The matrix is used during benchmarking sessions with Product Family Leads, SMEs, and Architecture representatives. Each application is assessed against selected dimensions using three maturity levels: Technical Debt, Transitional, and Modern.

The assessment should be pragmatic and evidence-based. It is intended to guide structured discussion and prioritization, not to act as a purely mechanical scoring exercise.

Maturity levels

The matrix uses three maturity levels:

Technical Debt: Capabilities are missing, undocumented, manually managed, or dependent on individual knowledge.
Transitional: Some capabilities are in place, but adoption is incomplete, inconsistent, or limited to specific teams, systems, or environments.
Modern: Capabilities are defined, consistently applied, evidence-based, and suitable for reliable, secure, scalable, and sustainable operation.

The target state represents the desired direction of travel. However, the required level of maturity may vary depending on the business criticality, risk profile, data sensitivity, lifecycle stage, and strategic relevance of the application.

Modernization dimensions

Dimension	What it assesses	Target state
FAIR & Discoverability	Whether data can be found, understood, accessed under defined rules, and reused without relying on personal knowledge.	Data is registered, documented, owned, governed, and reusable by users outside the immediate team within appropriate compliance boundaries.
IAM, Privacy & Security	Whether identity, access, encryption, secrets, and audit controls are implemented and enforced.	Authentication, access, encryption, secrets management, and access reviews follow approved enterprise standards.
Platform / Hosting / Infrastructure	Whether runtime environments and infrastructure are standardized, automated, and suitable for reliable operation and growth.	Infrastructure is provisioned through Infrastructure as Code, follows approved platform patterns, and hosting choices are documented and justified.
Architecture & Interoperability	Whether the system has clear components and controlled integrations.	Capabilities are exposed through defined interfaces, integration patterns are standardized, and dependencies are actively managed.
Reliability	Whether reliability expectations are defined, measured, and managed.	Critical services have SLIs/SLOs, health-based monitoring, regular reliability reviews, and systematic postmortem follow-up.
Scalability & Performance	Whether the system can maintain performance and grow capacity without major redesign or repeated manual effort.	Scaling is predictable and automated where appropriate, with proactive performance management and regular capacity planning.
Deployment Automation	Whether changes are built, tested, and deployed consistently and safely.	CI/CD, automated testing, quality gates, traceability, rollback, and security checks are in place.
Observability	Whether teams can understand system and data behavior end-to-end.	Logs, metrics, traces, lineage, and dependency views support diagnosis, impact analysis, and change understanding.
Resilience & Recovery	Whether systems and data can be restored within defined expectations.	Recovery objectives, procedures, roles, playbooks, and tested evidence are in place.
Cost Transparency & FinOps	Whether costs are visible and used in operational and architectural decision-making.	Costs are visible at system, product, or domain level and reviewed regularly with clear ownership of optimization actions.

Dimension

What it assesses

Target state

FAIR & Discoverability

Whether data can be found, understood, accessed under defined rules, and reused without relying on personal knowledge.

Data is registered, documented, owned, governed, and reusable by users outside the immediate team within appropriate compliance boundaries.

IAM, Privacy & Security

Whether identity, access, encryption, secrets, and audit controls are implemented and enforced.

Authentication, access, encryption, secrets management, and access reviews follow approved enterprise standards.

Platform / Hosting / Infrastructure

Whether runtime environments and infrastructure are standardized, automated, and suitable for reliable operation and growth.

Infrastructure is provisioned through Infrastructure as Code, follows approved platform patterns, and hosting choices are documented and justified.

Architecture & Interoperability

Whether the system has clear components and controlled integrations.

Capabilities are exposed through defined interfaces, integration patterns are standardized, and dependencies are actively managed.

Reliability

Whether reliability expectations are defined, measured, and managed.

Critical services have SLIs/SLOs, health-based monitoring, regular reliability reviews, and systematic postmortem follow-up.

Scalability & Performance

Whether the system can maintain performance and grow capacity without major redesign or repeated manual effort.

Scaling is predictable and automated where appropriate, with proactive performance management and regular capacity planning.

Deployment Automation

Whether changes are built, tested, and deployed consistently and safely.

CI/CD, automated testing, quality gates, traceability, rollback, and security checks are in place.

Observability

Whether teams can understand system and data behavior end-to-end.

Logs, metrics, traces, lineage, and dependency views support diagnosis, impact analysis, and change understanding.

Resilience & Recovery

Whether systems and data can be restored within defined expectations.

Recovery objectives, procedures, roles, playbooks, and tested evidence are in place.

Cost Transparency & FinOps

Whether costs are visible and used in operational and architectural decision-making.

Costs are visible at system, product, or domain level and reviewed regularly with clear ownership of optimization actions.

How to use the matrix

Use the matrix as a guide for structured discussion during application benchmarking. The goal is to understand the current state, identify meaningful gaps, and agree where modernization effort would create the most value.

The assessment should consider the context of each application. Not every application requires the same maturity level across every dimension. Criticality, risk, data sensitivity, lifecycle stage, strategic relevance, and expected future demand should influence the interpretation of the target state.

For the detailed assessment criteria, refer to the full Full Landscape Modernization Matrix description. It contains the complete guidance for each dimension, including technical debt, transitional maturity, and modern state descriptions, and should be used as the reference during benchmarking sessions.