Compute & Runtime draft
Control over compute environments, runtime platforms, and execution infrastructure
L0 Unaware
No awareness of where or how compute workloads execute; runtime environments are unmanaged and undocumented
Criteria
COMP-L0-C1The organisation has no inventory of its compute environments, runtime platforms, or execution dependenciesCOMP-L0-C2Workloads run on unknown or uncontrolled infrastructure with no visibility into resource allocation or geographic placement
Indicators
- No one can enumerate the full set of servers, containers, or serverless functions in active use
- Development teams deploy to whichever platform is convenient without central oversight
Upgrade path
Create a comprehensive inventory of all compute environments and runtime platforms. Assign ownership for each workload and document where execution takes place geographically.
Risk if stagnant
Without compute awareness, the organisation cannot assess exposure to provider lock-in, jurisdictional risks, or resource exhaustion. Shadow IT deployments proliferate unchecked, creating security and compliance blind spots.
L1 Dependent
All compute workloads run on a single SaaS or PaaS provider with no portability or fallback capability
Criteria
COMP-L1-C1All production workloads execute on a single cloud provider's managed services (e.g., AWS Lambda, Azure App Service, Google Cloud Run) with provider-specific runtime dependenciesCOMP-L1-C2The organisation cannot migrate workloads to an alternative provider without significant re-engineering
Indicators
- Application code uses provider-specific SDKs, APIs, or runtime features that have no portable equivalent
- The organisation has no tested process for running workloads outside the current provider's environment
Upgrade path
Negotiate contractual guarantees for compute region selection, resource availability, and data processing locations. Begin abstracting provider-specific dependencies behind portable interfaces.
Risk if stagnant
Total compute dependency on a single provider exposes the organisation to unilateral pricing changes, service discontinuations, and jurisdictional risks. A provider outage means complete loss of all production services with no alternative.
L2 Contractual
Compute environments are governed by contracts specifying region selection, resource guarantees, and processing constraints
Criteria
COMP-L2-C1Contracts with compute providers include explicit terms for geographic region selection, guaranteed resource allocation, and data processing boundariesCOMP-L2-C2The organisation has documented which workloads use provider-specific features and has a preliminary abstraction strategy
Indicators
- Compute provider contracts specify exact regions where workloads execute
- A register of provider-specific dependencies exists and is reviewed periodically
Upgrade path
Containerise all workloads using OCI-standard images. Deploy Kubernetes or equivalent orchestration to enable multi-provider portability. Test workload migration to at least one alternative environment.
Risk if stagnant
Contracts provide legal guarantees but not technical independence. If the provider changes terms or exits a market, the organisation faces a lengthy and costly migration with no pre-tested alternative.
L3 Controlled
The organisation self-manages containerised workloads on Kubernetes or equivalent orchestration, with tested multi-provider deployment capability
Criteria
COMP-L3-C1All production workloads run as OCI-standard containers orchestrated by the organisation through Kubernetes or equivalent platformCOMP-L3-C2Workload migration to an alternative compute provider has been tested and can be executed within a defined recovery time objective
Indicators
- Container images are built and stored in organisation-controlled registries
- At least one full workload migration drill to an alternative provider has been completed successfully
Upgrade path
Deploy on-premises or co-located compute infrastructure for the most sensitive workloads. Implement confidential computing or trusted execution environments where jurisdictional control is paramount.
Risk if stagnant
Self-managed containers provide portability but still depend on underlying IaaS providers for bare-metal resources. For workloads requiring maximum sovereignty, the organisation needs to control the physical compute layer.
L4 Autonomous
Fully sovereign compute infrastructure with organisation-owned or co-located hardware, confidential computing capabilities, and complete runtime independence
Criteria
COMP-L4-C1Critical workloads run on organisation-owned or dedicated co-located hardware with no shared tenancyCOMP-L4-C2Confidential computing or trusted execution environments are deployed for sensitive workloads, ensuring code and data remain encrypted during processing
Indicators
- The organisation operates its own data centre or dedicated co-location with physical access controls
- Runtime attestation confirms that workloads execute in verified, tamper-proof environments
Risk if stagnant
Sovereign compute infrastructure demands significant capital expenditure and specialised operations staff. Without sustained investment, hardware ages, security patches lag, and the organisation may fall behind cloud-native capabilities.