Framework & Methodology
One framework.
Four lenses.
The Concordance Framework is the foundation — 50 standards, 6 phases, 5 maturity levels. Compliance Signal, Velocity Governance, and Risk Bastion are lenses that apply it to audit evidence, AI governance, and deployment safety respectively.
📐
Concordance Framework
50 standards · 6 phases · 5 levels
The foundation. Scores engineering teams on SDLC practices from Requirements through Operations.
→lens
📊
Compliance Signal
SOC 2 · ISO 27001
Maps Concordance scores to compliance controls — evidence from your existing scan data.
→lens
🛡️
Velocity Governance
10 standards · activates on AI detection
10 standards where AI integration raises the stakes. Activates automatically on detection.
→lens
⛔
Risk Bastion
11 gate standards · deployment safety
Your score measures maturity. Bastion enhances safety. The same 11 standards — evaluated as gates, not averages.
50 standards. 6 phases. 5 maturity levels.
Every standard is scored on a 1–5 scale from Reactive to Optimizing. The framework covers the full SDLC lifecycle — from how requirements are captured to how incidents are managed.
Evidence is pulled directly from your SCM and tracker. No surveys. No self-assessment. Observable signals only.
1Reactive
2Emerging
3Defined
4Managed
5Optimizing
Phases & Standards
📋 Requirements8 standards
How work items are defined, tracked, and prioritized. Issue tracking, acceptance criteria, estimation, backlog hygiene, and traceability from requirements to code.🏗️ Design7 standards
How architecture and technical decisions are made and documented. ADRs, technical docs, API contracts, tech debt tracking, dependency management, and design reviews.💻 Development11 standards
How code is written, reviewed, and merged. Branch protection, PR workflows, commit conventions, linting, secrets management, documentation practices, and tech debt tracking.🧪 Testing9 standards
How quality is verified before production. CI pipelines, test coverage, security scanning, integration testing, CI reliability, and build performance.🚀 Release8 standards
How software is packaged, versioned, and shipped. Release cadence, semantic versioning, release notes, change failure rate, and rollback capability.📡 Operations8 standards
How production systems are monitored, maintained, and recovered. Incident response, postmortems, MTTR, code ownership, SLOs, and review cadence.