Cloud Architecture Design

Enterprise Architecture Maturity Model: Stages, Criteria, and What to Do at Each Level

Guy Brodetzki
·
6 min read

Key Takeaways

  • An enterprise architecture maturity model gives organizations a structured way to assess how well their IT systems support business goals, and a clear path to improve.
  • Most companies sit at Stage 2 or 3: they have some architecture documentation and standards, but decisions are still largely reactive, inconsistent, or siloed.
  • Each maturity stage demands different actions. Describing the stages without prescribing what to do next is where most guides fall short.
  • Cloud architecture decisions should be driven by your maturity level, teams at lower stages need to consolidate and standardize before pursuing complex multi-cloud strategies.
  • InfrOS helps engineering teams act on their maturity stage by providing validated, pre-deployment architecture design, so every infrastructure decision is grounded in proven requirements rather than educated guesses.

What Is an Enterprise Architecture Maturity Model

An enterprise architecture maturity model is a structured way to assess how well IT systems and architecture decisions support business goals, and what needs to improve over time.

Organizations don’t manage technology with the same level of consistency or strategic intent. Some make infrastructure decisions reactively, one project at a time. Others operate with documented, governed architecture that guides every major investment. A maturity model maps that progression into defined stages.

Companies use it because “improve IT” is too vague to act on. A maturity model creates a clear baseline: where you are now, what gaps exist, and what actions move you forward. The result is stronger investment planning, better alignment between engineering and leadership, and a more practical roadmap for IT infrastructure transformation.

The 5 Stages of Enterprise Architecture Maturity and What to Do at Each Level

Maturity models vary in their exact terminology, but the underlying progression is consistent. Organizations move from ad hoc, undocumented decisions toward managed, strategically integrated architecture. Here are the five stages, what each one looks like from the inside, and, critically, what to actually do at each level.

‍

Stage 1, Initial: What it looks like + what to do next

‍

At Stage 1, there is no formal architecture practice. Technology decisions are made by individual teams or project managers without coordination. Infrastructure is built to solve immediate problems. Documentation, when it exists, lives in someone's head or a shared drive that no one maintains. Security and compliance are handled reactively. Costs are difficult to explain because no one has full visibility into what's running or why.

This isn't a failure state, it's a starting point that most organizations pass through. The problem is staying here too long.

‍

What to do next: The priority at Stage 1 is visibility, not transformation. Start by taking inventory. Document what systems exist, what they do, who owns them, and what they cost. Don't attempt to redesign anything yet. Establish a small, cross-functional group responsible for architecture decisions, even informally. The goal is to stop making undocumented choices and start building a shared picture of the current state.

‍

Stage 2, Developing: What it looks like + what to do next

‍

At Stage 2, architecture documentation exists but isn't consistently maintained or used. Some teams follow standards; others don't. There may be an architecture function, a team or a few senior engineers with that title, but their influence on day-to-day decisions is limited. Cloud adoption is underway but fragmented: different business units use different providers, different tools, and different conventions. Costs are tracked at the account level but not attributed to teams, services, or business outcomes.

This is where a large proportion of mid-size enterprises sit. The documentation and the intent are there, but enterprise architecture integration into actual decision-making is weak.

‍

What to do next: The priority at Stage 2 is standardization. Define and enforce a baseline set of conventions: naming standards, tagging requirements, approved cloud services, identity and access patterns. These don't need to be perfect, they need to be agreed upon and applied consistently. Introduce architecture review as a lightweight step in project intake, not a gate that slows teams down, but a checkpoint that surfaces alignment issues early. Begin connecting infrastructure spend to business units so cost ownership becomes visible.

‍

Stage 3, Defined: What it looks like + what to do next

‍

At Stage 3, the architecture function has real influence. Standards exist, are documented, and are largely followed. Architecture reviews happen before significant projects begin. There is a current-state inventory that's reasonably accurate. Cloud enterprise architecture decisions are made with awareness of the broader environment rather than in isolation. Compliance and security requirements are mapped to infrastructure, though enforcement may still be partially manual.

The main gap at Stage 3 is execution. Architecture is documented, but environments still drift as teams move quickly and changes bypass review.

‍

What to do next: The priority at Stage 3 is closing the gap between design and reality. This means investing in tooling that detects drift, enforces policy in pipelines rather than after deployment, and connects architecture decisions to infrastructure code. Shift architecture review earlier, into the design and planning phase, not just the approval phase. Begin measuring architecture outcomes: deployment frequency, incident rates tied to architecture decisions, cost per service. These metrics build the business case for the next stage of investment.

‍

Stage 4, Managed: What it looks like + what to do next

‍

At Stage 4, architecture is quantitatively managed. Decisions are informed by data: utilization metrics, cost-per-unit economics, performance benchmarks, compliance dashboards. The gap between intended and actual architecture is tracked and systematically reduced. Enterprise architecture integration is real, business strategy and technology strategy are explicitly connected, and architecture decisions reference business outcomes rather than just technical preferences.

Cloud architecture at this stage is intentional. Multi-cloud or hybrid environments are governed deliberately, and infrastructure transformation projects begin with validated target architectures.

‍

What to do next: The priority at Stage 4 is continuous improvement and automation. Architecture governance should be embedded in CI/CD pipelines so enforcement is automatic rather than manual. Begin building predictive capability: using cost and performance data to model the impact of architectural changes before they're made. Platforms like InfrOS operate in this mode, generating validated, benchmarked architecture designs before deployment so that every infrastructure change has a proven outcome attached to it. Teams at Stage 4 are ready to use this kind of tooling at full value.

‍

Stage 5, Optimizing: What it looks like + what to do next

‍

At Stage 5, architecture is self-improving. The organization treats its IT environment as a continuously evolving system: runtime feedback loops into the next design cycle, cost and performance data drives automated optimization recommendations, and architecture decisions are made with quantified confidence rather than professional judgment alone. Business and technology planning are genuinely integrated, the architecture roadmap and the business strategy are produced together, not reconciled after the fact.

Very few organizations operate consistently at Stage 5. It’s best treated as a direction rather than a fixed destination.

‍

What to do next: The work at Stage 5 is sustaining and scaling. Governance models that work for a 200-person engineering team may not hold at 2,000. Architecture practices need to evolve as the organization grows, acquires companies, or expands into new markets. Invest in architecture enablement, tools, documentation, and training that let teams self-serve within well-defined guardrails rather than routing everything through a central review function. The goal is an architecture practice that scales with the business without becoming a bottleneck.

The Criteria Used to Assess EA Maturity

Moving from a self-assessment to a reliable maturity score requires evaluating specific dimensions of the architecture practice. These are the areas that consistently distinguish lower-maturity organizations from higher-maturity ones.

‍

Technology use. How systematically is technology selected, managed, and retired? Low-maturity organizations accumulate tools without strategic intent. High-maturity organizations maintain a rationalized technology portfolio, make explicit decisions about approved services, and decommission what no longer serves a purpose.

‍

Data quality and currency. Architecture documentation is only useful if it reflects reality. Assess how often your architecture inventory is updated, who owns it, and how closely it matches what's actually running in production. Stale documentation is a Stage 2 characteristic; continuously maintained, system-integrated inventories are Stage 4.

‍

Team participation. Architecture maturity is not a property of the architecture team alone, it's a property of how the entire engineering organization makes decisions. How often are architecture considerations surfaced in team-level planning? How much do product and engineering teams understand about the architecture standards that apply to their work?

‍

How architecture decisions are shared. At low maturity, architecture decisions live in documents that few people read. At high maturity, they're embedded in tools, pipelines, and approved patterns that developers encounter naturally as they work. Decision visibility and accessibility are strong signals of where an organization sits on the scale.

‍

Cost alignment. Can your organization trace infrastructure spend to specific business outcomes? The ability to answer questions like "what does it cost us to serve one customer" or "what did this architectural change cost us in production" is a reliable indicator of maturity. Organizations without tagging standards, cost attribution, or unit economics tracking tend to cluster at Stages 1–2.

‍

Security and compliance. How are security requirements enforced, through manual review, automated policy checks, or by design? At lower maturity, security is a layer applied after the fact. At higher maturity, it's a constraint incorporated at the design stage, validated before deployment, and continuously monitored in production.

How EA Maturity Connects to Cloud Architecture and IT Transformation

Your position on the maturity scale has direct, practical consequences for how you should approach cloud enterprise architecture decisions and IT infrastructure transformation.

‍

Low-maturity teams, Stage 1 and 2, are operating reactively. Architecture decisions get made in the context of individual projects, without visibility into the broader environment. When these teams attempt complex cloud migrations or multi-cloud strategies, they consistently encounter the same problems: inconsistent environments, cost overruns, compliance gaps, and rework. The issue isn't cloud strategy, it's that the foundational architecture practice isn't ready to support it. Attempting an IT infrastructure transformation before reaching at least Stage 3 is a predictable source of expensive failure.

‍

Mid-maturity teams, Stage 3, have the standards and documentation to support cloud enterprise architecture decisions, but they often lack the enforcement mechanisms to keep those decisions consistent across teams and over time. Cloud environments at this stage tend to drift: what was designed and what's running diverge as teams move fast and bypass review processes. The transformation work at Stage 3 is connecting architecture intent to actual infrastructure, through policy-as-code, IaC validation, and tooling that surfaces drift automatically.

‍

High-maturity teams, Stage 4 and 5, design first and deploy with confidence. This is where enterprise architecture integration becomes a genuine competitive advantage rather than an overhead cost. Architecture decisions are validated before deployment, grounded in benchmarked data rather than estimates, and connected to measurable business outcomes. IT infrastructure transformation at this level is predictable: timelines hold, costs come in as projected, and post-deployment surprises are the exception rather than the rule.

‍

InfrOS is built for teams making this shift. By emulating architecture candidates in a sandboxed environment before any resources are provisioned, it gives engineering teams the validated design foundation that Stage 4 and 5 maturity requires, and accelerates the path for Stage 3 teams ready to close the gap between design and deployment. Whether you're planning a cloud migration or building toward scalable cloud infrastructure, the architecture decisions you make before deployment determine the outcomes you get in production.

Organizations that treat architecture as a design discipline, not just documentation, typically spend less, deploy faster, and avoid more post-deployment remediation. Maturity measures how consistently they can do that.

FAQ

‍

What is the difference between an EA maturity model and an EA framework?

‍

A framework such as TOGAF or Zachman outlines how an enterprise architecture practice is structured and documented. A maturity model measures how consistently those practices are applied and how developed they are. Frameworks define the approach; maturity models show how effectively that approach is working.

‍

How long does it take to move from one maturity stage to the next?

‍

Most organizations move between maturity stages in six to twenty-four months depending on size, leadership support, and available tooling. Standardizing processes usually happens faster. Moving into higher maturity levels takes longer because it often requires automation, stronger governance, and closer alignment between architecture and business planning.

‍

How does EA maturity affect cloud architecture decisions?

‍

At lower maturity levels, cloud architecture decisions are usually reactive and disconnected across teams. At higher maturity levels, decisions are planned against documented standards, validated before deployment, and tied to measurable business outcomes. That leads to more predictable costs, stronger governance, and fewer infrastructure changes after launch.

‍

Which model works best for companies undergoing IT infrastructure transformation?

‍

For teams in active IT infrastructure transformation, models such as the US government Architecture Maturity Model or Gartner ITScore provide useful structure. The most important factor is consistency: assess your current state, identify the biggest gaps, and use that information to prioritize architecture decisions before major infrastructure investments.

‍

Keep on reading

Events
Meet InfrOS at AWS re:Invent 2026 in Las Vegas
Guy Brodetzki
Oct 11, 2026
·
6 min read

InfrOS is excited to be exhibiting at AWS re:Invent 2026 in Las Vegas!

We'll join the global cloud community to talk about how to build better cloud systems, cut costs, and keep them secure and reliable.

Make the Whole Thing Work at Booth #1387

Cloud architecture is complicated enough. Come have some fun at our booth:

  • Pull the lever: Set our Rube Goldberg machine in motion and win a prize.
  • Enter our daily raffles: Get a chance to win even bigger prizes.
  • Meet the team: Chat with us and see InfrOS in action with a live demo.

Meet Our Team

Our founders and team members will be at the event to meet cloud architects, engineering leaders, and organizations looking to improve their cloud infrastructure:

Schedule a Meeting with Us

We'd love to connect! Stop by for a quick chat or book a meeting in advance to see InfrOS in action.


Book a Meeting with InfrOS


See you in Las Vegas!

‍

Events
Meet InfrOS at KubeCon + CloudNativeCon North America 2026
Guy Brodetzki
Oct 11, 2026
·
6 min read

InfrOS is heading to KubeCon + CloudNativeCon North America 2026!

We'll join the global cloud community to talk about how to build better cloud systems, cut costs, and keep them secure and reliable.

Make the Whole Thing Work at Booth #360

Cloud architecture is complicated enough. Come have some fun at our booth:

  • Pull the lever: Set our Rube Goldberg machine in motion and win a prize.
  • Enter our daily raffles: Get a chance to win even bigger prizes.
  • Meet the team: Chat with us and see InfrOS in action with a live demo

The Best Seats aren't at KubeCon

Join InfrOS on November 11 for an NBA game in our private skybox as the Utah Jazz take on the Orlando Magic. It's a chance to catch the game, meet fellow attendees, and spend time with the InfrOS team away from the conference floor.
‍

Register for the event here

Meet Our Team

Our team will be available throughout the event to discuss your infrastructure challenges and demonstrate the InfrOS platform.

Here's our team attending the event:

Let's Meet

Have an infrastructure challenge you'd like to discuss? Stop by our booth or schedule a dedicated meeting with our team.


Book a Meeting with InfrOS


See you in Salt Lake City!

‍

Cloud Architecture Design
9 Best Infrastructure Automation Tools for Cloud Engineering Team
Harel Dil
Sep 25, 2026
·
6 min read

Most cloud teams are already using cloud automation. There's Terraform in one repo, Ansible playbooks in another and a CI pipeline ties them all together. The problem is that "infrastructure automation tools" cover such a diverse range of use cases that it’s hard comparing them directly. In this blog post we’ll review 9 such tools, that actual task each one solves, and the niche it occupies. InfrOS is our product hence we will list it first, but we made sure to be fair in reviewing the rest. And also, we'll be upfront about our view - most cloud teams have too many tools stitched together, and we believe fewer is better.

‍Key Takeaways

  • Infrastructure automation covers provisioning, configuration, orchestration and, more recently, architecture decisions.
  • Terraform, OpenTofu, Pulumi and CloudFormation build infrastructure. Spacelift and env0 are infrastructure orchestration tools that run and govern those builds.
  • Almost every tool starts after someone has already picked the architecture. InfrOS works on that earlier step.
  • Most teams juggle too many tools. The fewer tools you work with, the fewer handoffs where things break.

What Counts as Infrastructure Automation

Infrastructure automation, for the purposes of the list, refers to software that performs a step within the process of creating, configuring, or maintaining an infrastructure component in an automated way instead of a manual one. This includes IaC, configuration management, the process of running and approving changes, and policy enforcement. General CI/CD systems like GitHub Actions or Jenkins were excluded because they belong to a separate category - they could run Terraform, but wouldn't know what infrastructure is. The same is true about monitoring solutions that merely point at broken parts of an infrastructure but don't fix it.

Automating a Decision Is Not the Same as Automating Deployment

The vast majority of tools perform an action according to the plan - you decide which cloud, regions, database, networking design and redundancy level you need, and the tool implements it. This is good, but the tool doesn't care whether your design was right or wrong. If your architecture costs you twice as much as it needs to, or collapses after region failure, Terraform will build it anyway.

A subset of these tools actually creates the design. They consider your requirements, contrast various architectural options and highlight the trade-offs in terms of costs, performance, resilience, and compliance before any implementation takes place. This is important because an architecture design mistake can easily be corrected on the whiteboard but would be very costly once implemented. For more details check out this blog post about shift-left cloud infrastructure design.

The 9 Best Infrastructure Automation Tools

With that split in mind, here's each tool, what it automates, how it deploys and who it fits.

‍

1. InfrOS

InfrOS covers the entire cycle in one single package. It first helps to identify your infrastructure as well as requirements. This is followed by creation of different architectural options for you and analysis of them based on cost, performance, resiliency, and compliance. Before making any choice, it simulates the behavior of all options. Thus, you will be choosing based on facts rather than guesswork. Finally, after selecting one option, InfrOS helps to generate infrastructure as code and deploy the same. It will keep monitoring the live environment to inform you about better options whenever available. We call this Evolving Architecture™.

Recommended for: Cloud teams working in one or multiple clouds who seek a single solution for their design, validation, IaC and ongoing assessments.

‍

2. Terraform

Terraform remains the default choice for most teams, and deservedly so. Describe infrastructure in HCL files, execute the plan to see the changes to be done, and then apply those changes. With hundreds of providers, it can connect to pretty much any cloud or SaaS APIs. Nearly all Terraform automation done at scale happens either via HCP Terraform or a third party orchestrator which provides capabilities of remote executions and state management.

Best for: Pretty much any team that starts with IaC, especially in the context of multiple clouds.

Watch out for: HashiCorp put Terraform under Business Source License in 2023. HashiCorp got acquired by IBM recently. For most of us, nothing much changed, but for some companies, a fully open source option became preferable.

‍

3. OpenTofu

OpenTofu is the open-source fork of Terraform, created after that license change and now run under the Linux Foundation. Same HCL, same providers, very similar CLI, so moving over is usually a small job. It has also added features of its own, like built-in state encryption.

Best for: Teams that want the Terraform workflow with an open-source license and community governance.

Watch out for: The two projects are slowly drifting apart, so features don't always match.

‍

4. Pulumi

Pulumi allows for writing infrastructure using real programming languages such as TypeScript, Python, Go, C# and Java. This implies usage of loops, functions and unit testing instead of configuration language. It still operates through the desired state at its core meaning that you get to see the preview of each change before it is deployed.

Good for: Teams with a lot of developers willing to write code instead of learning HCL.

Keep in mind: With power comes increased ability to write messier infrastructures. Having a good system of code reviews in place is crucial.

‍

5. AWS CloudFormation

AWS CloudFormation is AWS’ own IaC solution. Using YAML or JSON templates AWS deploys and updates your infrastructure as a stack with rollback upon failure. Service itself is free but you have to pay for the resources it builds.

Good for: Teams which only use AWS and are interested in staying within their tooling ecosystem.

Keep in mind: It's AWS-only. The moment you start deploying your infrastructure to other clouds, you'll need another tool.

‍

6. Ansible

Ansible manages configurations of running servers. You craft playbooks using YAML format, and then Ansible connects via SSH to deploy packages, manage settings, and provision applications. There’s no agent involved, which makes the whole process straightforward.

Best for: Operations teams managing dozens of VMs, on-premise servers or networking devices. Usually used together with Terraform, where Terraform provisions and Ansible configures.

Be aware of: Ansible is not good with monitoring state of cloud resources, and therefore it’s not the best choice as a primary infrastructure provisioning solution.

‍

7. Spacelift

Spacelift is one of those infrastructure orchestrators that are sitting on top of your IaC. It allows running Terraform, OpenTofu, Pulumi, CloudFormation, Ansible, and Kubernetes workloads directly from your Git repositories. On top of it, it provides policies in code through Open Policy Agent, approvals, drift management and stack dependencies.

Best for: Platform teams with multiple stacks and multiple contributors that need some guardrails.

Be aware of: It’s one more platform to learn and use. Teams with only a few stacks probably don’t need it yet.

‍

8. env0

Similar in concept to Spacelift but focusing more on developer self-service and cost optimization, env0 allows platform teams to release approved templates for use by developers who build environments from those templates, with cost information added by env0 prior to deployment. If your concern is cloud governance, we've covered cloud governance tools for engineering teams before.

Best For: Organizations where developers should be able to spin up their own environments without giving them access to everything.

Beware: Like Spacelift, this is worth its weight in gold at scale.

‍

9. Crossplane

Crossplane is Kubernetes-as-a-control-plane for cloud infrastructure. Resources are defined as Kubernetes objects and managed through reconciliation (even when manual changes have been made), allowing platform teams to define APIs for themselves as a sort of wrapper, like a "database" object that handles all the cloud configuration under the hood.

Best For: Platform engineering teams who know their way around Kubernetes well.

Beware: This one's quite steep for those just starting with Kubernetes.

Tools Compared at a Glance

Here's how all nine line up on the same criteria.

ToolWhat it automatesHow you define itCloud scopeModelBest for
InfrOSArchitecture design, validation, IaC generation, deployment, ongoing checksRequirements and existing infrastructureSingle cloud, multi-cloud or hybridCommercialReplacing a multi-tool stack with one loop
TerraformProvisioningHCLMulti-cloudSource-available (BSL)General IaC
OpenTofuProvisioningHCLMulti-cloudOpen source (MPL)Open-source IaC
PulumiProvisioningTypeScript, Python, Go, C#, JavaMulti-cloudOpen-source coreDeveloper-led teams
CloudFormationProvisioningYAML or JSON templatesAWS onlyFree AWS serviceAWS-only teams
AnsibleConfigurationYAML playbooksAny server, any cloudOpen sourceServer and app config
SpaceliftIaC orchestration and policyWraps your IaCMulti-cloudCommercialPlatform teams with many stacks
env0IaC orchestration and self-serviceWraps your IaCMulti-cloudCommercialDev self-service and cost control
CrossplaneProvisioning through KubernetesKubernetes resourcesMulti-cloudOpen source (CNCF)Kubernetes platform teams

Swipe sideways to see all columns.

A few things jump out. Four of these tools (Terraform, OpenTofu, Pulumi and CloudFormation) do basically the same job with different languages and licenses, so you only need one of them. Spacelift and env0 only make sense once you have one of those four. And InfrOS is the only one that covers the steps before, during and after provisioning. So the real question isn't which tool is best. It's how many tools you actually need.

How These Tools Fit Together in One Pipeline

Consider the traditional pipeline to have four tiers. The first one is the decision tier where you select the architecture. The second is the definition tier where the architecture gets converted into code using Terraform, OpenTofu, Pulumi, or CloudFormation. Then, there is the orchestration tier where Spacelift or env0 executes the code with policy enforcement and approvals, or Crossplane does the same within Kubernetes. Finally, there is the configuration tier where Ansible configures the servers and applications.

‍

And that means four tools, four vendors, and four handoffs – and every single handoff becomes another point of failure. Instead, InfrOS uses a different approach, encompassing the decision-making, the IaC itself, the validation process and the monitoring within one loop, making it possible for you to remove quite a few elements from the stack rather than keeping it all running. This is end-to-end cloud automation, spanning design and live operations. Looping is important here because the process does not stop at deployment. Workloads evolve, pricing changes, new requirements come up – and an architecture that was perfect last year may no longer work.

 Keeping it in shape is an ongoing job, which our guide to cloud infrastructure optimization best practices covers.

FAQ

What is infrastructure automation?

It's the use of software for performing the tedious tasks of creating and managing the infrastructure. The tasks include coding of the infrastructure, provisioning of cloud resources, server configurations, approvals and policy enforcement. This aims at improving the speed, repeatability, and accuracy of change. More recent automation technologies extend the process of automation right from the stage of architectural designs to determine the best architecture options.

‍

What is the difference between automation and orchestration?

Automation is getting one task done without a person, like creating a database with a single Terraform apply. Orchestration is coordinating many automated tasks into one flow, in the right order and with the right checks. Think provisioning, then a policy check, then an approval, then configuration. Spacelift and env0 are infrastructure orchestration tools, while Terraform and Ansible are mostly automation. Once things grow, you usually need both.

‍

Do these tools replace Terraform?

Automation involves getting a single task completed without human intervention, such as building a database through a single apply in Terraform. On the other hand, orchestration involves managing all the automated tasks together as part of one workflow, in order and with the proper checks. For example, provision, policy check, approval, and configuration. Env0 and Spacelift are examples of infrastructure orchestration tools, whereas Terraform and Ansible are more automation tools.

‍

Which infrastructure automation tools suit small teams?

Keep it simple. You typically need one infrastructure-as-code tool for a small group, such as Terraform, OpenTofu or Pulumi, that operates within the CI pipeline you’re already using. CloudFormation will do the job just fine if you're only working in the AWS environment. Orchestration platforms and Kubernetes tools like Crossplane are more likely to give you return value later down the line when you have many stacks.

‍

How do you measure the return on infrastructure automation?

Let's start from things that are quantifiable. Measure the time that is required to deploy a change, the number of deployments that failed, the amount of time spent handling manual tickets, and how frequently drift occurred. In case of architecture level automation solutions, let's not forget about comparing cloud costs to some kind of baseline and counting the number of designs that were avoided after the go live.

‍

Our post on a FinOps cost optimization agent shows one way to tie automation to real cost numbers.

About InfrOS

InfrOS assists cloud teams in choosing what to build, validating that decision prior to production, and adapting as needed going forward.

‍