IOM Starter Kit
A working guide for infrastructure and platform leaders to assess IOM readiness, map existing tools against the standard, surface the structural gaps, and plan a structured, four-phase adoption path.
An Infrastructure Operating Model is the authoritative layer that defines what infrastructure exists, what it is intended to do, and what actions are legitimate — before execution occurs.
Five working parts
Designed to be completed by a team — individually or in a facilitated workshop — to produce a concrete, organization-specific picture of IOM readiness and a path forward.
Maturity Assessment
Score your organization across the six IOM capability dimensions and identify where you are today.
Tool Mapping Worksheet
Map your existing tools against IOM requirements and surface the structural gaps.
Gap Analysis
Translate maturity scores and tool gaps into a prioritized, severity-rated gap inventory.
Adoption Roadmap
Plan adoption in four phases with milestones, owners, and success criteria.
Conformance Checklist
Evaluate any solution claiming IOM capability against the standard's mandatory requirements.
Run it as a half-day workshop
The kit works best with 4–6 participants spanning infrastructure engineering, security, platform, and architecture. The maturity assessment alone takes 60–90 minutes and generates the most valuable organizational alignment.
Assign a facilitator to read each dimension aloud and lead scoring. Record dissenting views — disagreement on scores reveals organizational ambiguity about ownership and intent. Complete the gap analysis immediately after, while scores are fresh.
Score reality, not aspiration
The most common mistake is aspirational scoring. Score the capability as it reliably exists across your environment — not as it exists in your best team, your newest platform, or your most recent initiative. Gaps scored accurately are gaps you can close. Gaps scored generously are risks you carry invisibly.
Maturity bands
Six dimensions, scored 0–3 each, for a maximum of 72. Your total places you in one of four bands, each with a recommended starting point.
| Score | Band | What it means | Recommended starting point |
|---|---|---|---|
| 0–18 | Pre-IOM | Governance is primarily manual and reactive. Significant foundational work is required before adoption. | Start with state modeling — get an accurate, automated view of what exists. |
| 19–36 | Emerging | Some capabilities exist but are inconsistent, isolated, or tool-specific. | Focus on intent definition and ownership encoding. |
| 37–54 | Developing | Core capabilities are present and partly operational; gaps remain in reconciliation and pre-execution validation. | Close the reconciliation and pre-execution gaps. |
| 55–72 | Governed | Capabilities operate continuously and improve. Ready to extend governance to AI and autonomous systems. | Focus on AI-readiness: authoritative context and explicit boundaries. |
The four-phase adoption path
Each phase builds on the last and introduces no execution risk until authority has been established through accuracy.
Model
Establish an accurate, continuously updated canonical model of your infrastructure — read-only, no governance authority yet.
Reconcile & govern
Activate continuous reconciliation against declared intent. Auto-approve conforming changes, block violations, escalate the ambiguous.
Govern automation
Extend IOM authority into IaC pipelines and CI/CD. Human escalation becomes the exception, not the default.
Enable AI operations
Extend authoritative context and governed boundaries to AI agents. Achieve explainable, auditable autonomy.
Do not introduce execution authority before modeling authority is established. Organizations that try to govern before they can accurately model their infrastructure produce unreliable decisions that erode trust in the operating model. Phase 1 is the foundation everything else depends on.
Get the kit and start your assessment
Practitioners who complete the assessment and are pursuing adoption are eligible for IOM working group membership.