Section 8
8The 24-Month Roadmap
Organisations that rush every tool in at once usually end up with a pile of dashboards and no change in behaviour. Cognitive XOps rolls out in three waves, each with a clear maturity target, and the UCSMM assessment is repeated every six months: at months 6, 12, 18 and 24.
Text in this figure
UCSMM reassessment · M6 · M12 · M18 · M24 · Visibility · Months 0 – 3 · Control · Months 4 – 12 · Adaptation · Months 13 – 24 · Level 2 · Managed · Level 3 · Defined · Level 4 · Quantitatively managed
| Wave | What gets done | UCSMM target |
|---|---|---|
| 1 · Visibility | Inventory all shadow AI, assign an owner to every model, open the intake register, set the baseline UCSMM score and approve the AI policy. | Level 2 (Managed) |
| 2 · Control | Add risk-review and evaluation gates to CI/CD, the four-part verification gate, FinOps circuit breakers and the first incident simulations. | Level 3 (Defined) |
| 3 · Adaptation | Automate degraded-mode failover, run continuous red-teaming, enforce crypto-agility and embed the six-monthly UCSMM reassessment. | Level 4 (Quantitatively managed); Level 5 is a longer-term aim |
Tip: use ← → to move between sections.