Reliability maturity isn't a single number - it spans four dimensions that mature at different rates: detection, architecture, recovery, and practice. This model grades each dimension on the same five levels so a team can see where it actually is, not where its best dimension makes it feel.
Level 1 - Reactive
You learn about incidents from customers. Redundancy is single-AZ or accidental. There is no incident process beyond "someone notices and fixes it," and SLA credits are never claimed because nobody knows they exist. Most startups begin here; the danger is staying here at scale.
Level 2 - Monitored
You detect incidents from your own dashboards, usually before customers escalate. Workloads run multi-AZ. Incidents get a channel and a rough timeline, but post-incident review is informal and recovery is manual. This is the modal level in our corpus - competent, and quietly exposed to regional events.
Level 3 - Resilient
Detection is proactive (synthetic checks, external probes) and independent of the region being watched. Critical workloads have a tested path to a second region - pilot light or warmer. Incidents produce written post-mortems with actions that get tracked. The SLA check is starting to appear in the incident-closure checklist.
Level 4 - Recovering
Everything at Level 3, plus recovery is systematized: RTO/RPO targets per workload with business sign-off, quarterly game days that exercise the real failure classes (AZ loss, control-plane outage, DNS failure), and a standing process that turns every qualifying incident into a filed SLA claim inside the window. Reliability has a budget and an owner.
Level 5 - Independent
The architecture does not depend on any single provider control plane on the hot path. Identity, DNS, and API access have local fallbacks; the 2025 DynamoDB DNS and Service Control events would have been log lines, not incidents. Very few organizations need Level 5 everywhere - but the ones running critical infrastructure increasingly need it somewhere.
Using the model
Grade each of the four dimensions independently; your overall maturity is the lowest, because that's where the next outage finds you. The fastest wins are almost always in recovery - most teams are architecturally more mature than their incident practice, and closing that gap (tested failover, a claim process) costs process, not infrastructure. Pair this with the incident severity classification to make your post-mortems comparable over time.