> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cortex.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Seasonal readiness Scorecard

export const RecipeBadges = ({badges = []}) => {
  const map = {
    "recipe": {
      label: "Recipe",
      color: "#A86400"
    },
    "ai-excellence": {
      label: "AI excellence",
      color: "#653EE8"
    },
    "production-readiness": {
      label: "Production readiness",
      color: "#226686"
    },
    "incident-mgmt": {
      label: "Incident management",
      color: "#86198F"
    },
    "migrations": {
      label: "Migrations",
      color: "#0E7C66"
    },
    "compliance": {
      label: "Compliance",
      color: "#475569"
    },
    "dora": {
      label: "DORA metrics",
      color: "#1D4ED8"
    },
    "security": {
      label: "Security",
      color: "#B42318"
    },
    "operational-readiness": {
      label: "Operational readiness",
      color: "#B54708"
    },
    "dev-onboarding": {
      label: "Developer onboarding",
      color: "#C11574"
    }
  };
  const items = badges.map(key => map[key]).filter(Boolean);
  if (items.length === 0) return null;
  return <div className="not-prose flex flex-wrap gap-2 mb-6">
      {items.map(b => <span key={b.label} className="rounded-lg px-2 py-1 text-xs font-medium" style={{
    backgroundColor: b.color,
    color: b.textColor || "#FFFFFF"
  }}>
          {b.label}
        </span>)}
    </div>;
};

<RecipeBadges badges={["recipe", "production-readiness"]} />

For organizations that have a busy season, they can implement a seasonal readiness Scorecard to proactively ensure operational efficiency and consistency.

You can use our [example rules](/guides/production-readiness/seasonal-readiness-scorecard#example-rules) as a starting point, and you can learn more below about [how customer H\&R Block reduced bugs by 50% year-over-year by implementing a seasonal readiness Scorecard](/guides/production-readiness/seasonal-readiness-scorecard#example-h\&r-block’s-season-readiness-scorecard).

### Example rules

The focus areas of this type of Scorecard may be be specific to your organization's needs, but as general guidance, we would recommend creating a Scorecard that contains rules in these key focus areas:

<AccordionGroup>
  <Accordion title="Operational readiness">
    Example rules:

    * Entity has an owner<br />
      `ownership != null`
    * Runbook is linked<br />
      `links("runbook").length > 0`
    * Logs are linked<br />
      `links("logs").length > 0`
  </Accordion>

  <Accordion title="Reliability">
    Example rules:

    * SLO coverage<br />
      `slos().length > 0`
      * Before configuring this rule, set up an integration that supports querying SLOs: [Datadog](/ingesting-data-into-cortex/integrations/datadog), [Dynatrace](/ingesting-data-into-cortex/integrations/dynatrace), [Google](/ingesting-data-into-cortex/integrations/google), [Lightstep](/ingesting-data-into-cortex/integrations/lightstep), [New Relic](/ingesting-data-into-cortex/integrations/newrelic), [Prometheus](/ingesting-data-into-cortex/integrations/prometheus), [Splunk Observability Cloud (SignalFx)](/ingesting-data-into-cortex/integrations/splunk-observability), or [Sumo Logic](/ingesting-data-into-cortex/integrations/sumologic).
    * Test coverage minimum met<br />
      `captures("test-coverage", sonarqube.metric("coverage") >= 80)`
      * Before configuring this rule, set up an integration with [SonarQube](/ingesting-data-into-cortex/integrations/sonarqube). The [Codecov](/ingesting-data-into-cortex/integrations/codecov) integration also supports querying code coverage. You can [surface these code coverage metrics in failure messages](/guides/security/code-coverage-rules) for failed Scorecard rules.
    * Zero critical and high vulnerabilities in Mend<br />
      `mend.vulnerabilities(risk = ["Critical", "High"]).length == 0`
      * Before configuring this rule, set up an integration with [Mend](/ingesting-data-into-cortex/integrations/mend). Other integrations that support querying on vulnerabilities include [Apiiro](/ingesting-data-into-cortex/integrations/apiiro), [Checkmarx](/ingesting-data-into-cortex/integrations/checkmarx), [GitHub](/ingesting-data-into-cortex/integrations/github), [Mend](/ingesting-data-into-cortex/integrations/mend), [Semgrep](/ingesting-data-into-cortex/integrations/semgrep), and [Snyk](/ingesting-data-into-cortex/integrations/snyk).
    * On-call rotation has at least one escalation<br />
      `oncall.numOfEscalations() > 1`
      * Before configuring this rule, set up an integration that supports querying on-call: [Opsgenie](/ingesting-data-into-cortex/integrations/opsgenie), [PagerDuty](/ingesting-data-into-cortex/integrations/pagerduty), [Splunk On-Call (VictorOps)](/ingesting-data-into-cortex/integrations/splunk-oncall), or [xMatters](/ingesting-data-into-cortex/integrations/xmatters).
    * Datadog monitor is set<br />
      `datadog.monitors().length > 0`
      * Before configuring this rule, set up an integration with [Datadog](/ingesting-data-into-cortex/integrations/datadog).
  </Accordion>

  <Accordion title="Security">
    Example rules:

    * At least one required approval to merge<br />
      `git.numOfRequiredApprovals() > 0`<br />
      * Before configuring this rule, set up a version control integration: [Azure DevOps](/ingesting-data-into-cortex/integrations/azuredevops), [Bitbucket](/ingesting-data-into-cortex/integrations/bitbucket), [GitHub](/ingesting-data-into-cortex/integrations/github), or [GitLab](/ingesting-data-into-cortex/integrations/gitlab).
    * Code updated in the last week<br />
      `git.lastCommit().freshness < duration("P7D")`
      * Before configuring this rule, set up a version control integration.
    * 0 critical Snyk issues<br />
      `snyk.issues(severity=["CRITICAL"], fixability=["FIXABLE"]) <= 0`
      * Before configuring this rule, set up an integration with Snyk. Other integrations that support querying on vulnerabilities include [Apiiro](/ingesting-data-into-cortex/integrations/apiiro), [Checkmarx](/ingesting-data-into-cortex/integrations/checkmarx), [GitHub](/ingesting-data-into-cortex/integrations/github), [Mend](/ingesting-data-into-cortex/integrations/mend), [Semgrep](/ingesting-data-into-cortex/integrations/semgrep), and [Snyk](/ingesting-data-into-cortex/integrations/snyk).
  </Accordion>
</AccordionGroup>

### Get started with an example Scorecard

You can use the example rules above as a starting point for your Scorecard.

In this example Scorecard, the levels are organized by focus area. Scorecard levels are progressive, with the last level including the highest priority rules. Based on your organization's needs, you may want to reorder rules, add or remove rules, or rename the levels.

You can [create this Scorecard in the UI](/guides/production-readiness/seasonal-readiness-scorecard#create-example-scorecard-via-the-ui), or you can [upload the YAML file via API or GitOps](/guides/production-readiness/seasonal-readiness-scorecard#create-example-scorecard-via-gitops-or-api).

<Tabs>
  <Tab title="UI">
    ### Create example Scorecard via the UI

    #### Step 1: Create the Scorecard and configure its basic details

    1. In Cortex, navigate to **Scorecards** and click **+Create Scorecard**. Start with a blank Scorecard.
    2. Configure the basic details.
       * Include a name that helps your users understand the purpose of the Scorecard (e.g., `Season readiness`) and a description.
       * Learn more about configuring basic fields for Scorecards in [Create a Scorecard](/standardize/scorecards/create).

    ### Step 2: Add levels and rules

    1. Under **Define evaluation rules**, add levels. In our example, we added levels based on focus area:
       * Operational readiness
       * Reliability
       * Security
    2. Under a level, click **+Add rule** to add a rule.
       * For each level, add the [example rules](/guides/production-readiness/seasonal-readiness-scorecard#example-rules) listed earlier in these instructions.
    3. At the bottom of the page, click **Save Scorecard**.
  </Tab>

  <Tab title="API or GitOps">
    #### Create example Scorecard via GitOps or API

    When following a [GitOps approach](/configure/gitops), you can add a Scorecard YAML file to your `.cortex/scorecards` directory in your version control repository. Note that GitOps must be enabled for Scorecards in your [GitOps settings](/configure/settings/gitops-settings).

    You could also use the [Cortex API,](/api/rest/scorecards) where you can submit a Scorecard definition in YAML.

    <Accordion title="Seasonal readiness Scorecard YAML">
      Use the YAML file below to add this Scorecard to your workspace via the API or via a GitOps flow.

      ```yaml theme={null}
      tag: seasonal-readiness
      name: Seasonal Readiness
      description: Ensuring services are ready before the busy season
      draft: false
      notifications:
        enabled: true
        scoreDropNotificationsEnabled: false
      exemptions:
        enabled: true
        autoApprove: false
        userSpecificNotifications: false
      ladder:
        name: Default Ladder
        levels:
        - name: Operational readiness
          rank: 1
          description: Minimum seasonal readiness
          color: "#EBA27E"
        - name: Reliability
          rank: 2
          description: Top level readiness rules
          color: "#B3B3B3"
        - name: Security
          rank: 3
          color: "#33393F"
      rules:
      - title: On-call rotation has at least one escalation
        expression: oncall.numOfEscalations() > 1
        weight: 1
        level: Reliability
      - title: Logs are linked
        expression: links("logs").length > 0
        weight: 1
        level: Operational readiness
      - title: Entity has owner
        description: "For accountability, ensure entities have clear ownership"
        expression: ownership != null
        weight: 1
        level: Operational readiness
      - title: Test coverage minimum met
        expression: "captures(\"test-coverage\", sonarqube.metric(\"coverage\") >= 80)"
        weight: 1
        level: Reliability
      - title: SLO coverage
        expression: slos().length > 0
        weight: 1
        level: Reliability
      - title: Datadog monitoring is set
        expression: datadog.monitors().length > 0
        weight: 1
        level: Reliability
      - title: At least one required approval to merge
        expression: git.numOfRequiredApprovals() > 0
        weight: 1
        level: Security
      - title: Runbook is linked
        expression: links("runbook").length > 0
        weight: 1
        level: Operational readiness
      - title: Low number of Snyk issues
        expression: snyk.issues().length < 5
        weight: 1
        level: Security
      - title: Zero critical and high vulnerabilities
        expression: "captures(\"critical-vulns\", custom(\"critical_vulnerabilities\"))\
          \ == 0 AND captures(\"high-vulns\", custom(\"high_vulnerabilities\")) == 0"
        weight: 1
        level: Reliability
      - title: Code updated in the last week
        expression: git.lastCommit().freshness < duration("P7D")
        weight: 1
        level: Security
      filter:
        kind: GENERIC
        types:
          include:
          - service
      ```
    </Accordion>
  </Tab>
</Tabs>

## Example: H\&R Block's Season Readiness Scorecard

As described in their IDPCON talk, H\&R Block implemented a Season Readiness Scorecard ahead of tax season to drive operational consistency. Their Scorecard helped them automatically measure their organization's top priority areas: Security, resiliency, code coverage, and software development lifecycle best practices.

They included rules to verify on-call coverage, escalation depth, monitoring setup, SLOs, and package versions.

### Outcome

They reduced incidents and bugs by 50% year over year, while automating readiness tracking previously handled manually by six program managers.

#### Their next steps

To continue proactively meeting organizational benchmarks, they also created [Scaffolder templates](/streamline/workflows/scaffolder) with built-in compliance and coding standards. This allowed them to ensure that all new projects were scaffolded with the best practices baked in.

### See the IDPCON session

H\&R Block's Manager of Technology spoke at IDPCON to explain how their organization leveled up developer experience with automation in Cortex:

<Frame>
  <iframe className="w-full aspect-video rounded-xl" src="https://www.youtube.com/embed/_wLdQ5Fxb_g" title="YouTube video player" frameBorder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowFullScreen />
</Frame>


## Related topics

- [Reduce MTTA](/guides/incident-mgmt/reduce-mtta.md)
- [Scorecards](/guides/product-areas/scorecards.md)
- [Set benchmarks for AI readiness](/guides/ai-excellence/set-benchmarks-for-ai-readiness.md)