Digital Maturity Check

No digital or data strategy. Technology and data work happens wherever energy exists.

Some teams plan technology and data work, but plans are local and disconnected from business strategy.

An endorsed digital and data strategy links investment to business objectives and guides decisions.

Strategy progress is measured, and investment shifts with results and business change.

The strategy is refreshed ahead of change and shapes business strategy in return.

There is no digital or data strategy, and technology and data are not mentioned in business plans

Technology and data work happens in projects, but no strategy links it to business goals

Leaders have agreed which systems and data matter most and why they matter to the business

An endorsed digital and data strategy links investment to business goals

Benefits of digital and data investments are measured against baselines and full costs

Leaders can show how distinctive data assets create advantage that persists

No one is responsible for technology or data, and systems have no owners.

A leader has data in their title but little mandate or capacity.

A senior leader holds a clear mandate, priorities and a budget for technology and data, and every system and data domain has an owner.

The leader, system owners and data owners are measured on outcomes.

Leadership renews itself through succession, delegation and a bench of data-capable leaders.

No leader is responsible for technology or data, and there is no budget for either beyond licences

Responsibility for systems and data is split across IT and business teams, with no single leader and no system owners

A named leader is accountable for technology and data, with a budget, and every critical system and data domain has an owner

A senior leader sets digital and data priorities, and data appears in planning, budgets and board papers

Funding follows demonstrated value, and priorities are reset based on results

Data shapes strategy, and records show enterprise decisions changing because of it

No shared definitions. Every report defines things its own way.

Some teams keep glossaries, but the glossaries disagree.

Critical data has agreed definitions in a catalogue people actually use.

Definition coverage, freshness and catalogue use are measured and managed.

Definitions evolve under governance, and finding data is near effortless.

No one can list the organisation’s key data or say where it is held

The same measure gives different answers in different reports

Critical data is inventoried, has named owners and meets agreed quality standards

Data from different systems is integrated for the organisation’s priority measures

Data quality is measured against targets, and breaches are investigated at the source

Distinctive data assets are curated and improved as long-term investments

No owners. Questions about data have no home.

Informal owners exist where individuals care.

Every critical data set has a named owner and steward with clear duties.

Decision timeliness and issue resolution are measured for each owner.

Ownership adapts with the organisation and covers new data automatically.

There are no agreed rules for who can see, share or delete data

Data is shared on request or habit, with no agreed rules on permitted use

Owners and stewards are assigned, and rules for permitted use, sharing and retention are followed

Owners and stewards make recorded decisions on data use, sharing and exceptions

Governance decisions are recorded and reviewed, and policy improves from exceptions and incidents

Ethical judgement is applied ahead of regulation and builds stakeholder trust

No classification. Access is accidental history.

Sensitive data is known informally, and access accumulates.

Systems and data are classified, and access is role-based and applied consistently.

Access is reviewed on a cycle, and exceptions are managed.

Access adapts automatically to role changes, and anomalies are caught.

Systems and data are not classified or protected, and loss or exposure would go unnoticed

Access depends on who you know, and sensitive data moves by email and shared drives

Essential Eight basics, classification, access controls and tested backups protect critical systems and data

Access is role-based and reviewed, and incidents are detected, reported and resolved

Controls are tested on a risk basis, and monitoring finds issues before they cause harm

Protection adapts ahead of threats, and demonstrated trust wins customers and partners

Tools are bought as needs arise. Data moves by export, re-keying and email.

Point-to-point links multiply, and each new join is a project.

Each critical record has one home, and authorised users and systems get the data they need through maintained interfaces.

Time-to-connect and reuse are measured, and duplicates are consolidated.

New sources and uses connect quickly through standard patterns.

Tools are bought as needs arise, and records sit on paper, in personal files or in single-purpose systems

Many tools, little connection. Key data lives in spreadsheets and systems that do not connect, and the same record is keyed into several of them

Each critical record has one home in a managed system, with backup and recovery tested

The systems behind priority workflows connect through maintained interfaces, and authorised staff combine the data they need without manual workarounds

Core systems run standard work as designed, platforms scale with demand, and change lead times, licence use and operating costs are tracked

A clean core and a sharp edge: standard where it can be, built only where it sets the organisation apart, and the architecture adapts ahead of business change at a cost leaders accept

Numbers conflict, and methods are opaque.

Good analysis exists in pockets, and standards vary.

Priority measures are defined once, and analysis is validated.

Analytical quality is checked, and measures are reviewed against use.

Methods improve continuously and stand up to challenge.

Reporting is rare and produced only when someone asks for it

Reports are built by hand each cycle and are often late or disputed

Core reports come from one agreed source and match each other

Priority decisions are informed by trusted analysis, with uncertainty communicated

Experiments and evaluations test whether decisions delivered the intended outcomes

The organisation tests, learns and adapts faster than its competitors

No one knows what automation and AI are in use.

Lists exist for some tools. Embedded AI is invisible.

An inventory covers built, bought and embedded AI, and selection weighs value, alternatives and risk.

The inventory drives review cycles, and selection decisions are audited.

Selection anticipates opportunity and risk, retiring as readily as adopting.

Repetitive work is done by hand, and automation has not been considered

Automation is limited to macros and workarounds built by individuals

Automation is chosen deliberately, with risks assessed before use, and the AI tools staff use are registered with an owner

An inventory covers all AI and automation in use, including tools bought or embedded in products

AI and automation run in core workflows, with monitoring and human oversight

AI improves products, services and customer experience, safely and at scale

Work starts from requests, not needs.

Some teams talk to users. Most build to order.

Product owners maintain roadmaps built from user needs and priorities.

Roadmaps are managed by measured value and usage.

Discovery is continuous, and the portfolio anticipates need.

No one builds or maintains reports, forms or datasets for others to use

Useful reports and integrations depend on one or two people and break when they leave

Shared reports, integrations and datasets are documented and maintained, not personal files

Digital and data products have owners, roadmaps and users beyond the team that built them

Products are reused across teams, with service levels and feedback loops

Digital and data products and partnerships create new offers or revenue

Data skills are accidental.

Training exists but is generic and optional.

Each role has defined system and data skills, and staff demonstrably have them.

Competence is assessed, and gaps close to a plan.

Skills renew ahead of need as roles and tools change.

Data skills are not part of any role description or training plan

A few capable individuals carry most of the organisation’s data skills

Staff who handle systems and data are trained in quality, privacy and security basics, and each core system has a trained administrator

Data literacy is built into roles, with training completed by leaders and managers

Workforce plans cover critical data skills, succession and retention

The organisation attracts, grows and keeps data specialists that others seek

Data plays no part in daily work.

Use depends on individual preference.

Data use is embedded in priority workflows and roles, and staff work in the systems as designed.

Usage is measured by workflow, and gaps trigger action.

Staff extend data use themselves, and it spreads.

Decisions are explained by experience and opinion, not evidence

Meetings spend more time debating the numbers than deciding

Staff report data issues, and issues are logged and fixed at the source

Leaders routinely ask what the data says and expect evidence in business cases

Most staff use data in their daily work and suggest improvements

Staff challenge assumptions with evidence, and mistakes become lessons