Foundation

Three disciplines without which nothing else holds up. Digitalization, process management and IT security are the foundation — not the destination.

Digitalization of Processes & Documents

The step-by-step conversion of analogue processes and documents into the digital world, where not yet done. The absence of this foundation significantly hinders transformation.

How centrally and accessibly are your critical business documents (invoices, contracts, HR files) maintained?

Mostly paper. There is no central digital storage. Many documents are scanned or born digital, but spread out — multiple fileservers, mailboxes, legacy archives. Duplicates are the norm. A central document management system (DMS) is in place. Full adoption is still in progress — not every area is connected yet. Central, audit-proof archival integrated with source systems (ERP, mail, CRM). Regular audits, OCR active.

Process Management & Documentation

Systematic description and maintenance of business processes. Process clarity → resource orientation → automation → quick wins.

What is the state of documentation for your critical business processes?

Processes exist only in the heads of long-tenured staff. Nothing is documented. A few processes are loosely described (Word, wiki). No standards, updates happen occasionally. Core processes (~80 % of daily business) are documented in a central system (Confluence, BPMN tool). At least yearly reviews. All critical processes are documented, reviewed every six months, and tied to KPIs. New hires have all templates in week one.

Information & IT Security

Technical and organizational protection measures. Practical reality: 74 % of cyber incidents trace back to the human factor — awareness and basic hygiene beat any expensive suite.

How systematic are your IT-security basics (updates, MFA, awareness, incident plan)?

A firewall and an antivirus — that's about it. No incident plan, no training, MFA is an exception. Updates run, MFA is partially used, an annual awareness training takes place pro forma. An incident plan exists as a Word file but is never tested. Standardised patch day, MFA across the board, regular phishing simulations, incident plan tested — aligned with NIST CSF / BSI IT-Grundschutz. ISMS per ISO 27001 or BSI IT-Grundschutz with audits, pentests, continuous vulnerability scans. Security is part of the culture.

Intermediate

What builds on the foundation. Data, quality, change and compliance are the disciplines that, in mid-sized organizations and the public sector, often decide how far a transformation carries.

Data & Document Management

Structured capture, quality assurance, and governance of your data and business documents. Key point: without clean data, AI stays an expensive hobby.

How is your data quality organised for master data (customers, vendors, products)?

Nobody knows exactly where which data sits. Duplicates, typos and outdated records are everyday. Lead systems exist, but no consistent validation rules. Data is cleaned up reactively when errors surface. Data stewards are named, validation rules are documented, and data-quality reports run regularly. Full data governance per DAMA-DMBOK: master-data hub, quality KPIs, automated validation, regular audits — data quality is tied to objectives.

Quality Management

Planned and practised measures to ensure process quality and customer satisfaction. Maturity ranges from "never discussed" to "ISO 9001 with a real audit cycle".

How tangible is your quality management — KPIs, audits, reviews?

Quality is a value in Sunday speeches, but nobody measures it. Complaints surface randomly. A handful of metrics exist (delivery time, defect rate), but there is no systematic review cycle or improvement loop. A QM manual is maintained, a KPI cockpit exists, internal audits run yearly. Improvement actions are tracked. ISO 9001 (or equivalent) is certified/audited, KPIs are baked into daily operations, continuous improvement is lived.

Change Management & Organizational Development

How your organization carries change through. The evidence (MIT, 2025: 95 % of AI pilots fail — usually at the organization, not the tech) is clear: change management is not an "add-on after kick-off", it is day one.

How is your organization prepared for major technological changes (new systems, AI pilots, infrastructure overhauls)?

Changes are announced. Training, enablement plans, stakeholder involvement? None. Resistance is high. There are point-in-time trainings and kickoff workshops. But no systematic change plan, no communication roadmap. Larger projects come with a change plan (comms, training, go-live support). Stakeholders are involved, feedback channels exist. Change management per ADKAR/Kotter is day one of every project. Leaders are trained as change agents, culture work runs in parallel.

IT Compliance & IT Governance

How tangibly are regulatory requirements (GDPR, NIS-2, AI Act, license management) and decision structures embedded in IT. The obligations are growing faster than many realise.

How structured are IT compliance and IT governance? (GDPR, NIS-2, AI Act, license overview, role clarity)

GDPR was "done" years ago. NIS-2 and the AI Act are not on the radar. Roles and decision paths are unclear. GDPR runs daily. NIS-2 / AI Act are known but not yet implemented. License management is reactive, no inventory. A compliance roadmap exists (GDPR, NIS-2, AI Act), owners are named, license inventory is maintained. IT decisions follow a governance model (ITIL/COBIT-aligned). Governance per COBIT/ITIL is lived, compliance KPIs are dashboard-ready, audit-readiness is given. NIS-2 and AI Act are operationally implemented.

Advanced

Without a stable foundation and intermediate layer, high values here are brittle. Concrete levers: a modern technology stack (Dim 8), innovation and AI capability (Dim 9), and resilience (Dim 10).

Technology & Architecture

How modern and scalable your technology base is. Cloud adoption, API architecture, AI integration and platform modernisation are the levers — they decide whether new use cases scale or remain isolated projects.

Where does your organisation stand (roughly) on technology?

We have substantial catching up to do. Business-critical systems are legacy, with high maintenance burden and no clear modernisation roadmap. We run modern, performant platforms — but with limited scalability and little flexibility for change. Cloud topics are point solutions rather than strategy. We are partially cloud-native and API-oriented, first AI use cases are in production. Scalability works in parts but is not end-to-end. Scalable platform architecture (cloud-native, API-first), AI and agents are standard in automation — both internally and in our products and customer experiences.

Innovation Strategy & AI Integration

MIT 2025: roughly 95 % of GenAI initiatives show no measurable P&L impact — usually not because of the tech, but for lack of governance, data quality and scaling plans. Without strategy, AI is a hobby.

How systematically do you approach innovation and AI in particular?

Innovation happens by accident, AI is a buzzword. No use-case pipeline, no pilot governance. Individual AI pilots are running, but without a clear scaling plan. Data quality, roles and enablement are the real bottlenecks. Innovation pipeline with prioritised use cases, pilot governance (clear scaling criteria), AI strategy aligned with NIST AI RMF / EU AI Act. AI is measurably effective in daily business. AI management system per ISO 42001, clear accountabilities, AI capability is part of the people strategy.

Business Continuity & IT Resilience

Backup is not recovery. An incident plan that has never been rehearsed is hope, not preparation. Veeam 2024: only 32 % of respondents have recovery confidence.

How resilient is your business continuity — backup tests, incident-plan drills, ransomware preparation?

Backups run — probably. They have never been tested. An incident plan does not exist or is outdated. Backups are taken and occasionally spot-restored. An incident plan exists, but is not regularly rehearsed. 3-2-1-1 backup principle, documented recovery tests every six months, incident plan maintained quarterly. Offline / immutable copies in place. BCMS per ISO 22301 or BSI 200-4 — regular disaster-recovery drills with stakeholders, defined RTO/RPO, ransomware resilience tested.

Foundation

Intermediate

Advanced

Dimension

Digitalization of Processes & Documents

Process Management & Documentation

Information & IT Security

Data & Document Management

Quality Management

Change Management & Organizational Development

IT Compliance & IT Governance

Technology & Architecture

Innovation Strategy & AI Integration

Business Continuity & IT Resilience

Detailed report by email

Score per dimension, recommendations per weak spot, benchmark numbers with sources and quick wins — straight to your inbox.

Email address *

I consent to my email address being used for a one-time delivery of the report. Details in our Privacy Policy.

Digital Maturity Self-Check

Foundation

Digitalization of Processes & Documents

Process Management & Documentation

Information & IT Security

Intermediate

Data & Document Management

Quality Management

Change Management & Organizational Development

IT Compliance & IT Governance

Advanced

Technology & Architecture

Innovation Strategy & AI Integration

Business Continuity & IT Resilience

Dimension

Detailed report by email

Want to talk about the result?