Question 1 of 166%

How clearly is IT’s contribution to the organisation defined?

Consider how decisions and investments are actually directed.

Direction, principles and the roadmap demonstrably inform decisions The direction is clear, but has not yet been fully translated into a coherent roadmap There are separate plans; priorities and decisions are mostly made per project There is no shared view of the desired direction or overall coherence

How current is the shared view of the IT landscape and its dependencies?

Consider applications, information, infrastructure, processes and ownership.

The landscape, dependencies and ownership are current and inform decisions The main structure is known; some components or dependencies are not yet current Knowledge is dispersed across suppliers, documents and a small number of key individuals There is no reliable shared view of the landscape and its critical dependencies

How well does the digital workplace support day-to-day working practices?

Consider different roles, locations and devices.

The workplace demonstrably fits and performance and use are improved actively The workplace largely meets requirements; exceptions and improvement points are known The user experience varies noticeably by group, location or device Workplace limitations regularly disrupt day-to-day work

How coherently are identity, devices, applications and information managed across the digital workplace?

Consider access, device management, security and the complete lifecycle.

One demonstrable baseline covers access, devices, applications and information Standards are largely applied and the main exceptions are known Control varies noticeably by user group, device or application There is no coherent management and security baseline for the digital workplace

How are cloud and infrastructure decisions made?

Choose the statement that best describes decision-making.

Workload and business requirements demonstrably determine the platform choice Architecture principles exist but are not yet applied consistently Choices mainly follow the incumbent supplier, technology or available product There is no consistent framework for on-premises, SaaS, private or public cloud

Has a viable exit route been defined for critical cloud services?

This concerns digital sovereignty: retaining control over data and dependencies.

The exit route is defined, technically viable and reviewed periodically The main dependencies are known, but the exit has not yet been fully developed Contractual arrangements exist, but technical feasibility, timescale and cost remain unclear Digital sovereignty and a potential exit have not been assessed explicitly

How current is the view of vulnerabilities and digital risks?

This requires both a current view and demonstrable follow-through.

There is a current risk picture with demonstrable prioritisation and follow-through Periodic reviews take place, but follow-through is not yet embedded throughout Insight mainly arises following an incident, audit or individual assessment There is no current, coherent view of vulnerabilities and digital risks

When was recovery of a business-critical service last tested in full?

Not merely the backup, but the working service after recovery.

Recently tested in full, including dependencies, responsibilities and acceptance Components have been tested, but not recovery of the complete service chain Backups are checked, but actual recovery is tested only occasionally It cannot be demonstrated that recovery works within the required timeframe

Who safeguards the outcome when multiple suppliers are involved?

Governance connects individual specialisms into one working service.

One owner demonstrably directs performance, agreements and the end-to-end outcome Roles are defined, but end-to-end direction and escalation could be sharper Each supplier mainly protects its own component; coherence requires substantial internal coordination The organisation depends heavily on suppliers without clearly assigned end-to-end ownership

How transparent are total IT costs in relation to use and value?

Look beyond invoices: contracts, capacity, licences and lifecycle all matter.

Costs are fully traceable and actively directed according to use and added value An overall view exists, but not every cost development can be explained Cost information is spread across budgets, contracts and suppliers There is no reliable overall view of cost, use and future commitments

How predictably are major IT changes delivered?

Consider migrations, implementations and changes involving multiple teams or suppliers.

A consistent approach exists with clear decision points, acceptance and handover There is sufficient experience, but the approach and assurance vary by programme The outcome depends heavily on the supplier or a small number of key individuals Major changes regularly cause delay, rework or disruption

When is a major IT change demonstrably ready to be handed over to operations and users?

Technical delivery is only one part of a controlled transition into service.

Acceptance, documentation, adoption, ownership and aftercare are explicit go-live criteria Handover is largely arranged and remaining actions are actively tracked Handover, documentation and adoption usually follow the technical go-live Ready mainly means technically delivered; ownership and assurance remain unresolved

How is it decided whether generative AI can deliver demonstrable value in a specific business process?

Consider the intended outcome, current baseline, process ownership, cost and measurable decision criteria.

Each use case has a defined process objective, owner, baseline, costs, benefits and stop-or-proceed criteria that are actively tracked The business case and owner are defined, but the baseline or measurable decision criteria are not yet complete Exploration or pilots are under way, but their connection to process outcomes, cost and ownership is only partly developed Generative AI is mainly explored through available capabilities or isolated requests, without a concrete business case

How are governance, validation and meaningful human oversight organised for generative AI?

Consider permitted use, data and access, testing in context, traceability, incident handling and ongoing monitoring.

Use and accountability are bounded; outputs are appropriately validated, monitored and reviewed by authorised people where necessary Core policies and controls are in place, but their application, validation or monitoring still varies by use case There are separate guidelines or manual checks, without coherent governance and demonstrable validation There is no clear framework for data, use, human review, traceability and follow-through

Which areas require attention first, in your view?

Choose up to two areas. Your choice helps determine the advisory order without changing the substantive score.

Strategy & architecture Workplace & Microsoft 365 Cloud & sovereignty Security & resilience Operations & governance Migration & change Generative AI

When should the first outcome become visible?

This does not affect the substantive score, but helps determine an appropriate first step.

Within three months: there is a concrete reason or urgency Within three to twelve months: prepare and improve with purpose There is no fixed timetable yet; direction and priorities come first

In 33 seconds

Two assessment routes. One useful starting point.

The IT Quickscan provides a broad view across seven themes; the Digital Resilience Check focuses on risk and recovery. Both routes show where focused action is needed first.

Florine voice-over · Dutch audio and captions

Receive your outcome as a PDF.

Discuss your outcome?

Two assessment routes. One useful starting point.