ForIT · General Business
IT Maturity Map
Assessed 2026-07-01 · 9 categories × 5 levels
Target 95/100 (+22 to close the gap)
Domain heat strip (current level)
Top 3 gaps — where to invest next
Security & Data Protection
Reach L5: Continuous access evaluation with just-in-time elevation; AI-driven detection and autonomous containment under guardrails; auto-verified restores, ransomware isolation and self-orchestrating failover.
AI
Reach L5: Continuous AI governance (automated policy enforcement, drift/misuse monitoring, an auditable model lifecycle); agentic automation of routine work under guardrails; agents execute & remediate; continuously-measured productivity uplift; an AI-native operating model.
Governance & IT Strategy
Reach L5: Continuous, data-driven strategy with real-time KPI/OKR telemetry; AI assists portfolio prioritisation and scenario planning; governance keeps pace with autonomous delivery.
Domains × maturity levels — current state & next move
Governance & IT Strategy
Core ITIT strategy aligned to business objectives, an IT operating model, policies/standards, a risk register, and KPIs/reporting to leadership.
Now — L4 Proactive / Measured
Strategy is outcome/metric-driven with a governed portfolio and risk register; KPIs/OKRs tie IT to business results; investments prioritised on measured value.
Next move
Continuous, data-driven strategy with real-time KPI/OKR telemetry; AI assists portfolio prioritisation and scenario planning; governance keeps pace with autonomous delivery.
Security & Data Protection
Core ITIdentity & access (SSO/MFA/PAM, joiner-mover-leaver), threat management (EDR/MDR, SIEM, vuln mgmt, tested IR), and data protection (backup/DR, tested restores, retention, DLP, immutability) in one view.
Now — L4 Proactive / Measured
Risk-based access with reviews, least-privilege and PAM; detection measured (MTTD/MTTR) with SOAR playbooks; RPO/RTO measured against SLA, automated restore drills, immutability enforced, DLP tuned on metrics.
Next move
Continuous access evaluation with just-in-time elevation; AI-driven detection and autonomous containment under guardrails; auto-verified restores, ransomware isolation and self-orchestrating failover.
Devices & Endpoints
Core ITMDM (Jamf/Intune), zero-touch enrollment, patch compliance, device trust, disk encryption, and asset lifecycle (ITAM).
Now — L4 Proactive / Measured
Patch/compliance SLAs measured, config drift auto-remediated, hardware/OS lifecycle tracked, risk-scored posture gates access.
Next move
Self-healing endpoints, autonomous patch/config remediation, AI predicts device failure and pre-empts it, near-zero manual imaging.
Network & Physical
Core ITSegmentation, ZTNA/SASE, redundancy and monitored performance — plus site/physical security and access control (doors, cameras, OT).
Now — L3 Defined / Standardized
Segmented zones, ZTNA/SASE rollout begun, redundant links, performance monitored with alerting; site networks segmented from OT.
Next move
Micro-segmentation, ZTNA/SASE enforced org-wide, SD-WAN with measured performance/SLA, automated failover; OT segmentation enforced and monitored.
Cloud & Infrastructure
Core ITIaC, cloud posture management (CSPM), cost governance (FinOps) + license cost-effectiveness, and resilience/HA.
Now — L4 Proactive / Measured
Everything-as-code with policy-as-code guardrails, FinOps with unit economics, license spend optimised on metrics, resilience tested (chaos/failover).
Next move
Self-optimizing infrastructure, AI-driven capacity & cost optimization, autonomous license/right-sizing, near-zero manual provisioning.
Business Applications & Data
Core ITThe line-of-business apps the company runs on, plus data governance — ownership, cataloguing, quality, records/retention and a governed knowledge base.
Now — L4 Proactive / Measured
The app portfolio is rationalised on measured value; data quality is measured; integrations are monitored; retention enforced & sampled; a governed knowledge base exists.
Next move
AI-assisted data governance and app optimisation; a continuously-scored, RAG-ready governed knowledge base; near-zero manual data toil.
Collaboration & Communications
Core ITM365/Google workspace governance, records/retention, external-sharing control and guest lifecycle, sensitivity labels, and the communications stack.
Now — L4 Proactive / Measured
Adoption & governance measured, auto-expiring guest access, DLP + labels enforced with metrics, lifecycle automation for teams/sites.
Next move
At or above target — sustain.
IT Support & Operations
Core ITService desk, monitoring/observability, asset/CMDB, change management and runbook automation.
Now — L4 Proactive / Measured
SLAs measured & met, observability (metrics/logs/traces), change success rate tracked, runbook automation, proactive problem management.
Next move
Self-healing operations, AIOps correlates & auto-remediates, agentic resolution of routine tickets under guardrails, predictive incident avoidance.
AI
AI EraAI governance AND adoption in one axis: acceptable-use policy, data-boundary/DLP for AI, model-risk & vendor review, shadow-AI discovery and data readiness — together with copilots deployed & adopted, AIOps in the loop, agentic automation under guardrails, and measured workforce uplift.
Now — L4 Proactive / Measured
AI use inventoried & risk-tiered with shadow-AI discovery and model-risk/vendor review on cadence; AIOps in monitoring/triage/routing loops; measured workforce uplift (adoption %, toil reduction); human-in-the-loop controls.
Next move
Continuous AI governance (automated policy enforcement, drift/misuse monitoring, an auditable model lifecycle); agentic automation of routine work under guardrails; agents execute & remediate; continuously-measured productivity uplift; an AI-native operating model.