{
    "name": "Digital maturity matrix — 16 verifiable controls",
    "version": "2026-09-14",
    "language": "en",
    "methodology": "An open framework to assess the existence, application, evidence and management of essential controls. It is not a certification: it makes gaps easier to discuss and prioritise.",
    "levels": [
        {
            "score": 0,
            "name": "Absent",
            "text": "No stable practice or usable evidence."
        },
        {
            "score": 1,
            "name": "Initial",
            "text": "Occasional practice dependent on one person."
        },
        {
            "score": 2,
            "name": "Controlled",
            "text": "Documented, applied and verifiable control."
        },
        {
            "score": 3,
            "name": "Managed",
            "text": "Measured, reviewed and improved control."
        }
    ],
    "controls": [
        {
            "domain": "OSINT",
            "control": "Decision question defined before collection",
            "minimum_evidence": "Dated brief with scope, audience and expected decision"
        },
        {
            "domain": "OSINT",
            "control": "Sources classified by origin, date and reliability",
            "minimum_evidence": "Source log and explicit scoring rule"
        },
        {
            "domain": "OSINT",
            "control": "Facts, hypotheses and unknowns kept separate",
            "minimum_evidence": "Analysis note with confidence levels"
        },
        {
            "domain": "OSINT",
            "control": "Sensitive information minimised and protected",
            "minimum_evidence": "Retention rule and access register"
        },
        {
            "domain": "Cybersecurity",
            "control": "Inventory of exposed assets maintained",
            "minimum_evidence": "List of domains, services, accounts and owners"
        },
        {
            "domain": "Cybersecurity",
            "control": "Critical access protected by resistant MFA",
            "minimum_evidence": "Coverage report and approved exceptions"
        },
        {
            "domain": "Cybersecurity",
            "control": "Patches prioritised by exposure and impact",
            "minimum_evidence": "Dated remediation queue and closure evidence"
        },
        {
            "domain": "Cybersecurity",
            "control": "Backups restored during a test",
            "minimum_evidence": "Report from the latest restoration test"
        },
        {
            "domain": "AI agents",
            "control": "Agent purpose, limits and owner documented",
            "minimum_evidence": "System card and responsibility matrix"
        },
        {
            "domain": "AI agents",
            "control": "Allowed and prohibited data identified",
            "minimum_evidence": "Data classification and applied filters"
        },
        {
            "domain": "AI agents",
            "control": "Sensitive answers evaluated on a test set",
            "minimum_evidence": "Results, acceptance thresholds and known errors"
        },
        {
            "domain": "AI agents",
            "control": "Logging and manual stop available",
            "minimum_evidence": "Execution logs and shutdown procedure"
        },
        {
            "domain": "Visibility",
            "control": "Search intents connected to useful pages",
            "minimum_evidence": "Intent, page, action and metric map"
        },
        {
            "domain": "Visibility",
            "control": "Entities, authors and dates are explicit",
            "minimum_evidence": "Consistent visible markup and structured data"
        },
        {
            "domain": "Visibility",
            "control": "Mobile journeys and performance controlled",
            "minimum_evidence": "Field measurements and key action tests"
        },
        {
            "domain": "Visibility",
            "control": "Conversions connected to entry content",
            "minimum_evidence": "Dashboard by page and business objective"
        }
    ]
}