Digital maturity is not the single real measure of business resilience. Cash, people, suppliers, governance, reputation and many other capabilities matter.
It is a useful lens on one question: can the firm use its technology, data and ways of working to respond when an important condition changes?
That distinction rescues the idea from maturity theatre. A high score or collection of modern platforms does not prove resilience. Evidence from actual decisions, incidents and service changes is more useful.
Investment is different from capability
A firm can launch CRM, portal, analytics and collaboration platforms while employees continue to rely on private spreadsheets, email attachments and personal knowledge.
The invoices and launch dates show acquisition. Maturity appears in use:
- the investment is connected to a commercial or service outcome;
- people can complete the intended task;
- data is suitable for the decisions made from it;
- ownership and controls persist after the project;
- the organisation can change the service without exceptional effort;
- measures reveal benefit, harm and drift;
- suppliers and systems can fail without producing unmanaged chaos.
The source calls the gap a maturity trap. That phrase is worth preserving. Technology creates potential; the operating system around it determines whether the potential is available under pressure.
Resilience is scenario-specific
An organisation can be resilient to remote working and fragile to a cyber incident. It can recover technology quickly and be unable to replace a departed relationship partner's knowledge. It can adapt its service and lack enough financial capacity to absorb a downturn.
Assess maturity against scenarios that matter to the firm.
Examples include a material supplier outage, a regulatory deadline, an acquisition, loss of key people, a rapid shift in client demand, a data incident or the need to launch a new service. Ask which decisions, data, systems and capabilities the response requires.
This prevents a generic assessment from declaring the firm mature in the abstract.
Strategy: can leaders reprioritise with a reason?
Digital work should connect to explicit commercial outcomes, risks or enabling capabilities. When conditions change, leaders can then judge what to accelerate, alter, pause or stop.
A portfolio is less mature when initiative rationales are “modernisation”, “innovation” or vendor end-of-life without explaining the business consequence. Technical renewal can be necessary; connect it to service continuity, security, cost or option value.
Evidence of strategic maturity includes current investment cases, named owners, assumptions, dependencies, measures and review triggers. It also includes a record of work the firm stopped when value disappeared.
Resilience comes from faster informed trade-offs, rather than the ability to keep every project running.
Systems: can the service continue and change?
Modern technology can still be fragile if it depends on one supplier, undocumented configuration or a manual release only one person understands. Older technology can remain serviceable with strong support, recovery and a credible retirement plan.
Inspect critical client and business services rather than platform age alone. Map dependencies, support status, capacity, observability, recovery, access and change lead time. Test restoration and fallback. Record concentrated knowledge.
A resilient architecture is appropriate to the service and maintained. It does not have to be maximally cloud-based, composable or new.
Measure whether teams can make a safe small change, recover from a realistic failure and understand what happened.
Data: can the firm see and trust enough?
A cross-organisational view is useful when definitions, lineage and permissions support it. Producing it through a spreadsheet is not automatically immature; the question is whether the method is reliable, timely and sustainable for the decision.
Data maturity includes ownership, quality standards, minimisation, access control, correction, retention and the ability to explain a measure. It also includes knowing where evidence is absent.
Under pressure, firms often assemble data from several systems. Practice that process before a crisis. Identify the critical questions, source owners and reconciliation route.
Do not collect more data merely to improve a maturity score. Unnecessary data creates security, privacy and operating risk.
People: can they perform the work when conditions vary?
Licence activity is a weak adoption measure. People can log in and still use a shadow process, or use a tool infrequently because the task itself is rare.
Observe real tasks. Ask different roles what they use, where they leave the official route, what they cannot recover from and which knowledge sits with one colleague. Examine accessibility and differing digital confidence.
Build capability through work, support, documentation and feedback. One launch training session cannot prepare people for every future change.
Resilience also requires enough capacity. A named owner with no time and a skilled team permanently overloaded are operational weaknesses a maturity model should not disguise.
Governance and culture: can ordinary decisions improve the service?
“Continuous improvement” becomes empty when nobody can approve a small change, every defect competes with a transformation programme and lessons never move between teams.
A mature rhythm gives service owners a route to review evidence, make bounded improvements and escalate consequential trade-offs. The cadence follows the service. Quarterly strategic review may complement weekly operational work and immediate incident response.
Culture appears in behaviour: people can report problems without punishment, leaders challenge attractive claims, teams share learning and the firm can stop work. It is not measured by asking whether employees feel innovative.
Partnership autonomy needs clear boundaries. Local experimentation can produce learning, while shared data, security and client-experience standards protect the firm.
Suppliers and ecosystem belong in the assessment
The source focuses on internal alignment and underplays external dependence.
For critical suppliers, understand service boundaries, subcontractors, data location, support, change notification, recovery, exit and the firm's own responsibilities. Test whether the organisation can continue, recover or migrate at an acceptable level.
Concentration may be an informed choice. Record why, monitor the assumptions and maintain options proportionate to the consequence.
Client and regulatory ecosystems matter too. A firm may need to exchange data, meet assurance requests or integrate with mandated platforms. Resilience includes the ability to respond without inventing controls for every request from scratch.
A diagnostic based on evidence
For each material scenario, assess five areas:
- Direction: Is the outcome, risk appetite and decision authority clear?
- Service: Are system and supplier dependencies understood and recoverable?
- Data: Can leaders obtain suitable evidence with lawful, secure access?
- People: Do roles have skill, capacity, support and alternatives?
- Learning: Can the firm detect drift, decide and retain what it learns?
Use a small scale if it helps prioritisation, and publish the observations behind each rating. Avoid labels such as “leading” or “sector average” without a defined benchmark.
Ask for counter-evidence. A platform owner may rate recovery highly because backups run; the latest restoration test may show a different result. A leader may rate adoption highly because licences are active; task research may reveal workarounds.
Differences between respondents are findings, not errors to average away.
Start where consequence and dependency meet
Maturity will be uneven. Do not automatically begin with the lowest score. A weak capability with little consequence may be less important than a moderate weakness supporting a critical service.
Prioritise the gap that materially affects a current strategy or scenario and unlocks other work. Improving identity and access may reduce risk across several services. Clarifying client-data ownership may improve reporting and AI evaluation. Repairing one approval route may release many small changes.
Define the next observable improvement, owner, dependencies and review. A multi-year trajectory is built from specific operating changes.
Measure resilience through exercises and events
Scorecards are hypotheses. Exercises and real events provide stronger evidence.
Run a supplier-outage scenario. Restore a service. Produce a client-impact view from current data. Move a routine change through governance. Ask another team to use the documentation. Simulate the departure of a key system owner. Review what slowed the response and fix the cause.
After an incident or urgent change, capture which capability helped and where the organisation improvised. Update the maturity view from evidence.
If you want to do this more rigorously, we've built an online digital maturity scorecard that walks you through each dimension with more granularity. It takes about fifteen minutes and it's the kind of thing worth sharing with a CFO or board member to ground a conversation about where to invest next.
A lens, not a verdict
The strongest source claim is that alignment matters more than technology expenditure. Keep it.
The refinement is that digital maturity does not equal resilience. It explains part of the firm's ability to respond and improve. Its value lies in the decisions and exercises it prompts, not the score it produces.
If leadership points to modern platforms while operational teams maintain shadow work, begin with one critical service and scenario. Trace strategy, systems, data, people and governance through the response.
The firms that respond fastest to market shifts. The ones that serve clients most effectively when expectations change. The ones that recover quickest from operational disruption. They are, almost without exception, the firms where strategy, systems, data, people, and culture are all pointing in the same direction.
For most firms, honestly, they're not. But at least now you know what to measure. And where to start.
