• 1.1Core operations (finance, sales, operations, HR) are run on documented systems rather than spreadsheets or informal processes.5 pts
• 1.2Business data is backed up automatically, stored securely, and recoverable in a disaster scenario.5 pts
• 1.3Key systems are connected or share data through integrations, APIs or a central data store.5 pts
• 1.4User access to systems is controlled by role-based permissions and regularly reviewed.5 pts

Evidence required: ERP or accounting system screenshots, CRM licence, payroll/HRIS records, integration documentation.

• 2.1There is a single source of truth for customer, product and financial data.5 pts
• 2.2Data quality rules (deduplication, validation, completeness checks) are in place and monitored.5 pts
• 2.3Data ownership and accountability are assigned to named roles or owners.5 pts
• 2.4Data privacy, consent and retention policies are documented and followed.5 pts

Evidence required: Data dictionary, sample reports, deduplication rules, data quality dashboard, GDPR/privacy records.

• 3.1A documented set of KPIs is used to run the business and is reviewed at least monthly.5 pts
• 3.2Management reports are produced automatically from live data rather than rebuilt manually.5 pts
• 3.3Metrics are linked to actions — underperformance triggers a known response plan.5 pts
• 3.4Relevant performance data is accessible to the people who need it to make decisions.5 pts

Evidence required: Management dashboards, KPI definitions, monthly reporting pack, automated alerts.

• 4.1There is a documented policy for AI use, including approved tools and prohibited data inputs.5 pts
• 4.2Data is clean, structured and accessible enough to be used safely with AI models or analytics.5 pts
• 4.3AI outputs that affect customers, finance or compliance are reviewed by a human before use.5 pts
• 4.4Staff who use AI tools are trained on risks, hallucinations, confidentiality and verification.5 pts

Evidence required: AI use policy, model access logs, data readiness checklist, AI training records, risk assessment.

• 5.1A digital or data strategy is documented and reviewed at leadership or board level.5 pts
• 5.2Cybersecurity essentials are in place: MFA, endpoint protection, patching and incident response.5 pts
• 5.3Digital and data risks are recorded in a risk register with owners and mitigations.5 pts
• 5.4There is a plan for building or buying the digital skills the business needs.5 pts

Evidence required: Board or management meeting minutes, digital strategy document, cyber insurance, risk register.