Research · Digital Consulting
A single maturity score hides more than it shows. This note explains how the index is built, what evidence counts, and how to read a result so that it tells an organisation what to do next.

About this note. It documents the method behind the index and how to interpret a score. It does not reproduce organisation-level results.
Ask most organisations whether they are digitally mature and you get a confident answer that does not survive one follow-up question. We have the system. It is in use. The data comes out of it. These are three separate claims, and organisations that can make all three are rarer than those that can make the first.
The index exists to separate those claims. The 2025 edition covers organisations in Kenya, Uganda and Tanzania. What follows is the method, because a score without a method is an opinion.
Maturity describes what an organisation has today: systems, skills, habits. Readiness describes how much new change it can absorb without breaking. Two organisations with the same systems can differ widely in readiness. One has a finance team that documents its work and a leadership that reads reports. The other runs on the memory of two long-serving staff.
Digital plans usually fail on readiness, not on technology. A clinic network buys a records system that its sites cannot power reliably. A cooperative adopts a mobile app that nobody in the office is responsible for. Neither purchase was foolish. Each ignored what the organisation could absorb.
The dimensions are deliberately few, so that each can be examined with evidence and each maps to an action a leadership team can take.
Figure The five dimensions of the index, scored on four levels
The shape matters. A five-sided profile with one short spoke tells an organisation where its constraint is. An average of the five hides it.
Each dimension is scored on four levels. The rule that gives the index its discipline is that a level is awarded only where we can inspect something.
Table The four levels and the evidence that supports each
| Level | Name | What it looks like | Typical evidence |
|---|---|---|---|
| 1 | Ad hoc | Work depends on individuals, and tools are personal. | Nothing written down; answers differ between staff. |
| 2 | Repeatable | A procedure exists and some teams follow it. | A written procedure; a log with gaps. |
| 3 | Managed | The procedure is owned, measured and reviewed. | A named owner; a report used in meetings. |
| 4 | Embedded | Improvement is routine and new change is absorbed easily. | Review records showing changes made; staff who can explain why. |
Suppose an organisation says its customer records are digital. At the first level, records sit in spreadsheets kept by individual officers. At the second, there is a shared file and an agreed format, but entries are inconsistent. At the third, one person owns data quality, checks run monthly and a report goes to management. At the fourth, that report is used to decide something, and there is a record of a decision that changed because of it. The system is the same in all four cases. Only the evidence differs.
Comparing organisations across Kenya, Uganda and Tanzania is useful and easy to overdo. Each country has its own regulator and its own rules on personal data. Kenya's Data Protection Act dates from 2019, Uganda's Data Protection and Privacy Act from the same year, and Tanzania's Personal Data Protection Act from 2022. An organisation that holds customer data in more than one country has to satisfy more than one law, and its People and Process scores look different as a result.
Public bodies in Kenya have a common reference in the National Digital Master Plan 2022 to 2032, which sets out four pillars: digital infrastructure; digital government services, products and data management; digital skills; and digital innovation, enterprise and digital business. When we assess a Kenyan public body we read its strategy evidence against those pillars. Public and private bodies elsewhere in the region work under different frameworks, and we do not pretend the comparison is exact.
Sector is the other caution. A commercial bank and a county government department are not the same problem, and an index that ranks them in one league table teaches little. We compare within a sector first and across sectors only for general patterns.
Five habits turn a useful score into a misleading one.
The weakest dimension sets the pace. An organisation with strong leadership intent and weak records will not get far by strengthening leadership further.
The number of systems an organisation owns says little about how well they work together. Three systems that do not exchange data create more manual work than one.
A licence bought is a cost incurred. Adoption is measured by what people do on an ordinary Tuesday.
Self-assessment drifts upward, mostly without bad faith, because people rate their intentions. That is why the evidence rule exists, and why a second reader should test any self-score.
Sitting at the sector median is not the goal. The right target is the level at which the organisation's next planned change can succeed.
The next step is set by the lowest dimension, not the average.
A score is useful only if it changes what an organisation does in the next quarter. The table shows how we translate the weakest dimension into first actions.
Table First actions by weakest dimension
| Weakest dimension | First 90 days | Watch for |
|---|---|---|
| Strategy and leadership | Name one executive owner for digital priorities, agree three outcomes and fund them. | Priorities that change with each budget cycle. |
| Data and records | Choose one record that matters, such as customers or stock, and give it an owner and a monthly quality check. | The same record held in several files. |
| Technology and infrastructure | Fix what blocks daily work first: power, connectivity and devices at the busiest site. | New systems bought before the basics are reliable. |
| People and skills | Train the people who will run the next system before it arrives, and name a backup for each critical task. | Skills held by one person. |
| Process and governance | Write down the three processes that carry the most risk, including who may see personal data. | Procedures nobody has read. |
These are starting points, not a plan. A real plan adds the organisation's budget calendar, its regulator and its appetite for change.
If your organisation is preparing a digital investment, the most useful first step is to ask what evidence supports each of its five scores. We can help you do that in weeks.
Book a Consultation