> For the complete documentation index, see [llms.txt](https://knowledge.adsgroup.org.uk/8RnoQ2Y1ZgHQnhYYpqoO/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://knowledge.adsgroup.org.uk/8RnoQ2Y1ZgHQnhYYpqoO/digital-and-cybersecurity-pillar/assessment-guide/question-framework-and-scoring-system.md).

# Question Framework and Scoring System

## **Introduction to the Question Framework**

The **Digital Pillar Question Framework** is designed to provide clarity and consistency in evaluating your organisation’s digital and cybersecurity maturity. Each question in the assessment tool is structured to align with specific architecture themes, sub-themes, and exemplar statements, ensuring a comprehensive evaluation. See the walkthrough below to see how the questions are structured. This example is shown from the downloadable excel tool to show how the structure is laid out. The online digital platform provides an AI assisted assessment experience.

{% embed url="<https://app.guideflow.com/player/8kon0w4b5p>" %}

The latest **question assessment excel sheet** can be downloaded below:

{% file src="/files/k5Et30fguxYDzJ2ep8Ed" %}

## **Framing the Question**

Each question is thoughtfully developed to guide organisations through a detailed evaluation process:

* **Theme and Sub-Themes**
  * Questions are grouped under architecture areas (Business, Data, Application, Technology, Security).
  * Sub-themes provide a more granular focus, such as **Data Management** or **Cybersecurity Controls**.
* **Exemplar Statements**
  * These statements represent ideal outcomes or benchmarks for each sub-theme.
  * For example, under **Data Management**:\
    \&#xNAN;*Bronze Level*: “Secure storage and access controls are in place, ensuring data is organised and protected.”
* **Consider Column**
  * Provides additional context to guide the respondent in understanding the specific requirements of the question.
  * For example: “Does the organisation maintain a documented and tested incident response plan?”
* **The Question**
  * Focused, clear prompts that evaluate practices, such as:\
    “Are critical business systems backed up using secure and encrypted methods to ensure recoverability?”
* **Performance Type**
  * Each question evaluates specific performance categories:
    * **Capability**: Processes, tools, and people-related competencies.
    * **Metric/KPI**: Quantifiable metrics measuring progress.
    * **IGP**: Indicators of Good Practice, such as adherence to industry standards.

***

## **Maturity Model**

The **Maturity Model** evaluates each question on a 0–3 scale, enabling organisations to measure their progression from foundational to optimised practices:

* **0 – Not Considered**: No current practices or consideration for the capability.
* **1 – Defined**: Initial planning or awareness exists, but implementation is limited.
* **2 – Managed**: Policies and processes are operational, with basic oversight.
* **3 – Optimised**: Fully embedded and continuously improved practices.

This scoring system provides clarity on where an organisation currently stands and offers a roadmap for advancing maturity levels.

***

## **Integration, Scoring, and Evidence**

To ensure accuracy and relevance, the assessment incorporates features for integrating external frameworks, assigning scores, and gathering evidence.

* **Integration with Existing Frameworks**
  * Questions can be linked to established frameworks like AeroExcellence or SIRI.
  * Responses to these frameworks may auto-fill corresponding maturity levels in the Digital Pillar, streamlining the process.
* **Scoring: Current, Compliance, Target**
  * **Current Score**: Reflects where the organisation currently stands.
  * **Compliance Score**: Indicates adherence to mandatory standards (e.g., GDPR, ISO).
  * **Target Score**: Helps set achievable improvement goals.
* **Evidence Requirements (Silver and Gold)**
  * For advanced levels, evidence must substantiate responses, such as:
    * Compliance certifications (e.g., ISO 27001, Cyber Essentials).
    * Documented policies, processes, or audit reports.

***

## **Using the Framework for Continuous Improvement**

The structured nature of the question framework ensures that each response contributes to a deeper understanding of organisational maturity. By focusing on specific sub-themes, exemplar statements, and performance types, organisations can:

* Pinpoint strengths and weaknesses.
* Prioritise improvement actions.
* Benchmark against industry standards and peers.

Look next at the [**Core Assessment Sections**](/8RnoQ2Y1ZgHQnhYYpqoO/digital-and-cybersecurity-pillar/assessment-guide/core-assessment-sections.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://knowledge.adsgroup.org.uk/8RnoQ2Y1ZgHQnhYYpqoO/digital-and-cybersecurity-pillar/assessment-guide/question-framework-and-scoring-system.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.