Principle 1 — Evidence Over Intention

Every answer option describes an observable state — a policy that exists, a register that is maintained, a KPI that is reported. Draft strategies, pilots and plans do not score as capability. Respondents should answer as if presenting to an external auditor or an index assessor.

Principle 2 — Measured the Way Governments Are Measured

The dimensions, vocabulary and benchmarks follow the international indices, so an entity can read its DGM results in the language of its EGDI, GTMI, OECD, Qiyas or DGOV ambitions — and see which capabilities move which indicator.

Principle 3 — Investment Feasibility

The twelve dimensions cover, in order, the workstreams of a full digital government and AI readiness study: ICT systems audit, document workflows, data readiness and digitization, directing the government entity where to focus their next budget allocation.

Principle 4 — Foundations Gate Everything Else

Three dimensions — strategy and governance, data readiness, and security, privacy and sovereignty — are Critical Threshold Dimensions. If any falls below the foundational threshold, the overall maturity level is capped, because capability built on ungoverned strategy, unusable data or unsecured platforms overstates real readiness.

Principle 5 — Sovereignty Is a First-Class Domain

Data residency, cross-border transfer control, locally hosted AI models and national cloud policy are assessed explicitly, not as a footnote to cybersecurity.

Principle 6 — Users Are Not One Group

Requirements are assessed separately for officials and decision-makers, operational staff, researchers and analysts, and the public — including accessibility, multilingual delivery and digital inclusion.

Principle 7 — Actionability Over Precision

Every dimension score maps to a maturity-level interpretation with implications, five recommended actions, the key risk and the path to the next level, consolidated into a prioritized action plan and a three-horizon roadmap.

Principle 8 — Two Benchmarks Create Perspective

Each report positions the entity against its selected region — GCC, Middle East or Africa — and against a Global reference, calibrated from the UN, World Bank, OECD, DGA, TDRA and Deloitte data and Planaletix advisory experience with government entities.

D7 - Security, Privacy & Data Sovereignty [11%]

D8 - Service Design, Functional & User Requirements [8%]

Security governance and risk assessment, AI-specific threat assessment, role- and attribute-based access control, encryption and key management, monitoring, logging and audit, compliance with national data protection law, data residency and cross-border controls, privacy by design, incident response, vendor and supply-chain security.