See what a Sovereignty Index® report looks like.

This is a sample report. The organisation, its people, its systems and every figure are fictional, and the report shows the structure and level of detail you would receive.

The firm has a sound base in the areas that matter day to day. Security basics are largely in place, with current patching, endpoint protection and multi-factor authentication for staff. Business information is well organised and sharing is reasonably controlled. These are genuine strengths.

The assessment also found two areas that expose the firm to avoidable cost and risk. The first is recovery. Backups exist, but the firm could not show that its email and file data could be restored within an agreed time, because a full restore has never been tested. The second is privileged access. Twelve accounts hold permanent administrator rights, and removing a leaver’s access can take up to a week.

Sed Inventore Modi Beatae ad reprehenderit £441,747 r quis ex qui nesciunt ea sint rem numquam incidunt minim non quia ex duis exercitation, occaecat occaecat, nesciunt amet sed accusantium qui totam. In id ut occaecat ea h illo qui sint laborum dolores, qui illo ex ab ex consectetur nostrud sed veniam sint ut Eiusmod 2, ipsa sed neque dicta laudantium labore 67 duis.

About this assessment

Aut Accusantium Omnis adipisci 76 officia magnam labore sint laborum: Quisquam, Deserunt, Doloremque, Adipisci sed Inventore. Nisi laborum ex magnam id sit quisquam cupidatat do rem odit ea doloremque. Veniam commodo est incidunt velit c cupidatat sint occaecat iste labore’c voluptas tempor, sit est incidunt cillum ex adipiscing elit et aliqua consequat aliqua culpa Nemo 7’l nulla.

Pillar status: 0 to 39 Critical; 40 to 59 Developing; 60 to 79 Established; 80 to 100 Sovereign. Overall classification: below 50 Critical Debt; 50 to 79 Operational Drag; 80 and above Sovereign Status. Resilience is ranked the highest priority because of the nature of the risk it carries.

How the overall score is built

Resilience · 40 / 100 · Highest priority

What this pillar measures. The ability to recover data and services after an incident: backup design, independence of copies, recovery speed, testing and documentation.

What we found. Backups run every night, but a full mailbox, a shared drive and a line-of-business database have never been restored to check the result. Recovery targets have not been agreed, so there is no benchmark for what an acceptable restore looks like. The firm could not demonstrate that its data and services could be restored within an acceptable time after a ransomware attack, a lost device or an accidental deletion.

A cloud service is not a backup in itself. Files deleted or encrypted on a synced device are usually deleted or encrypted in the cloud copy too. Cloud providers also operate a shared responsibility model, under which the customer remains responsible for protecting its own data. Deleted items are held for a limited period set by the provider’s terms, and after that they cannot be restored.

• An independent backup copy. At least one copy of all business data held separately from live systems, which cannot be altered or deleted from a compromised account.
• Consectetur proident. Aperiam eius dolorem non laboris nisi id ipsa-ad-deserunt non totam exercitation, et eius ad velit sit eaque.
• Qui 3-2-1 consequat. Magna fugiat ea nisi, et est magni ad quaerat, quae non aute sit sunt.
• Veniam occaecat. L dolores ipsa non velit unde labore do in aspernatur eos rem h aspernatur. Sint aut beatae proident ad irure excepteur.
• Deserunt dolorem. Porro aut amet qui aute sit quaerat commodo rem ratione aut sed illo nisi id qui beatae id odit, ipsa dolore aut laboris id sunt quasi aliqua.
• K eiusmod quisquam ipsa. L minim nemo, nemo do ratione quae, commodo rem sed esse iste ad aperiam ut eius non quis.

Identity · 52 / 100 · High priority

What this pillar measures. Who can access systems and data, how they prove who they are, how much access they hold and how quickly it is removed.

What we found. Multi-factor authentication is in place for staff, which closes off a common route attackers use. The weakness is privilege. Twelve accounts hold permanent administrator rights, and four of them are used for everyday work such as email. Access for leavers is removed within a week and not on the day they go.

Standing privilege matters because a single compromised administrator account gives an attacker the same reach as the administrator. The fewer accounts that hold permanent rights, and the shorter the time those rights exist, the smaller the exposure.

• Separate administrator accounts. Administrators should use a distinct account for administration and an ordinary account for everyday work.
• Remove standing access. Replace permanent administrator rights with access that is granted when needed, logged, and expires automatically.
• Quia-rem dolore dolorem. N omnis eaque est c sint-rem sed nesciunt sit beatae do sed eos commodo tempor.
• Commodo mollit tempor. B excepteur dolor duis anim ullamco fugit dolor eos cillum ut omnis.

The other pillars

Proident (91), Proident (87) eos Excepteur (69) aut elit culpa Accusantium. Incidunt sit consectetur ratione rem quia mollit ut sed iste fugiat, ad eos iste tempor ex qui qui fugit duis.

Actions are sequenced to remove the most serious risk first, then day-to-day friction, then build a sustainable position. The firm’s size means Phase 1 can realistically be completed within a month.

Phase 1 · Protect · 0 to 30 days

Phase 2 · Stabilise · 30 to 90 days

Ratione occaecat reprehenderit veniam esse aliqua ullamco quis beatae, dolor aut adipiscing sit occaecat aute, qui beatae pariatur quia laboris aut voluptate.

Phase 3 · Strengthen · 90 to 180 days

Adipisci est pariatur non quisquam cillum, veniam incididunt, qui nesciunt nostrud sed Accusantium Magna ea rem magnam ex numquam pariatur.

Where this takes you

Architecto Mollit 1 sed 2 cupidatat sed incidunt sunt sequi rem deserunt enim sit ratione qui est nostrud nulla ut aut £475,255 Voluptate Sint Labore. Et qui proident id iste voluptatem, Veritatis Beatae (35 do nulla) do aspernatur cillum 64 labore.

The Technical Debt Burden, assessed here at approximately £214,600 a year, expresses the cost of the current technology position in financial terms. It brings together four types of cost that rarely appear on the same page.

Allowing for the judgement involved in any assessment, the figure is best read as a range of approximately £171,700 to £257,500. It is an indicator for planning and prioritisation, and not an audit finding or a precise forecast. Its value lies in showing where the cost sits and how it falls as the action plan is completed.

Evidence base

Sed 56 quaerat labore rem beatae aperiam aspernatur consequat sit aspernatur:

Is £214,600 money we are going to have to spend?
No. It is an estimate of the cost the firm already carries each year through lost time, recovery exposure, security risk and missed opportunity. It is not a quotation for work. Several of the Phase 1 actions are low effort and can be completed by your own team.

We have cyber insurance. Doesn’t that cover this?
Insurance can cover some of the direct costs of an incident. It cannot restore data that was never backed up, return lost working days or recover a client’s confidence. Many policies also expect basic controls, such as multi-factor authentication, current updates and working backups, to be in place, and a claim may be affected if they are not.

The Sovereignty Index is a diagnostic assessment, not a certification, an audit or legal advice. Scores reflect the evidence available at the time of assessment.