The Sovereignty Index®
Your estate, measured.
Your debt, in pounds.
Your invoices show what you pay for IT. The Sovereignty Index® puts a figure in pounds on the rest: the cost of fragility and deferred decisions, with the evidence behind it, in a written report within four weeks of the opening session. Fixed fee. No obligation to go further.
One document. Three things on every page.
Every Sovereignty Index® report contains three things: a scored position across five pillars, a calculated Technical Debt Burden stated in pounds, and a prioritised set of findings your executive team can act on without translating from technical language first.
Pillar scores
A scored position across Identity, Velocity, Resilience, Security and Cognitive, each rated on a common scale so your executive team can see the shape of the estate at a glance.
Technical Debt Burden
A single £ figure for the annual cost of your current estate's fragility: emergency cover, insurance exposure, deal risk and staff hours lost to workarounds. It is calculated with the working shown and given with a range.
Prioritised findings
A ranked set of findings with recommended actions, sequenced by impact and effort. Written for your executive team. Takes your existing team from "we think there's a problem" to "here is the problem and here is what to do about it."
Five pillars. Fifty questions. One number.
The Index assesses your estate across five areas that together decide whether you are in control of your IT or whether the appearance of control is masking structural fragility that may surface as a cost or a crisis.
Identity
Who can access what, and how do you know?
Have you ever fully audited who holds privileged access to your infrastructure and your SaaS applications? Identity assesses your directory architecture, privileged access management and offboarding rigour. It is often where the most immediate findings sit.
Velocity
How quickly can your IT respond to the business?
Velocity measures the gap between what the business asks IT for and when it arrives. Long lead times, manual deployment processes and uncontrolled change compress your ability to respond to market conditions and add cost to initiatives that touch technology.
Resilience
What happens when something fails?
Resilience covers backup integrity, recovery time objectives, disaster-recovery test records and single points of failure. Do you know that your backups work? The Sovereignty Index® tests that assumption, and the gap between assumed and actual recovery capability is where the largest debt figures tend to emerge.
Security
What is your exposure, right now?
Security assesses patch currency, endpoint coverage, perimeter configuration and security event visibility. It is a structural assessment of whether your posture is coherent and whether your executive team is receiving an accurate picture of risk, and it is not a penetration test.
Cognitive
Does your IT team know everything they need to know?
Cognitive measures documentation quality, knowledge concentration, and institutional dependency. When key knowledge sits in one person's head, or has left the business, your estate becomes fragile in ways other pillars may not show. That debt grows each time staff change.
A written report within four weeks. No slide decks.
The Sovereignty Index® follows three stages from the opening session to a decision-ready document. The process is structured, with a defined end.
Briefing and scoping
A structured call with the people who know your estate, typically IT leadership and one member of the senior team. We establish scope and agree access to documentation.
Estate review
We work through a structured review of your configuration and documentation across all five pillars. This is desktop-led, with no agents or scanning tools and no access to live systems. You control what we see.
Modelling and output
We translate findings into scored positions across each pillar and calculate your Technical Debt Burden in pounds. The output is a written document structured for your executive team. It states your position, your debt figure and a prioritised set of findings with recommended actions.
Our delivery commitment
We commit to delivering the written report within four weeks of the opening session, once we have the access we need from you. If we miss that date, the fee reduces by 10% for each week the report is late, up to 50% of the fee.
Who this is for.
Directors who suspect the picture is incomplete
If your IT reporting tells you everything is fine but incidents keep happening, the Sovereignty Index® produces an independent view that doesn't go through whoever manages your estate.
Finance directors facing a renewal or migration decision
Before committing to a new vendor contract or a cloud migration programme, it is worth knowing what you actually have. The Index gives you a baseline that makes any subsequent investment decision defensible.
Businesses after a period of rapid growth
Fast growth often means IT inherited by acquisition, headcount or circumstance, and not designed. The debt that accumulates during growth tends to surface as risk or cost at a bad moment.
Leadership teams preparing for a transaction
Technical debt can come under scrutiny in M&A due diligence. An independent assessment before a process starts gives you a cleaner data room and can avoid findings that reduce valuation or delay close.
The cost of inaction compounds
Annual IT risk exposure — unmanaged estate vs post-Sovereignty Index
Illustrative mid-market cost model (50–249 employees). Does not represent any specific organisation. Sources: Ponemon Institute / IBM Security.
The diagnostic is a fixed fee of £3,500, agreed in writing before work begins. If the findings do not justify the next step, you stop here, better informed, with a document your executive team can hold.
The Sovereignty Index® is built on 50 discovery questions — ten for each of five pillars — mapped against recognised standards: Cyber Essentials Plus and ISO 27001 for Identity and Security, the NIST Cybersecurity Framework for Resilience, DORA (DevOps Research and Assessment) metrics for Velocity, and the Microsoft AI Adoption Framework for Cognitive Readiness. Each pillar is scored out of 100, giving your executive team a position it can compare and track. Mapped means our questions follow those frameworks. It does not mean the report certifies you against them.
Ready to see the number?
The first call is a conversation. If the Sovereignty Index® is the right next step, we will confirm what it involves and what you will have at the end of it. You decide.