A capability and maturity model for public institutions
The Public Trust Model for Digital
Forty capabilities across four pillars, scored by your own leadership team, to set your organization's path to digital maturity.
The measure of success is not a score. It is whether the public can rely on what you deliver.
| Pillar | Score | Gap |
|---|---|---|
| 1 — Information Practice | 2.4 | 1.6Below |
| 2 — Service Modernization | 2.2 | 1.8Below |
| 3 — Digital Office | 2.4 | 1.6Below |
| 4 — Digital Platform | 2.1 | 1.9Below |
Overall 2.28 of 5. 1 of 40 capabilities sit at target.
01 — The idea
A maturity model is a shared vocabulary for an argument you are already having
Every leadership team already disagrees about how good its digital practice is. The disagreement is usually unproductive, because nobody has agreed what "good" would look like.
A capability and maturity model fixes the vocabulary. It names a finite set of capabilities, describes five recognizable levels of practice for each one, and asks everyone to place the organization on the same scale. What it produces is less a score than a map of where the executive agrees, where it does not, and where it does not know.
What it is not
It is not an audit — nobody verifies your answers. It is not a benchmark against other cities, and it does not produce a league table. It is not a technology assessment; almost every question is about ownership, evidence and process rather than about products. Nothing is awarded, but you might end up with a plan forward.
02 — The structure
40 capabilities across four pillars
The pillars have held up across decades of use with public-sector teams, because they map onto how a public institution actually divides the work rather than onto how a vendor divides its product line.
1 Information Practice
10 capabilities
2 Service Modernization
9 capabilities
3 Digital Office
10 capabilities
4 Digital Platform
11 capabilities
The same sample organization, broken out to every capability:
| Capability | Gap |
|---|---|
| 1.1 — Content Practice | 1Approaching |
| 1.2 — Content Standards | 2Below |
| 1.3 — Channel Strategies | 1Approaching |
| 1.4 — Lifecycle and Asset Management | 2Below |
| 1.5 — Open Data | 1Approaching |
| 1.6 — Data Governance and Classification | 2Below |
| 1.7 — Privacy | 1Approaching |
| 1.8 — Brand and Message | 0At target |
| 1.9 — Data Quality and Documentation | 3Well below |
| 1.10 — Equity in Data Practice | 3Well below |
| Capability | Gap |
|---|---|
| 2.1 — Design Operations | 1Approaching |
| 2.2 — User Research | 1Approaching |
| 2.3 — Service Standards | 2Below |
| 2.4 — Forms Standardization | 1Approaching |
| 2.5 — Service Methodology | 2Below |
| 2.6 — Analytics and Decision Support | 2Below |
| 2.7 — Prototyping Practice | 2Below |
| 2.8 — Performance Management | 2Below |
| 2.9 — Programme Evaluation | 3Well below |
| Capability | Gap |
|---|---|
| 3.1 — User Experience Lab | 1Approaching |
| 3.2 — Service Catalogue | 2Below |
| 3.3 — Digital Team | 1Approaching |
| 3.4 — Policy Lab | 1Approaching |
| 3.5 — Feedback and Listening | 1Approaching |
| 3.6 — Decision-making Model | 2Below |
| 3.7 — Capability and Literacy Model | 2Below |
| 3.8 — Knowledge Base | 2Below |
| 3.9 — Procurement and Vendor Risk | 1Approaching |
| 3.10 — AI Governance and Assurance | 3Well below |
| Capability | Gap |
|---|---|
| 4.1 — DevSecOps and Change Management | 1Approaching |
| 4.2 — Identity and Access Management | 2Below |
| 4.3 — Payments and Notifications | 2Below |
| 4.4 — Security Governance and Risk | 2Below |
| 4.5 — Content Management System | 1Approaching |
| 4.6 — Data Architecture | 2Below |
| 4.7 — Enterprise Search | 1Approaching |
| 4.8 — AI and Automated Decision Platform | 3Well below |
| 4.9 — Process Automation | 2Below |
| 4.10 — Threat Defence and Resilience | 2Below |
| 4.11 — Third-Party and Cloud Assurance | 3Well below |
03 — The scale
The target is level 4, and that is the whole argument
Most maturity models imply that every organization should be reaching for level five everywhere. For a municipality with no dedicated security staff and no data scientist, that is not ambition — it is a reason to stop reading.
This model publishes its target line at level 4, and defines it as practice a resource-constrained public body can actually reach — usually by buying, sharing or joining rather than by building. Level 5 is leading practice, and most institutions should not be trying to reach it in most areas.
| Level | How the organization describes itself | What it means in practice |
|---|---|---|
| 1 | We are eager to learn to ride | Absent, or handled reactively when something goes wrong |
| 2 | We are riding with training wheels | Exists in pockets; informal, undocumented, dependent on particular individuals |
| 3 | We are riding solo, but with caution | Documented and real, but applied inconsistently and not measured |
| 4 | We are a strong, confident rider | The target. Owned, documented, applied consistently, evidenced. The target line. |
| 5 | We are an elite rider and constantly improving | Leading practice. Measured, published, independently verified, revised on evidence. |
Levels are cumulative: claiming 4 asserts that 1 through 3 are also true. Every one of the 200 level descriptions is written in the first person, so the respondent is always asserting something about their own organization rather than agreeing with a description of the world.
04 — The profile
Obligation is not the same thing as size
A provincial liquor distribution branch employs a few hundred people and runs its entire mandate through software — e-commerce, wholesale logistics, point of sale, licensee management, payments at scale. A city of the same population employs twice as many people and delivers its mandate through crews, vehicles and pipes, with software as the front door.
Headcount says the city is bigger. Every meaningful measure of what the public is owed says the liquor branch has the larger digital obligation. So headcount appears nowhere in the profile that sets the weighting.
Instead, seven factors — transaction volume, data sensitivity, service criticality, reach, automated-decisioning exposure, regulatory exposure and digital intensity — produce an obligation band that weights each capability for that specific institution.
Provincial liquor distribution branch
- Digital Obligation Index
- Large
- Delivery Capacity Index
- Medium
- Exposure Gap
- +1 stretched
- Capabilities per year
- 5
Where to start — ranked by gap × weight:
- 1.10Equity in Data Practice weight 1.50
- 2.9Programme Evaluation weight 1.38
- 1.9Data Quality and Documentation weight 1.12
- 3.10AI Governance and Assurance weight 1.12
- 4.8AI and Automated Decision Platform weight 1.12
City of 100,000
- Digital Obligation Index
- Medium
- Delivery Capacity Index
- Medium
- Exposure Gap
- +0 matched
- Capabilities per year
- 5
Where to start — ranked by gap × weight:
- 1.9Data Quality and Documentation weight 1.12
- 2.9Programme Evaluation weight 1.12
- 4.11Third-Party and Cloud Assurance weight 1.12
- 4.4Security Governance and Risk weight 1.62
- 1.10Equity in Data Practice weight 1.00
Both lists come from identical capability scores. Only the institution changed.
05 — What it measures that others do not
Three findings worth more than the score
Literacy
Every question can be answered "I don't know," and the proportion of those answers is reported as a finding in its own right. A leadership team that cannot answer a third of the questions about its own organization has a governance problem independent of its maturity.
Dispersion
When the whole executive responds, averaging destroys the most valuable signal in the data. A CIO at 4 and a Department Manager at 2 average to a 3 that describes nobody's view. The spread is reported alongside the score, and the widest disagreements are named.
Exposure Gap
Obligation band minus capacity band. An institution whose obligations materially exceed its capacity to meet them is not failing at delivery — it is under-resourced for what it has been asked to do, and that is a conversation for the council or board rather than the team.
06 — This edition
Three areas rebuilt for what public institutions now answer for
Data, performance and evidence
Modelled on practice built by category leaders: governance as a review gate rather than a document, a published data quality standard, documentation that states a dataset's limitations, equity as a measurable practice rather than a value, and programme evaluation as a discipline distinct from dashboards.
The largest single gap in the previous edition was that it measured whether capabilities existed and never whether services worked — not one question asked whether a programme had achieved what it was funded to achieve.
Automated decision-making and AI
Governance sits in the Digital Office, not the Platform, because the failure mode in public-sector AI is not technical — it is an unappealable decision that nobody in the organization can explain or override. Risk-tiered impact assessment, human review and a route to contest, disclosure to the public, a registry of systems in use, and contract terms with hyperscalers and model vendors covering training prohibitions, residency and exit.
Security proportionate to scale
A public institution almost never needs a SOC 2 report of its own. It uses SOC 2 twice over: as an internal control framework, and as a procurement instrument — demanding Type II evidence from the vendors holding residents' data, and actually reading it. Public institutions need security ladders they can actually climb.
07 — How it runs
15 minutes to a scorecard
The Baseline Assessment asks one question per capability — 40 in total, roughly 15 minutes. Each question presents the 5 level descriptions and asks which one describes the organization today.
The Digital Deep Dive opens the full bank of 315 items for any capability worth examining closely, taken by persons accountable for it rather than by the whole executive.
The Public Trust Maturity Scorecard returns the heat map, the gap to target, the literacy and dispersion findings, and a priority sequence cut to what your capacity can absorb in a year. It exports in two forms: a full internal report, and a shareable summary safe to put in front of a council.
The whole thing is self-administered. Nothing is verified by anyone, which is precisely why the evidence question at the end of each deep dive asks whether a claim is asserted, documented, published or independently verified. Read what happens to your data on the privacy page before you begin — it should factor into your decision to proceed.
Digital maturity is not the goal. It is the precondition for a public that can rely on what you deliver — and trust, once spent, is expensive to rebuild.
40 capabilities, 200 level descriptions, 315 deep-dive items. Developed over decades of practice with municipal, provincial and crown-corporation leadership teams.