Seven layers hold your business up. Most organisations have never drawn them.

Every organisation runs the same seven layers, whether or not anyone has written them down. When nobody has, work gets planned at whichever layer is complaining loudest — which is almost never the layer where the problem actually lives.

This is a single page you can print at A3, stick on a wall, and fill in with a pen in about ten minutes. It will tell you where your next piece of work belongs.

The seven layers

Identity & Access — accounts, sign-on, multi-factor, permissions, joiners and leavers
Devices & Endpoints — laptops, mobiles, patching, endpoint protection, enrolment and disposal
Network & Connectivity — connectivity and failover, firewalls, remote access, DNS and domains
Infrastructure & Hosting — servers, containers, hosting, databases, storage, backup and recovery
Data & Integration — systems of record, data exchange, reporting, retention
Applications & Productivity — line-of-business apps, email, documents, finance, customer records
Observability & Security Operations — monitoring, error tracking, logs, alerting and on-call

What the map gives you

What actually sits at each layer, in plain language, so nothing gets missed because it had an unfamiliar name
A “what good looks like” line per layer — a single concrete test, not a maturity essay. For backup: you know the date of the last successful restore.
A three-way tick box per layer — Absent, Basic, Solid — so the whole assessment takes minutes
A bottom-up reading rule that tells you which layer to work on next, and why top-down sequencing gets redone

It names no products on purpose. The right tool at each layer depends on your size, sector and obligations, and a map that named vendors would be a sales sheet rather than a reference.

Get the map

Prefer to skip the form? Download the map directly (PDF).

General business guidance only. This map is a planning aid, not professional, legal, security or regulatory advice, and it does not assess compliance with any standard or framework. Organisations handling personal data, payment data, regulated records or safety-critical operations carry obligations this map does not evaluate — take qualified advice on your own circumstances.