Most organisations know their data protection isn't where it needs to be. Sensitive data sits in systems nobody fully understands. Vulnerability patching is reactive. Threat detection relies on hope as much as technology. Access to critical data is broader than anyone intended. And the compliance evidence that satisfies auditors this year may not survive the regulatory convergence of 2026–27 – GDPR enforcement escalation, DORA, the EU AI Act, and SAP ECC end-of-support arriving simultaneously.

The free DPS self-assessment tells you where you stand. The C6 Expert Diagnostic tells you why – and exactly what to do about it.

• Evidence-Based Maturity Scoring – Quantified maturity levels across each DPS process area, benchmarked against industry peers. Not a traffic-light summary – a weighted, defensible score you can present to stakeholders.

• Root-Cause Analysis – Why your data protection posture looks the way it does. The patterns behind the scores – whether that's technology under-exploitation, process gaps, or misaligned ownership.

• Prioritised Improvement Roadmap – Sequenced, actionable recommendations that account for dependencies, regulatory deadlines, and your organisation's capacity for change.

• Investment Case for Stakeholders – A board-ready narrative that connects data protection maturity to business risk, regulatory exposure, and value protection.

• Expert Review Call – A 60–90 minute one-to-one session to walk through every finding, answer your questions, and discuss strategic next steps.

• Branded Strategic Report – A polished, professional document you can share with your leadership team, audit committee, or board.

The diagnostic covers six core processes that define your organisation's data protection and security maturity:

• Classify & Protect Data – How your organisation discovers, classifies, encrypts, and governs sensitive data across ERP and enterprise systems.

• Discover & Remediate Vulnerabilities – Your capability to identify and fix vulnerabilities across ERP application layers, infrastructure, and custom code.

• Detect & Respond to Threats – The maturity of your threat detection, incident response, and forensic capability.

• Control & Segregate Access to Sensitive Data – How effectively you restrict access to sensitive data through identity controls and data-tier governance. For a full treatment of business-process access governance, see the AAG diagnostic.

• Secure & Govern Changes – Security embedded into your development, transport management, and data-in-transit protection.

• Measure & Assure Compliance – Your regulatory compliance posture, audit readiness, and continuous governance across the ERP estate.

Process Diagnostic – £1,500 + VAT Focus on one process area of your choice. 12–16 page branded report. 60-minute expert review call. Delivered within 5 working days.

Domain Diagnostic – Full DPS – £7,500 + VAT All six DPS process areas with cross-process analysis. 35–45 page branded report with integrated risk heat map and strategic roadmap. 90-minute expert review call with stakeholder-ready summary slides. Delivered within 10 working days.

Upgrade path: Start with a single process at £1,500. If you choose to upgrade to the full DPS domain diagnostic within 90 days, your £1,500 is credited in full – you pay only the £6,000 difference.

Why now? Three regulatory forces converge in 2026–27. GDPR enforcement is escalating. DORA demands demonstrable control over ICT risk. And SAP's ECC end-of-support deadline means every migration to S/4HANA is a data protection event. Organisations that understand their DPS maturity now can act strategically. Those that wait will act reactively, at greater cost and greater risk.

• Data Protection Officers and Privacy Leads responsible for demonstrating GDPR, DORA, or sector-specific compliance across SAP systems that hold sensitive personal and financial data.
• SAP Security leads and Basis teams who know their security hardening, patching, and access to sensitive data aren't where they need to be – but can't articulate the full picture to stakeholders.
• Heads of IT and CISOs preparing for the regulatory convergence of 2026–27 – GDPR enforcement escalation, DORA, the EU AI Act, and SAP ECC end-of-support arriving simultaneously.
• Organisations midway through S/4HANA migrations who need to ensure data protection controls, encryption, and security architecture are designed into the new platform – not retrofitted.
• Internal Audit and Compliance teams seeking independent assurance that data protection and security controls are operating effectively, not just documented in a policy nobody reads.
• Regulated industries – financial services, healthcare, government, defence – where data breaches carry reputational, financial, and regulatory consequences that far exceed the cost of prevention.

What's the difference between the free DPS self-assessment and the C6 Expert Diagnostic?

The free assessment gives you a high-level maturity score across the six DPS process areas. The Expert Diagnostic goes deeper – with detailed questionnaires, AI-assisted analysis enriched by expert interpretation, industry benchmarking, a prioritised improvement roadmap, and a one-to-one review call with Gerald West.

Can I start with one process area and upgrade later? 

Yes. If you purchase a Process Diagnostic at £1,500 and decide to upgrade to the full DPS Domain Diagnostic within 90 days, your £1,500 is credited in full. You pay only the £6,000 difference.

How does this relate to the AAG diagnostic?

AAG focuses on business-process access governance – who can do what in your systems. DPS focuses on data protection and security – how sensitive data is classified, protected, monitored, and governed. Some organisations need both; the "Control & Segregate Access" process area in DPS examines the data-centric dimension of access control, while AAG covers the full business-process view.

Is this suitable for organisations currently migrating to S/4HANA?

Particularly so. The diagnostic assesses your current-state data protection and security maturity and identifies specific risks and opportunities relevant to your migration. Many clients use the findings to shape their S/4HANA security architecture, encryption strategy, and data migration controls before go-live.

Can my organisation pay by invoice or purchase order?

Yes. For organisations that require a purchase order or prefer to pay by invoice rather than card payment, please email assessments@carokahn.com with your requirements. We will issue a formal quotation and can accommodate payment by bank transfer on standard net-30 terms. VAT-registered organisations will receive a proper VAT invoice.

Will I receive a VAT invoice?

Yes. All purchases include a VAT receipt. For card payments through the store, Payhip (as merchant of record) issues the VAT receipt automatically. For invoice payments arranged directly with CaroKahn, we issue a VAT invoice via QuickBooks.

What if I am not satisfied?

If the diagnostic does not meet your expectations, email assessments@carokahn.com within 7 days of receiving your report. We will discuss your concerns and offer a partial or full refund on a case-by-case basis.

Can I get a diagnostic for other domains (AAG, CCM, AIRC)?

Yes. The C6 Expert Diagnostic is available across all four C6 Maturity Model domains: AAG, CCM, DPS, and AIRC. Visit the Get Expert Guidance collection to explore all available diagnostics.