Methodology
How the assessment was built
Every question had to pass one test: would it still matter to an executive in three years, after today's tools, vendors, and headlines have changed?
The assessment is grounded in operating experience and informed by public standards, research, and current technology-management practice. The sources below are selected anchors for the questions, not a claim that Mickom assesses against those frameworks.
What the research does and does not mean
Informed by external work, not certified against it
The sources help test whether the assessment is asking durable, decision-relevant questions. They do not independently verify a respondent's answers or change the self-reported nature of the result.
- No alignment or conformance is claimed. The assessment does not map to, measure against, or certify compliance with any framework listed here.
- No endorsement is implied. None of these organizations has reviewed, approved, or is associated with Mickom or this assessment.
- The result remains directional. External research informs the questions. It does not turn the result into an audit, benchmark, or assurance opinion.
Reading by domain
Selected sources that informed the questions
Business & Technology Alignment
FinOps Foundation. FinOps Framework 2026: Executive Strategy, Technology Categories, and Converging Disciplines (opens in a new tab). Published March 19, 2026.
Supports questions connecting technology investment to business priorities, portfolio tradeoffs, and decision support.
Deloitte. From Operators to Orchestrators: Deloitte's 2026 Global Technology Leadership Study Reveals a New Mandate for Tech Leaders (opens in a new tab). Published April 30, 2026.
Supports the emphasis on business outcomes, cross-functional decisions, and executive visibility rather than technology activity alone.
Project Management Institute. Why Complex Projects Fail: Best Practices Are Not Enough, System Thinking Gives Your Team the Edge (opens in a new tab). Published May 12, 2026.
Supports questions about intended outcomes, dependencies, and adjustment as operating conditions change.
Technology Environment & Modernization
FinOps Foundation. FinOps Framework 2026: Executive Strategy, Technology Categories, and Converging Disciplines (opens in a new tab). Published March 19, 2026.
Supports deliberate workload placement, lifecycle economics, and technology value across cloud, SaaS, data center, data platforms, and AI.
U.S. Government Accountability Office. Information Technology: Agencies Need to Plan for Modernizing Critical Decades-Old Legacy Systems (opens in a new tab). Published July 17, 2025.
Reinforces questions about aging critical systems, modernization planning, business consequence, and realistic execution. The federal findings are used as a modernization-risk signal, not an enterprise benchmark.
Google Cloud DORA. 2025 DORA Report: State of AI-Assisted Software Development (opens in a new tab). Published September 23, 2025.
Supports the importance of platform quality, workflow clarity, team alignment, and loosely coupled architecture when organizations modernize and adopt AI.
National Institute of Standards and Technology. Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems, SP 800-18 Rev. 2 (opens in a new tab). Published June 30, 2026.
Supports visibility into system purpose, roles, interconnections, privacy, and supply-chain dependencies.
AI & Intelligent Automation
National Institute of Standards and Technology. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile, NIST AI 600-1 (opens in a new tab). Published July 26, 2024; NIST page updated April 8, 2026.
Supports lifecycle risk management, measurement and evaluation, governance, human oversight, and data-readiness questions.
National Institute of Standards and Technology. Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations (opens in a new tab). Published March 24, 2025.
Supports consideration of manipulated inputs, misuse, and adversarial behavior within AI risk review.
European Commission. Commission starts enforcing AI Act rules and new transparency requirements on 2 August (opens in a new tab). Published July 31, 2026.
Reinforces accountable ownership, risk-based review, transparency, and practical governance for organizations subject to applicable requirements.
OWASP GenAI Security Project. OWASP GenAI LLM Top 10 2026 (opens in a new tab). Published August 3, 2026.
Provides a current practitioner signal on prompt injection and other AI-specific security risks without turning the assessment into a technical control checklist.
Google Cloud DORA. 2025 DORA Report: State of AI-Assisted Software Development (opens in a new tab). Published September 23, 2025.
Supports the focus on workflow clarity, operating conditions, platform readiness, safety nets, and adoption rather than AI-tool deployment alone.
Cybersecurity & Resilience
National Institute of Standards and Technology. NIST Releases Version 2.0 of Landmark Cybersecurity Framework (opens in a new tab). Published February 26, 2024; NIST page updated February 19, 2025.
Supports treating cybersecurity as enterprise risk, with explicit governance and supply-chain attention.
Verizon Business. Vulnerability exploitation top breach entry point, 2026 industry-wide DBIR finds (opens in a new tab). Published May 19, 2026.
Supports executive visibility into vulnerability exposure, third-party dependency, and resilience as the threat environment changes.
National Institute of Standards and Technology. Developing Security, Privacy, and Cybersecurity Supply Chain Risk Management Plans for Systems, SP 800-18 Rev. 2 (opens in a new tab). Published June 30, 2026.
Supports clear roles, system interconnections, data and privacy considerations, and cybersecurity supply-chain responsibilities.
IT Operations & Operating Model
Deloitte. From Operators to Orchestrators: Deloitte's 2026 Global Technology Leadership Study Reveals a New Mandate for Tech Leaders (opens in a new tab). Published April 30, 2026.
Supports explicit attention to operating-model fitness, distributed accountability, cross-functional orchestration, and AI-driven change.
Google Cloud DORA. 2025 DORA Report: State of AI-Assisted Software Development (opens in a new tab). Published September 23, 2025.
Supports questions about platform quality, workflows, service and change discipline, and the operating conditions that shape technology performance.
World Economic Forum. The Future of Jobs Report 2025 (opens in a new tab). Published January 7, 2025.
Supports the emphasis on skill shifts, AI, data and cyber capability, reskilling, and workforce planning.
Project Management Institute. Why Complex Projects Fail: Best Practices Are Not Enough, System Thinking Gives Your Team the Edge (opens in a new tab). Published May 12, 2026.
Supports end-to-end ownership, dependency management, and change capacity rather than process compliance alone.
Governance, Investment & Execution
FinOps Foundation. FinOps Framework 2026: Executive Strategy, Technology Categories, and Converging Disciplines (opens in a new tab). Published March 19, 2026.
Supports portfolio tradeoffs, executive strategy alignment, lifecycle cost, decision support, and business-value accountability.
Project Management Institute. Why Complex Projects Fail: Best Practices Are Not Enough, System Thinking Gives Your Team the Edge (opens in a new tab). Published May 12, 2026.
Supports separating project completion from intended business benefit and explicitly testing dependencies, capacity, and outcome realization.
Deloitte. From Operators to Orchestrators: Deloitte's 2026 Global Technology Leadership Study Reveals a New Mandate for Tech Leaders (opens in a new tab). Published April 30, 2026.
Supports governance that coordinates distributed technology decisions and stays focused on business outcomes rather than administrative control.
Keeping this honest
Sources age, and so does this page
Every entry carries its publication date so the reader can judge how current it is. The research behind an assessment version is fixed when that version is published.
Research is reviewed when an assessment version changes, not continuously. A new development earns a change when it exposes a durable executive capability gap, not simply because it is new.