Managed Security Services: CISO Does Not Bear Sole Liability
Benedikt Langer
8 min. read In many organisations, the CISO is seen as the person who stands accountable for security. ...
Read Article
7 Min. Reading Time
The MDPI Smart City Maturity Study 2026 examined 1.136 German municipalities. The central finding: Strategic planning for smart city concepts is significantly more advanced in German cities than the digital infrastructure needed to implement them. For CIOs in companies, this isn’t just a municipal problem – it’s a mirror of a structural capability gap that emerges in organizations of all sizes when strategy outpaces operations.
Key Takeaways
- Strategy before Infrastructure. 74% of the municipalities examined have adopted smart city strategies, but only 31% have the data infrastructure to implement them. Companies show the same pattern with AI programs.
- The Capability Gap has a name. When Strategic Readiness exceeds Operational Maturity by more than two maturity levels, the probability of program stagnation increases by a factor of 3.2.
- CIO Task: Synchronize, don’t accelerate. The solution isn’t faster strategy – but conscious infrastructure prioritization in investment planning before the next strategy document is approved.
- Three Diagnostic Questions. Where does the organization stand on the Capability Map? Which infrastructure gaps specifically prevent strategy execution? Which investment cycles realistically close the gap by when?
Related: NVIDIA Agent Toolkit: What CIOs need to consider when making AI vendor decisions
What is the Smart-City-Capability-Gap and why is it relevant for CIOs?
What is a Capability Gap? A Capability Gap describes the gap between strategic ambition and operational implementation capability. When an organization formulates digital goals without ensuring that the infrastructure and process maturity exist to execute them, this gap arises. In the corporate context, it is the most common cause of AI program stagnation: projects stop halfway because IT investments cannot deliver measurable business results.
The MDPI study has made the Capability Gap quantifiable. It evaluates 1,136 German municipalities on a 5-stage scale in two dimensions: Strategic Readiness (existing concepts, decisions, budget commitments) and Operational Maturity (actually existing digital infrastructure, data platforms, connectivity). The result: The average Strategic Readiness is 3.1 out of 5, while Operational Maturity is only 1.8. The gap averages 1.3 stages.
For CIOs in companies, this is insightful because the same effect is measurable there: McKinsey and BCG showed in separate DACH studies in 2025 that 68% of large German companies have adopted AI strategies, but only 22% have the data pipelines to operate them productively.
Capability Gap: Municipalities vs. Companies (2026)
74%
German municipalities with Smart-City strategy (MDPI 2026)
31%
of which with sufficient data infrastructure for implementation
3.2x
higher program stagnation risk with gap over 2 maturity levels
The structural parallels between municipalities and companies
Municipalities and companies operate in fundamentally different political and economic contexts – but the mechanism behind the Capability Gap is identical. Both systems produce strategy documents under legitimacy pressure (city councils, supervisory boards, investors) without sufficient verification of feasibility.
In municipalities, this pressure arises from federal and EU funding programs: Those who want to apply for funding for Smart-City projects need a strategy. Thus, strategies emerge, often without infrastructure budget in the same resolution. In companies, the analogous pressure is the expectation of investors and supervisory boards for AI and digitalization roadmaps – often communicated as part of earnings calls and annual reports before the technical prerequisites are secured.
The solution is the same in both contexts: Capability Mapping before Strategy Publishing. Those who first conduct an honest assessment and then write the strategy produce documents that are executable.
Timeline: Typical Capability Gap Pattern in DACH Companies
Q1
Strategy Approval
Executive board approves AI/digital roadmap. Budget often not yet finalized. Infrastructure assessment missing. External consulting firm has delivered feasibility study.
Q2
First Implementation Attempts
Pilot projects start. Data access missing or qualitatively inadequate. Integration between legacy systems costs significantly more than planned. Mood shifts.
Q3
Stagnation and Re-Prioritization
Pilots are paused or declared as “Phase 2”. IT budget is redirected to infrastructure basics. Strategy goal remains on paper, execution shifts by 12-18 months.
Q4
Infrastructure Investment or Strategy Adjustment
Either: targeted infrastructure investment closes the gap (long-term successful). Or: strategy is scaled back to what the current infrastructure can deliver (short-term pragmatic, long-term risky).
What CIOs Can Conclude
The capability gap is not an inevitable fate. It is avoidable if three questions are answered before the next strategy round:
Strategies That Create Capability Gaps
- Strategy approved before infrastructure assessment
- Technical debt not quantified
- No capability mapping in strategy process
- Investment planning and IT roadmap decoupled
Strategies with Executable Infrastructure
- Capability Map as template for strategy development
- Infrastructure budget secured in the same decision
- Maturity model for data pipelines and system integration
- Quarterly Capability Review synchronized with Strategy Review
Frequently Asked Questions
How do I concretely measure the Capability Gap in my organization?
A pragmatic approach: Compare your organization’s strategic AI and digitalization goals for the next 24 months with existing data sources, integration pipelines, and engineering capacities. Where are data, systems, or expertise missing? That delta is your Capability Gap. For a more structured assessment, frameworks like the Gartner IT Score or the MIT CISR Data Capability Model provide methodological foundations.
Is the Capability Gap less relevant in smaller companies?
No – it’s often more pronounced in small and medium-sized enterprises. Larger corporations have governance structures that enforce infrastructure assessments. Mid-sized companies often decide on digital initiatives more quickly without a formal capability check. The MDPI study shows the same pattern in municipalities: Small towns with less administrative capacity show larger gaps than well-equipped major cities.
How long does it typically take to close a Capability Gap?
Experience values from DACH transformation projects: Data infrastructure upgrades (new data platform, data quality engineering) take 12-18 months to reach production readiness. System integration projects (legacy connection, API layer) take 18-24 months. Skill-building in data engineering takes 12-24 months. Those who start closing the gap today can realistically execute the original 2025 strategy goals in 2027/2028.
Which metric provides the best indication of a growing Capability Gap?
The simplest early warning: the percentage of IT projects that, after approval, are postponed to “Phase 2” or “next year”. If this percentage exceeds 40%, a systematic Capability Gap is likely. Another indicator: when technical debt is regularly mentioned as a blocker for strategic initiatives in quarterly meetings, without a separate budget being allocated for it.
How do I explain the Capability Gap concept to the executive board?
The most effective approach is to compare it with physical infrastructure: “We have the strategy for the highway, but not yet a four-lane federal road. Before we build the highway, we must complete the federal road.” Alternatively, a direct comparison with the municipal Smart City gap works well: External study data neutralizes the message and removes its accusatory character toward previous IT planning.
Network
Tobias Massow is CEO of Evernine Media GmbH and publisher of Digital Chiefs, cloudmagazin.com, MyBusinessFuture and SecurityToday. He writes about corporate digitalization, IT strategy, and the economic implications of AI in DACH companies.
Source cover image: Pexels / Michael Pointner (px:18306898)