Two minutes, no form

Where does your practice actually stand on AI?

Eight questions, taken from the assessment our technicians work through. They are the ones that separate a real answer from a confident guess, which is usually where the surprises are.

There is no email field and no sign-up. Your answers stay in this browser tab and are not stored, sent, or counted anywhere.

Is there a written inventory of everywhere sensitive records live?

01/Data inventory

Current means somebody reviewed it in the last twelve months and can produce it now. If it takes more than five minutes to find, treat it as stale.

How does the organization know which AI tools are in use?

02/Shadow AI discovery

This question separates a real inventory from a guess. Only a log or console review counts as verified.

How many of the AI tools in use are covered by a signed BAA or data processing agreement?

03/Vendor agreements

Covered means executed and on file, not offered.

Is prompt data excluded from vendor model training?

04/Tenant configuration

Verified means you saw the setting in the console on the plan you pay for. A marketing claim on the pricing page is not verification.

Is multi-factor authentication enforced everywhere sensitive records can be reached?

05/Identity and access

Enforced means the tenant blocks a sign-in without it. Available but optional is partial. Count the AI tools, not only email.

Is there a written acceptable use policy for AI tools?

06/Written policy

Tailored means it names your systems and the data you hold. A downloaded template with the name typed in is a template.

Is there an incident response plan?

07/Incident path

Exercised means somebody walked through it, even at a table. A document nobody has opened is documented but untested.

How often is any of the above reviewed?

08/Evidence and review cadence

Scheduled means it is on a calendar with an owner. Ad hoc means it happens when something prompts it, which is the same as not scheduled.

0 of 8 answered