The decision
Is the operating environment ready to control an AI-assisted workflow?
Readiness is not the same as enthusiasm, budget, or product availability. This assessment focuses on whether the organization can define acceptable use, protect data, integrate systems, train operators, and learn from incidents.
Six current-state operating selections.
A score, gap interpretation, and copyable action memo.
The program leader accountable for policy, controls, and pilot approval.
Evidence to prepare
Answer from records, not impressions.
- Mission: service hours, critical decisions, response targets, and consequences of failure.
- Policy: approved uses, prohibited uses, review owners, and change control.
- Data: classification, access, retention, deletion, and audit evidence.
- Integration: system inventory, interfaces, identity, telemetry, and degraded modes.
- People: training records, coaching plans, and escalation competence.
- Incidents: SOPs, drills, after-action records, and corrective-action closure.
Working tool
Score the current operating posture
Select the statement that best matches evidence available today, not the intended future state.
This score is a physicalsecurity.AI planning heuristic, not a NIST certification, compliance determination, or site risk assessment. Review the method and limitations.
Interpretation
Use the weakest factor to shape pilot scope.
A composite score can hide one decisive weakness. Review the factor-level guidance before discussing a launch date.
Limit work to synthetic data and policy drafting until approved uses and owners exist.
Do not introduce operational records until access, retention, and deletion are controlled.
Pilot an isolated workflow with manual handoff and measurable degraded operation.
Train reviewers to detect unsupported claims, automation bias, and missing evidence.
Standardize the human process before adding an AI dependency.
Require stronger testing, fallback, monitoring, and named approval authority.
Method and limits
A conversation structure, not a maturity certification.
The browser-local heuristic combines six ordinal selections. It is designed to expose discussion gaps and produce actions, not to certify conformance with NIST, ISO, law, contract, or an insurer's requirements.
Validate every action with legal, privacy, IT, HR, labor, records, and operational stakeholders appropriate to the workflow.
Review the NIST AI Risk Management Framework