Know where you stand.
Know what to do next.
24 questions across six domains. A scored readiness tier. A client service launch verdict. Completed in under 30 minutes by your MSP team, for your own business, or on behalf of a client.
One assessment instrument. Two different purposes.
MSP Self-Assessment
availableCompleted by: MSP technical lead, operations lead, or vCISO
About: The MSP's own internal AI governance posture
Time: Under 30 minutes
Answers the question: are we ready to credibly sell AI governance to our clients? This is the prerequisite step in the CyberSentriq commercial motion: you must establish your own posture before you can package it as a service.
Client Assessment
coming soonCompleted by: The MSP (on behalf of their client)
About: The client's AI governance posture
Time: 30–45 minutes
Completed by the MSP for each client as part of onboarding, service expansion, or QBR preparation. Each completed client assessment is a billable deliverable and the foundation for a recurring governance service conversation.
In development with partner MSPs. The MSP self-assessment is the prerequisite first step.
What the assessment covers
Each domain contains four questions scored 0–3. The overall score is a weighted mean. Domain weights reflect where credibility is most important.
AI Strategy and Governance Foundation 15% weight
AI usage policy existence and currency, named governance ownership, staff AI awareness training, and AI incident register.
Approved AI Tool Management 20% weight
Approved tool list with data-handling constraints, shadow AI visibility, lifecycle controls at joiner/leaver events.
Exception and Waiver Workflow 15% weight
Exception request process, exception register with expiry management, Microsoft stack governance boundary, and client-facing exception evidence.
M365 and Copilot Readiness 20% weight
SharePoint and OneDrive permission audit, sensitivity label deployment and coverage, guest and external sharing controls, and a scored Copilot readiness assessment.
Data Classification and Prompt Hygiene 10% weight
Data classification scheme enforced by tooling, staff prompt hygiene guidance by data category, agentic AI scope controls.
Compliance Framework Readiness 20% weight
ISO 27001 or equivalent foundation, ISO 42001 alignment and gap assessment, HIPAA BAA registry, and structured regulatory change monitoring.
What your score means
Fundamental gaps across multiple domains. Cannot credibly support client governance from this position.
Core capabilities are forming. Structured 60–90 day posture improvement program before client service positioning.
Reasonable posture with identifiable gaps. Pre-sales conversations with clients can begin; full service launch requires M365 readiness and compliance thresholds.
Strong internal posture. Full client service launch authorised. Own posture serves as the reference sale.
Client service launch also requires: Domain 4 (M365 Readiness) ≥ 50% and Domain 6 (Compliance) ≥ 50%
Transparent methodology
Risk scores in CyberSentriq are computed from explicit signals. The methodology is visible to MSPs and clients; unexplained scores create more questions than they resolve.
- Each of the 24 questions is scored 0–3 by the respondent (None / Partial / Mostly / Yes).
- Domain score = mean of the four questions in the domain, expressed as a percentage of 3.
- Overall score = weighted mean of the six domain scores using the weights shown above.
- Tier mapping: 0–25% Critical, 26–50% Developing, 51–75% Progressing, 76–100% Ready.
- Two minimum thresholds must additionally be met to authorise client service launch: M365 Readiness ≥ 50% and Compliance ≥ 50%.
Become a CyberSentriq partner MSP
Access the full assessment toolkit, the AI Governance Scorer, and partner enablement support.