{
  "name": "CyberSentriq MSP AI Governance Self-Assessment",
  "description": "A self-assessment of an MSP's AI governance posture across six capability domains. Each question is answered on a 0–3 scale; domain scores are weighted into an overall fraction that maps to a readiness tier and a client-service launch verdict.",
  "url": "https://lab.cybersentriq.com/assessment",
  "version": "1.0",
  "responseScale": [
    {
      "value": 0,
      "label": "None"
    },
    {
      "value": 1,
      "label": "Partial"
    },
    {
      "value": 2,
      "label": "Mostly"
    },
    {
      "value": 3,
      "label": "Yes"
    }
  ],
  "scoring": {
    "method": "Each domain score is the mean of its question values divided by 3. The overall score is the weighted sum of domain scores (weights below sum to 1.0). Domains with a threshold must individually meet it for an unconditional launch verdict.",
    "domainWeightsSumTo": 1
  },
  "tiers": [
    {
      "tier": "Ready",
      "min": 0.76,
      "max": 1,
      "verdict": "Full client service launch authorised",
      "description": "Strong internal posture. Own posture serves as the reference sale. QBR evidence programme can begin immediately."
    },
    {
      "tier": "Progressing",
      "min": 0.51,
      "max": 0.75,
      "verdict": "Pre-sales conversations authorised; full launch conditional",
      "description": "Reasonable posture with identifiable gaps. Pre-sales conversations with clients can begin; full service launch requires M365 readiness and compliance thresholds."
    },
    {
      "tier": "Developing",
      "min": 0.26,
      "max": 0.5,
      "verdict": "Hold client service launch",
      "description": "Core capabilities are forming. Structured 60–90 day posture improvement programme before client service positioning."
    },
    {
      "tier": "Critical",
      "min": 0,
      "max": 0.25,
      "verdict": "Posture engagement required before client service positioning",
      "description": "Fundamental gaps across multiple domains. Cannot credibly support client governance from this position."
    }
  ],
  "domains": [
    {
      "id": "strategy",
      "title": "Strategy and Governance Foundation",
      "weight": 0.15,
      "minThreshold": null,
      "questions": [
        {
          "id": "s1",
          "text": "Do you have a written, current AI usage policy specifically covering staff use of third-party AI tools?"
        },
        {
          "id": "s2",
          "text": "Is there a named individual responsible for AI governance in your organisation?"
        },
        {
          "id": "s3",
          "text": "Have staff received documented AI awareness training in the last 12 months?"
        },
        {
          "id": "s4",
          "text": "Do you maintain an AI-related incident register and review it on a defined cadence?"
        }
      ]
    },
    {
      "id": "tooling",
      "title": "Approved AI Tool Management",
      "weight": 0.2,
      "minThreshold": null,
      "questions": [
        {
          "id": "t1",
          "text": "Is there a maintained, current list of approved AI tools with data-handling constraints for each?"
        },
        {
          "id": "t2",
          "text": "Can you produce a list of unapproved AI tools being used across your client estate (shadow AI visibility)?"
        },
        {
          "id": "t3",
          "text": "Are AI tool access changes triggered as part of your joiner/mover/leaver workflow?"
        },
        {
          "id": "t4",
          "text": "Do approved tools include vendor compliance evidence (BAA, DPA, SOC 2) where applicable?"
        }
      ]
    },
    {
      "id": "exceptions",
      "title": "Exception and Waiver Workflow",
      "weight": 0.15,
      "minThreshold": null,
      "questions": [
        {
          "id": "e1",
          "text": "Is there a structured, documented process for staff to request use of an unapproved AI tool?"
        },
        {
          "id": "e2",
          "text": "Are exceptions tracked with an expiry date and review cadence?"
        },
        {
          "id": "e3",
          "text": "Is the boundary between Microsoft-stack tools and other AI tools explicit in your governance scope?"
        },
        {
          "id": "e4",
          "text": "Can you produce a client-facing record of all active exceptions for a given client?"
        }
      ]
    },
    {
      "id": "m365",
      "title": "M365 and Copilot Readiness",
      "weight": 0.2,
      "minThreshold": 0.5,
      "questions": [
        {
          "id": "m1",
          "text": "Has SharePoint and OneDrive permission auditing been completed in the relevant tenants in the last 12 months?"
        },
        {
          "id": "m2",
          "text": "Are sensitivity labels deployed and applied to a measurable proportion of content?"
        },
        {
          "id": "m3",
          "text": "Are guest and external sharing controls reviewed and constrained to organisational policy?"
        },
        {
          "id": "m4",
          "text": "Is a scored Copilot readiness assessment completed before enabling Copilot in a client tenant?"
        }
      ]
    },
    {
      "id": "classification",
      "title": "Data Classification and Prompt Hygiene",
      "weight": 0.1,
      "minThreshold": null,
      "questions": [
        {
          "id": "c1",
          "text": "Is your data classification scheme enforced by tooling (not just documentation)?"
        },
        {
          "id": "c2",
          "text": "Do staff have written prompt hygiene guidance indexed by data category?"
        },
        {
          "id": "c3",
          "text": "Where agentic AI tools are used, are their scope and actions controlled at the retrieval layer?"
        },
        {
          "id": "c4",
          "text": "Are controls in place to prevent client data crossing tenant or environment boundaries via AI tooling?"
        }
      ]
    },
    {
      "id": "compliance",
      "title": "Compliance Framework Readiness",
      "weight": 0.2,
      "minThreshold": 0.5,
      "questions": [
        {
          "id": "cf1",
          "text": "Do you hold ISO 27001 certification or equivalent active certification?"
        },
        {
          "id": "cf2",
          "text": "Have you assessed your readiness against ISO 42001 (AI management systems)?"
        },
        {
          "id": "cf3",
          "text": "Do you maintain a HIPAA BAA registry for AI vendors processing health data (where applicable)?"
        },
        {
          "id": "cf4",
          "text": "Do you actively monitor regulatory changes affecting AI governance (EU AI Act, FCA guidance, UK Bill)?"
        }
      ]
    }
  ],
  "submission": {
    "endpoint": "https://lab.cybersentriq.com/api/survey-results",
    "method": "POST",
    "documentation": "https://lab.cybersentriq.com/openapi.json"
  }
}