Results
What does the score say?
- Total score
- --
- Items scored
- --
- Gate items at zero
- --
- Result
- --
Score every item to see the result.
Calculator Library / AI Operations
AI Security Readiness Check
Score twelve security controls for an AI use, see which gaps to close first, and note the gates that stop a go decision. A planning aid; nothing is sent anywhere.
Tool
Score the controls
Strong = 20 or more of 24, no gate at 0
Score each of twelve controls from 0 (not in place) through 1 (partly) to 2 (in place and working). Three are gates: a zero on any of them stops a go decision. Score from evidence, with your IT and security leads in the room. Load the example to see a plant scored.
| Question area | What good looks like | Gate | Score |
|---|
Everything runs in your browser. Nothing is sent to a server, and entries are not saved between visits. The example is made-up data. The scores are judgments; check them against evidence.
Picture
Scores by item
What This AI Security Readiness Check Does
The check scores twelve controls that matter for the safe use of AI at work: approved tools and shadow AI, data classes mapped to tools, sign-in and access control, least privilege for agents, secrets kept out of prompts, prompt-injection controls, logging and retention, vendor security review, abuse-case testing, incident response, separation from control systems, and training. Each is scored 0, 1, or 2. Three are gates: approved tools, data classes mapped to tools, and least privilege for agents.
A zero on a gate stops a go decision. Otherwise a total of 20 or more of 24 is Strong, 14 to 19 means Gaps to close, and below 14 is Weak. The check runs in your browser and does not send your data anywhere. It supports the AI Security for Operations Guide; the AI Security Controls Checklist holds the evidence and actions.
This is an awareness and planning aid, not a security assessment. It does not test anything. A high score does not mean you are secure. Have qualified security specialists review important uses.
How the Result Is Decided
| Condition | Result |
|---|---|
| Any gate item scored 0 | Stop: close the gate gaps first |
| Total 20 or more of 24, no gate at 0 | Strong |
| Total 14 to 19 | Gaps to close, with owners and dates |
| Total below 14 | Weak |
Worked Example
The pre-loaded scores are for an illustrative plant. The total is 14 of 24 with no gate at zero, so the result is Gaps to close. The weakest item is prompt-injection controls, scored 0. The data are made up.
Limits and Good Practice
- Score from evidence such as settings, logs, and documents, not from memory or hope.
- The thresholds are a starting rule, not a standard. A single serious gap can matter more than the total.
- Run the check for each important use, not only once for the organization.
- Pair it with abuse-case testing and a review by security specialists.
- Score again after any significant change, and at least yearly.
AI Security Readiness Check Frequently Asked Questions
What is the AI Security Readiness Check?
A twelve-question scoring tool for the controls around an AI use: tools, data, access, agents, injection, logging, vendors, testing, incident response, separation from control systems, and training. Three are gates.
Does a high score mean we are secure?
No. It is a planning aid based on your own scores. It does not test anything. Have qualified security specialists review important uses and test them.
Why are least privilege and approved tools gates?
Because they limit the damage a mistake or an attack can do and the data that can leak. If they are not in place, the other controls are working against a much larger exposure.
Can I use it for an AI agent?
Yes. Score the controls for that agent and its connections. Items on least privilege, injection controls, logging, and incident response matter most for agents.
How often should I score again?
After any significant change to the use, the tools, or the vendor, and at least once a year.