Is there a clearly accountable owner for AI security decisions?
q-strategy-sponsor
Published
Measures whether AI security sponsorship is explicitly assigned.
Domain: AI Strategy
Capability: Operating Model
Control: Executive sponsorship established
Type: yes-no
Assessment Types: quick, professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: personal, team, enterprise
Difficulty: Intermediate
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 1
ai-strategystrategy-operating-modelstrategy-sponsorshipyes-no
How consistently are AI governance policies applied across production and pilot use cases?
q-governance-policy
Published
Evaluates governance policy execution consistency.
Domain: AI Governance
Capability: Policy Governance
Control: Policy review and exception process
Type: likert
Assessment Types: professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: team, enterprise
Difficulty: Advanced
Version: v1.0
Dependencies: 0
Framework Count: 3
Recommendation Count: 2
ai-governancegovernance-policygovernance-policy-reviewlikert
How complete is your inventory of AI tools, models, assistants, and workflows?
q-inventory-coverage
Published
Measures inventory completeness and change awareness.
Domain: AI Inventory
Capability: Asset Discovery
Control: AI asset inventory coverage
Type: maturity-level
Assessment Types: quick, professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: personal, team, enterprise
Difficulty: Intermediate
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 1
ai-inventoryinventory-discoveryinventory-coveragematurity-level
Is shadow AI usage detected and reviewed on a regular basis?
q-shadow-ai-detection
Published
Measures whether unsanctioned AI usage is visible and governed.
Domain: Shadow AI
Capability: Shadow AI Detection
Control: Shadow AI policy enforcement
Type: single-choice
Assessment Types: quick, professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: personal, team, enterprise
Difficulty: Intermediate
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 2
shadow-aishadow-detectionshadow-ai-controlsingle-choice
Are human and machine identities for AI services governed with least privilege and recertification?
q-identity-governance
Published
Measures identity governance maturity for AI-connected systems.
Domain: Identity
Capability: Identity Governance
Control: Identity governance for AI systems
Type: single-choice
Assessment Types: professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: team, enterprise
Difficulty: Advanced
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 1
identity-accessidentity-controlidentity-governance-controlsingle-choice
Which access governance controls are consistently present for AI platforms?
q-access-reviews
Published
Measures coverage of role ownership, policy, logging, testing, and review around access governance.
Domain: Access Management
Capability: Access Review
Control: Access review and least privilege
Type: multiple-choice
Assessment Types: professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: team, enterprise
Difficulty: Intermediate
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 1
access-managementaccess-reviewsaccess-review-controlmultiple-choice
What percentage of AI integrations are covered by managed secret storage and rotation?
q-secrets-lifecycle
Published
Measures coverage of secrets governance for AI integrations.
Domain: Secrets
Capability: Secret Lifecycle
Control: Secrets lifecycle management
Type: percentage
Assessment Types: professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: team, enterprise
Difficulty: Intermediate
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 1
secretssecret-lifecyclesecret-management-controlpercentage
Which prompt security controls are consistently present?
q-prompt-security-controls
Published
Measures guardrails, filtering, logging, and review around prompt handling.
Domain: Prompt Security
Capability: Prompt Validation
Control: Prompt guardrails and logging
Type: multiple-choice
Assessment Types: quick, professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: personal, team, enterprise
Difficulty: Advanced
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 1
prompt-securityprompt-validationprompt-guardrails-controlmultiple-choice
Are prompt injection defenses validated before high-risk assistants are released?
q-prompt-injection-readiness
Published
Measures validation rigor for prompt injection resistance.
Domain: Prompt Injection
Capability: Prompt Firewall
Control: Prompt injection prevention
Type: yes-no
Assessment Types: professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: team, enterprise
Difficulty: Advanced
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 1
prompt-injectionprompt-firewallprompt-injection-controlyes-no
Does the organization use RAG or retrieval-augmented generation in production or pilots?
q-uses-rag
Published
Gating question for retrieval-augmented generation controls.
Domain: RAG Security
Capability: Retrieval Boundary
Control: RAG trust boundary control
Type: yes-no
Assessment Types: professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: team, enterprise
Difficulty: Basic
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 1
rag-securityretrieval-boundaryrag-boundary-controlyes-no
How strongly are source trust, retrieval boundaries, and poisoning controls enforced for RAG workflows?
q-rag-boundary
Published
Evaluates RAG security control maturity.
Domain: RAG Security
Capability: Retrieval Boundary
Control: RAG trust boundary control
Type: maturity-level
Assessment Types: professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: team, enterprise
Difficulty: Intermediate
Version: v1.0
Dependencies: 1
Framework Count: 2
Recommendation Count: 1
rag-securityretrieval-boundaryrag-boundary-controlmaturity-level
How consistently are model evaluations, safety thresholds, and release gates applied?
q-llm-evaluation
Published
Measures LLM evaluation discipline and content safety gating.
Domain: LLM Security
Capability: LLM Evaluation
Control: LLM evaluation and safety gating
Type: likert
Assessment Types: quick, professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: personal, team, enterprise
Difficulty: Advanced
Version: v1.0
Dependencies: 0
Framework Count: 3
Recommendation Count: 1
llm-securityllm-evaluationllm-evaluation-controllikert
Are model artifacts signed, scanned, and traced through release approval workflows?
q-model-provenance
Published
Measures model provenance and release assurance.
Domain: Model Security
Capability: Model Assurance
Control: Model integrity and provenance assurance
Type: single-choice
Assessment Types: enterprise, industry-pack, compliance-pack
Assessment Scopes: enterprise
Difficulty: Advanced
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 2
model-securitymodel-assurancemodel-assurance-controlsingle-choice
Does the organization use AI agents with tool execution or autonomous actions?
q-uses-agents
Published
Gating question for agent-security coverage.
Domain: Agent Security
Capability: Agent Governance
Control: Agent runtime action governance
Type: yes-no
Assessment Types: professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: team, enterprise
Difficulty: Basic
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 1
agent-securityagent-governanceagent-governance-controlyes-no
How mature are approval gates, action allow lists, and runtime monitoring for AI agents?
q-agent-runtime-controls
Published
Measures whether agent autonomy is constrained appropriately.
Domain: Agent Security
Capability: Agent Governance
Control: Agent runtime action governance
Type: maturity-level
Assessment Types: professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: team, enterprise
Difficulty: Intermediate
Version: v1.0
Dependencies: 1
Framework Count: 3
Recommendation Count: 1
agent-securityagent-governanceagent-governance-controlmaturity-level
Is Model Context Protocol or equivalent tool-connector infrastructure enabled?
q-uses-mcp
Published
Gating question for MCP and connector governance coverage.
Domain: MCP Security
Capability: Connector Governance
Control: Connector and session governance
Type: yes-no
Assessment Types: professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: team, enterprise
Difficulty: Basic
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 1
mcp-securityconnector-governancemcp-connector-controlyes-no
Are connectors allow-listed, session-logged, and reviewed for risk before use?
q-mcp-governance
Published
Measures governance around MCP or equivalent connectors.
Domain: MCP Security
Capability: Connector Governance
Control: Connector and session governance
Type: multiple-choice
Assessment Types: professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: team, enterprise
Difficulty: Intermediate
Version: v1.0
Dependencies: 1
Framework Count: 2
Recommendation Count: 2
mcp-securityconnector-governancemcp-connector-controlmultiple-choice
What percentage of AI workflows are covered by data classification, redaction, and approved retention controls?
q-data-protection-coverage
Published
Measures coverage of AI data protection controls.
Domain: Data Protection
Capability: Data Classification
Control: AI data protection and redaction
Type: percentage
Assessment Types: quick, professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: personal, team, enterprise
Difficulty: Advanced
Version: v1.0
Dependencies: 0
Framework Count: 3
Recommendation Count: 1
data-protectiondata-classificationdata-protection-controlpercentage
Are privacy impacts reviewed before AI workflows process personal or sensitive data?
q-privacy-review
Published
Measures privacy review gating for AI-related processing.
Domain: Privacy
Capability: Privacy Oversight
Control: Privacy review and lawful processing
Type: yes-no
Assessment Types: quick, professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: personal, team, enterprise
Difficulty: Intermediate
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 2
privacyprivacy-oversightprivacy-oversight-controlyes-no
Are AI services or models deployed in cloud environments?
q-uses-cloud-ai
Published
Gating question for cloud AI deployment-specific controls.
Domain: Cloud AI
Capability: Cloud Posture
Control: Cloud AI posture control
Type: yes-no
Assessment Types: professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: team, enterprise
Difficulty: Basic
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 1
cloud-aicloud-posturecloud-ai-posture-controlyes-no
How mature are approved configurations, tenant isolation, and regional controls for cloud AI services?
q-cloud-posture
Published
Measures cloud AI posture control maturity.
Domain: Cloud AI
Capability: Cloud Posture
Control: Cloud AI posture control
Type: maturity-level
Assessment Types: professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: team, enterprise
Difficulty: Intermediate
Version: v1.0
Dependencies: 1
Framework Count: 2
Recommendation Count: 1
cloud-aicloud-posturecloud-ai-posture-controlmaturity-level
Are AI runtimes isolated, patched, and covered by infrastructure hardening standards?
q-infrastructure-runtime
Published
Measures runtime infrastructure hardening for enterprise AI.
Domain: Infrastructure
Capability: Runtime Infrastructure
Control: Infrastructure hardening for AI runtime
Type: single-choice
Assessment Types: enterprise, industry-pack, compliance-pack
Assessment Scopes: enterprise
Difficulty: Intermediate
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 1
infrastructureruntime-infrastructureinfrastructure-hardening-controlsingle-choice
What percentage of critical AI events are logged with enough detail for audit and investigation?
q-logging-coverage
Published
Measures event logging coverage for high-value AI workflows.
Domain: Logging
Capability: Event Logging
Control: AI event logging coverage
Type: percentage
Assessment Types: professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: team, enterprise
Difficulty: Intermediate
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 1
loggingevent-logginglogging-coverage-controlpercentage
How mature are AI anomaly detection, alerting, and security monitoring workflows?
q-monitoring-anomalies
Published
Measures monitoring readiness and signal quality.
Domain: Monitoring
Capability: Detection Monitoring
Control: Monitoring and anomaly detection
Type: maturity-level
Assessment Types: professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: team, enterprise
Difficulty: Intermediate
Version: v1.0
Dependencies: 0
Framework Count: 3
Recommendation Count: 1
monitoring-loggingdetection-monitoringmonitoring-detection-controlmaturity-level
Have AI-specific incident playbooks been tested through tabletop exercises or simulations?
q-incident-response
Published
Measures AI-specific incident readiness.
Domain: Incident Response
Capability: Incident Playbooks
Control: AI incident playbooks and exercises
Type: yes-no
Assessment Types: professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: team, enterprise
Difficulty: Intermediate
Version: v1.0
Dependencies: 0
Framework Count: 3
Recommendation Count: 1
incident-responseincident-playbooksincident-playbook-controlyes-no
Are AI controls mapped to frameworks with named evidence owners and recurring review?
q-compliance-evidence
Published
Measures framework mapping and evidence readiness.
Domain: Compliance
Capability: Control Evidence
Control: Evidence-backed compliance readiness
Type: single-choice
Assessment Types: professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: team, enterprise
Difficulty: Basic
Version: v1.0
Dependencies: 0
Framework Count: 4
Recommendation Count: 1
compliancecontrol-evidencecompliance-evidence-controlsingle-choice
Are third-party AI providers reviewed for security, legal, and operational risk before onboarding?
q-vendor-diligence
Published
Measures third-party AI diligence maturity.
Domain: Third-Party AI
Capability: Vendor Diligence
Control: Third-party diligence and contract assurance
Type: single-choice
Assessment Types: enterprise, industry-pack, compliance-pack
Assessment Scopes: enterprise
Difficulty: Intermediate
Version: v1.0
Dependencies: 0
Framework Count: 3
Recommendation Count: 1
third-party-aivendor-diligencevendor-diligence-controlsingle-choice
Are model artifacts, AI packages, and dependencies verified for provenance before deployment?
q-supply-chain-provenance
Published
Measures AI supply chain integrity and provenance assurance.
Domain: Supply Chain
Capability: Provenance Assurance
Control: Supply chain provenance assurance
Type: yes-no
Assessment Types: enterprise, industry-pack, compliance-pack
Assessment Scopes: enterprise
Difficulty: Intermediate
Version: v1.0
Dependencies: 0
Framework Count: 3
Recommendation Count: 1
ai-supply-chainprovenance-assurancesupply-chain-provenance-controlyes-no
How strongly are users trained on AI-specific misuse, data handling, and prompt safety expectations?
q-human-risk-training
Published
Measures role-based awareness and human-risk reduction around AI.
Domain: Human Risk
Capability: Human Behavior
Control: AI security training and awareness
Type: single-choice
Assessment Types: quick, professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: personal, team, enterprise
Difficulty: Basic
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 1
human-riskhuman-behaviorhuman-risk-controlsingle-choice
Are fallback procedures documented for critical workflows that depend on AI outputs or services?
q-business-continuity
Published
Measures continuity planning for AI dependency failures.
Domain: Business Continuity
Capability: Continuity Planning
Control: AI continuity and fallback planning
Type: single-choice
Assessment Types: quick, professional, enterprise, industry-pack, compliance-pack
Assessment Scopes: personal, team, enterprise
Difficulty: Basic
Version: v1.0
Dependencies: 0
Framework Count: 2
Recommendation Count: 1
business-continuitycontinuity-planningcontinuity-controlsingle-choice
How many active AI use cases are tracked in a formal risk register?
q-ai-risk-register-count
Published
Measures whether the governance process is backed by numerically tracked use cases.
Domain: AI Governance
Capability: Policy Governance
Control: Policy review and exception process
Type: numeric
Assessment Types: enterprise, industry-pack, compliance-pack
Assessment Scopes: enterprise
Difficulty: Basic
Version: v1.0
Dependencies: 0
Framework Count: 3
Recommendation Count: 1
ai-governancegovernance-policygovernance-policy-reviewnumeric