TOPCYBER21™ AI Readiness & Maturity Assessment
Is your organization ready for AI?
AI is already inside your organization. It arrives as free accounts, notetakers, browser extensions and features switched on inside tools you already pay for. Find out how well you govern and protect it, and whether it is safe to turn each kind of AI on.
Reviewed by a CISSP. Takes place in the TOPCYBER21™ Portal.
One assessment, two answers
A score for how mature you are, and a verdict on what is safe to switch on
AI maturity
How well do you govern and protect the AI you use?
A score from 0 to 5 with a maturity band, broken down by NIST CSF 2.0 function so you can see where you are strong and where you are exposed.
AI readiness
Is it safe to turn each kind of AI on?
- Business AIReady
- AI connected to your dataReady with conditions
- AI that takes actionNot ready
Example verdicts. Each level shows how many of its critical controls you have in place and what to fix.
Maturity is your overall average. Readiness looks at your weakest critical controls, so a decent score can still leave you not ready for some kinds of AI.
What we assess
11 domains, in the order you should build them
The first four are your AI foundation. Get them right and everything after them gets easier.
- 01AI Use Policy
- 02AI Governance Team
- 03AI App Approval & Vendor Risk
- 04Compliance Monitoring & Shadow AI
- 05People & AI Literacy
- 06Identity & Access for AI
- 07Data Readiness
- 08Data Protection Controls
- 09Human Oversight & Output Integrity
- 10Agents & AutomationAsked only if agents are in use or planned
- 11Monitoring & AI Incident Response
AI foundation
What you get
Clear results you can act on
- An AI maturity score from 0 to 5, with a chart by function
- A readiness verdict for each level of AI, with the fixes that unlock it
- A view of all 11 domains and the answers you gave
- A downloadable PDF report, updated after our review
- Review by a CISSP, and an AI Readiness & Maturity Consult to walk through it
How it works
Three steps
- Open your portal. Create your organization’s TOPCYBER21™ Portal account, secured with multi-factor authentication.
- Answer the assessment. 27 questions across 11 domains, plus a few about how you use AI today.
- Review your results with us. See your score and verdicts right away, then book a consult to validate them.
Built for organizations adopting AI
Why this assessment is different
Any AI vendor
Readiness is judged by what AI can reach and do, not by whose brand it carries.
A verdict per level
One number cannot tell you whether it is safe to connect AI to your data or let it take action. We answer each separately.
The risks you already have
Shadow AI, oversharing, data loss, meeting notetakers and policy violations are each scored.
Foundation first
Domains run in build order, so your next step is always clear.
A person reviews it
Every submission is reviewed by a CISSP, not just scored by software.
Separate from your cyber score
Your AI results stand on their own beside your TOPCYBER21™ cyber assessment.
Scoring follows the NIST CSF 2.0 functions and is cross-referenced to the NIST AI RMF and ISO/IEC 42001. The assessment reports alignment with these frameworks; it is not an audit or a certification.
Are you ready to turn this on?
Find out in one sitting. Your results are waiting in the TOPCYBER21™ Portal.
