Diagnostic
AI Security Maturity Benchmark Packet
Establish a directional, analyst-reviewed baseline of AI security ownership, control coverage, evidence gaps, and priority work.
The first deliverable is a decision package: what is in scope, what is required, what is blocked, and what can proceed.
No production testing, adversarial activity, access to secrets, or customer-data processing happens without explicit authorization and the right agreement path. Do not enter secrets or credentials here.
What to gather for this packet
Needed: Current-state overview · AI usage landscape · Key concerns
Helpful: Prior assessments · Framework targets · Org context
Bring names and high-level descriptions only — exact targets, accounts, and credentials are shared later through a secure channel.
Engagement
Readiness inputs
Deliverables you want
Packet modules
- Scope Brief — What is in scope, what decision is being made, and what success looks like.
- Buyer Pressure Summary — The pressure that triggered the engagement and the buyer questions behind it.
- Evidence Handling Plan — Where evidence is stored, redaction, retention, and deletion.
- Contract Requirements — The required and conditional agreements for this engagement.
- Open Questions — What is still required before a scoping call or private offer.
- Follow-On Recommendations — Natural next services once this engagement completes.
- Deliverables Plan — The artifacts the buyer will receive and in what format.
AI Security Maturity Benchmark Packet — preview
Diagnostic
Scope Brief
- Organization: To be specified during scoping
- Decision: Establish a directional, analyst-reviewed baseline of AI security ownership, control coverage, evidence gaps, and priority work.
- Driver: We do not yet know our AI security gaps or where to invest first.
Buyer Pressure Summary
- Pressure: New leader/mandate, Pre-program scoping, Budget planning, Audit prep
- Buyer questions: To be added
Evidence Handling Plan
- Evidence stored in an access-controlled encrypted store; redaction; agreed retention + deletion.
Contract Requirements
- Mutual NDA — Required for this engagement.
- Evidence Handling Policy — Required for this engagement.
- No-Cost Scoping Retainer (conditional) — Scope before any paid work or active testing.
- Statement of Work Template (conditional) — If run as a paid diagnostic, a lightweight SOW applies.
Open Questions
- The buyer questions / questionnaire to answer
Follow-On Recommendations
- ai governance program build
- ai product security assessment
- secure ai sdlc
Deliverables Plan
- Analyst-reviewed program baseline
- Control coverage and evidence gap view
- Priority findings
- Owned 30/60/90 roadmap
Onboarding
Move four tracks in parallel
We put legal, finance, procurement, and technical scoping on parallel rails so the work can start without waiting on every internal process sequentially.
Technical / Program Definition
Output: Draft Engagement Plan
- system or capability in scope
- workflow and integration points
- access or environment needs
- authorization and boundaries
Legal
Output: NDA + Scoping Authorization
- mutual NDA
- data handling
- authorized use boundaries
- confidentiality
- work-product terms
Finance / Procurement
Output: Procurement Packet
- vendor profile
- tax/payment details
- budget category
- fixed-fee quote path
- invoice terms
- onboarding answers
Internal Approval
Output: Approval Memo
- why now
- business pressure
- risk if delayed
- expected deliverables
- timeline
- decision needed
Output
Your output: a clear, measurable prescription.
SCOPE delivers a one-page engagement plan you can share and act on immediately.
- Situation & core problem
- Desired outcome & success criteria
- Key risks & assumptions
- Recommended path(s)
- Effort, timing & impact
- Open questions & next step
SCOPE Prescription
Situation
Criteria
Recommended path
Next step
Export as markdown ↗