// Q01 Does your business use Microsoft 365, Google Workspace, or another cloud productivity suite?

yes — we are fully on M365 or Google Workspace partially — some cloud, some local licenses no — we use local/legacy software only we have no standardized productivity tools

// Q02 How sensitive is the data your business handles day-to-day?

highly regulated — HIPAA, PCI, legal, or financial client data moderately sensitive — internal financials, contracts, employee data general business data — proposals, schedules, non-regulated records low sensitivity — public-facing or non-confidential data only

// Q03 Is anyone at your company currently using AI tools (ChatGPT, Copilot, Gemini, etc.) for work tasks?

yes — multiple people, regularly, for real work tasks yes — a few people, experimenting occasionally — curiosity use only, nothing systematic no — nobody is using AI tools at all

// Q04 How would you rate your team's general comfort level with new technology?

resistanteager adopters

// Q05 Does your organization have any documented AI usage or data governance policy?

yes — written policy, employees have signed or been trained informal — we have talked about it but nothing is written no — we have no policy and have not discussed it not applicable — we have no AI usage at all

// Q06 How would you describe your current IT infrastructure?

modern — cloud-first, managed endpoints, MFA everywhere mixed — some cloud, some aging hardware, partial MFA legacy — mostly on-prem, minimal cloud, inconsistent security unknown — we genuinely do not know what we have

// Q07 Do you have a documented data retention policy — how long you keep records and when you delete them?

yes — written, enforced, reviewed within the last year partial — some departments have it, others do not no — we keep everything indefinitely with no policy we do not know what data we have or how long we keep it

// Q08 Do you have an up-to-date inventory of the software vendors and SaaS tools your business uses?

yes — complete list, contacts, renewal dates known mostly — we know the major ones but not everything partial — people use tools we did not officially approve no — we have no vendor or tool inventory at all

// Q09 Does your business have a written incident response plan — what to do if you get hacked, hit by ransomware, or lose access to critical systems?

yes — written, tested, team knows what to do informal — we would figure it out but nothing is documented no — we have no plan we have had an incident and still have no plan

// Q10 Has anyone at your business received any security or AI awareness training in the past 12 months?

yes — formal training, documented, all staff informal — we talked about it in a meeting or via email no — no training has happened we do not think training is necessary

AI readiness check.
free.

your business. ten questions.

not sure what your score means?