AI Readiness AssessmentData · Governance · Security · Use Cases · People

An AI readiness assessment is a structured evaluation that scores your organization across five pillars — data foundation, governance and policy, security and identity, use case pipeline, and people and process — against frameworks including NIST AI RMF 1.0, ISO/IEC 42001:2023, OWASP LLM Top 10, and Microsoft Responsible AI. It produces a 0–5 maturity score per pillar, a gap report, a framework crosswalk, and a prioritized 90/180/365-day roadmap.

Quick Scan engagements run about one week from kickoff to readout. Standard engagements run about three weeks. Comprehensive engagements, which include building one Copilot Studio agent or workflow automation pilot, run about six weeks. Timing depends on stakeholder availability and tenant access; we will scope it precisely after a 30-minute discovery call.

Pricing is scoped to your environment and shared after a discovery call. We do not publish flat tiers because a 30-person law firm and a 350-person manufacturer have very different surface areas. Quick Scan engagements start small; Standard and Comprehensive engagements scale with stakeholder count, tenant complexity, and pilot scope. Request a scoped quote and we will come back within one business day.

Strongly recommended. Microsoft 365 Copilot grounds on every file the user can already access in SharePoint, OneDrive, and Teams. Years of permissive sharing mean Copilot can surface salaries, M&A documents, HR cases, and other sensitive content the moment a user asks the right question. A readiness assessment fixes the SharePoint, Microsoft Purview, and Entra ID gaps before activation rather than after a leak. See our Microsoft Copilot services page for the deployment side.

Yes. The assessment scorecard cross-references HIPAA, SOC 2 Type II, CMMC 2.0, NIST CSF 2.0, NIST AI RMF, and ISO/IEC 42001 controls. If you are pursuing or maintaining any of these, the readiness deliverables map directly to the AI-related questions auditors and procurement teams now ask. Pair it with our Managed Cybersecurity or CMMC Compliance Readiness programs for end-to-end coverage.

A readiness assessment evaluates current state and produces a remediation plan. An AI strategy engagement is broader and forward-looking: vision, target architecture, build-vs-buy decisions, multi-year investment plan. Most mid-sized organizations do not need a strategy engagement before a readiness assessment — readiness produces the operational foundation that makes any strategy executable.

No. The assessment is built for organizations of 10 to 500 users that do not have an internal data science team. Recommendations are framed in terms of Microsoft 365 admin actions, SharePoint cleanup, policy authoring, training rollout, and licensed-tool configuration. If a recommendation requires a specialist build, we flag it explicitly and can deliver it through the Comprehensive tier or a separate engagement.

That is the most common starting point. The assessment treats existing tools as in-scope and discovers shadow AI usage explicitly — which tools, who is using them, with what data. We then recommend whether to centralize on a tenant-grounded option (Microsoft 365 Copilot, ChatGPT Enterprise, Claude for Work), keep parallel approved tools, or block specific consumer endpoints.

Yes. The Quick Scan tier was designed for organizations under 50 users that need a focused readiness pulse without a multi-week engagement. The output is the same five-pillar scorecard at a smaller scope: typically 5 to 7 stakeholder interviews, top-level SharePoint review, and a starter policy. Most Quick Scan engagements are completed in about a week.

No. The methodology is platform-agnostic. While the deepest tooling fit is with Microsoft 365 Copilot, Copilot Studio, Entra ID, Microsoft Purview, and Defender, the same five pillars apply to organizations on Google Workspace with Gemini, AWS with Bedrock, or stack-agnostic deployments using ChatGPT Enterprise or Claude for Work. We adapt the technical scan to your environment.

All findings stay in your environment or in OST’s ISO-27001-aligned client portal. We use read-only delegated access where possible, never extract bulk content, and document every system touched. A standard NDA covers the engagement, and any sensitive findings are shared via Microsoft Purview-protected documents rather than email. We can also operate under your existing MSA or BAA.

A board-ready scorecard (PDF and Word formats), a five-pillar gap report, a framework crosswalk against NIST AI RMF, ISO/IEC 42001, OWASP LLM Top 10, and your existing compliance program, a prioritized 90/180/365-day roadmap with effort estimates, and an acceptable-use policy starter document. Comprehensive engagements add a working pilot agent or automation, full ISO 42001-aligned policy set, and role-based training materials.