Gartner’s How to Achieve the Minimum Viable AI Governance
Enterprise Security Posture Assessment
You Cannot Manage What You Don’t Measure.
Documented controls mean little if they cover only part of the environment, fail to detect drift, or cannot be enforced consistently.
Download our free self-assessment framework to see how well your organization:
- Discovers and tracks assets, AI tools, and identities
- Controls permissions and sensitive data access
- Maintains secure configurations
- Detects and corrects drift
- Enforces security policies across its environment
Why posture strength matters now
46%of vulnerable edge devices were still not fully remediated a year on
43%of breaches involved unsanctioned AI, more than double the year before
$5.39Maverage cost of a shadow-AI breach, above the $4.99M global average
What’s inside
A Framework to Measure the Gap Between Security Policy & Reality
Replace subjective maturity estimates with an assessment grounded in operational evidence. Find the weaknesses conventional assessments overlook and lay out a plan to systematically tackle them.
- Level criteria and self-testsfor every dimension and axis
- 20 operational questionsthat flag exposure open right now
- Weighted-gap rankingso you know what to fix first
- Executive worksheetwith posture-debt tracking and leadership questions
How it works
Know Where You Stand. Decide What to Fix Next.
This evidence-based assessment helps you measure your organization’s ability to systematically detect, govern, and eliminate exposure across traditional IT infrastructure and the expanding AI ecosystem.
Each dimension is evaluated on a scale of 1 to 3 for Maturity, Coverage, and Depth. These measurements show where the program is strong and where it fails to deliver consistent protection.
Try it. Score each axis from 1 (weak) to 3 (strong) and watch the total change.
Asset & AI Inventory20% weight
Maturity
Coverage
Depth
Permission Baselining & Scope Governance25% weight
Maturity
Coverage
Depth
Configuration & Drift Control25% weight
Maturity
Coverage
Depth
AI Policy Enforcement & Data Security15% weight
Maturity
Coverage
Depth
Governance & Continuous Enforcement15% weight
Maturity
Coverage
Depth
This highlights each dimension’s weakest link.
The action plan
Turn Your Assessment Into an Action Plan
The framework goes beyond assigning a maturity level. It helps you establish where exposure persists, what evidence supports your current posture, and which improvements deserve priority.
The assessment is designed to be repeated quarterly, allowing leadership to evaluate whether exposure is being eliminated faster than new weaknesses emerge.
With the fillable assessment, you can:
Calculate your security posture score across 15 criteria, with an overall result from 15 to 45.
Identify active exposure through 20 operational security checks.
Prioritize remediation investments using weighted gaps across the five dimensions.
Track posture debt, including unresolved exceptions, unmanaged assets, persistent drift, and unreviewed policies.
- 90days
Define a 90-day improvement plan with accountable owners and measurable objectives.
FAQ
Common Questions, Straight Answers
Who is this assessment for?
Security and IT leaders who own exposure management, posture or governance, plus the dimension owners who supply the evidence. The leadership section is written for executives deciding where to fund the fix.
What do I need to complete it?
Evidence rather than opinion. Expect to pull an inventory export, identity baselines and review records, drift or conformance reports, your egress channel list, and your policy register. The scoring itself is fifteen numbers; the evidence is what makes them true.
Do I need special software?
The fields fill in any PDF reader. Automatic scoring, which totals the axes, assigns your band and ranks your priorities live, runs in Adobe Acrobat Reader, which is free. In Chrome, Edge or macOS Preview the totals stay blank, so you add up the columns by hand.
How often should we run it?
Every quarter. Posture is a rate of improvement: a team moving from 24 to 30 is often in better shape than one sitting flat at 33.
Free self-assessment
How Strong Is Your Posture, Really?
Score your posture across five dimensions and leave with a 90-day plan.
