Framework¶

The Assessments Hub uses a practical diagnostic framework. The exact questions and scoring model can differ by assessment, but the underlying purpose is consistent: turn vague technical, cloud, AI, security, and readiness concerns into visible decision areas.

1. Current-state clarity¶

Can the team explain how the system works today?

Typical signals:

Architecture and data-flow visibility.
Known owners for critical systems.
Documented dependencies.
Clear operating assumptions.

2. Evidence readiness¶

Can the team prove what it says is implemented?

Typical signals:

Configurations, screenshots, logs, exports, policies, runbooks, and diagrams.
Security questionnaire support.
Audit trail availability.
Access, backup, incident, and recovery evidence.

3. Architecture and platform risk¶

Can the platform handle operational, customer, and enterprise expectations?

Typical signals:

Cloud foundation quality.
Infrastructure-as-code maturity.
Deployment and rollback safety.
Observability and alerting.
Recovery and resilience posture.

4. Security and control validation¶

Are controls implemented, testable, and explainable?

Typical signals:

Identity and access control.
Logging and monitoring.
Vulnerability management.
CI/CD security.
Secrets handling.
Evidence-backed remediation.

5. AI, data, and vendor dependency¶

Are AI, cloud, vendor, model, and data-flow dependencies understood?

Typical signals:

Prompt, embedding, retrieval, and inference data flows.
External model/API dependency.
Region and processor visibility.
Portability and fallback options.
Retention, deletion, and support-tool boundaries.

6. Actionability¶

Can the findings be converted into work?

Typical signals:

Prioritised risks.
Sequenced remediation.
Clear ownership.
Implementation-ready backlog items.
Decision points for leadership.

Interpretation¶

This framework supports technical and governance conversations. It should not be treated as legal advice, certification, audit assurance, or a regulatory opinion.