Your practice space
Read first, or open the worksheet whenever you are ready.
A security score is useful only when it helps a team choose what to repair. A polished dashboard can hide a missing emergency stop. A low number can also exaggerate the danger of a harmless public-data draft. This course’s scorecard is deliberately simple: ten practices, each scored from zero to two, against one real workflow. It is a conversation starter with evidence attached, not a badge.
Score with the business owner, the data owner, and whoever administers the tool. Ask to see a working control. “We have a policy” earns less than a tested permission boundary. If nobody knows the answer, mark it unknown and investigate. A point rises when the practice is demonstrated, not when a meeting assigns someone to look into it.
Constructed teaching example
See the risk in ordinary work
Example: leadership says the company is “secure” because it has a policy and strong passwords.
Where it fails
Nobody can name the owner of an AI connector, show a tested pause procedure, or say which customer files entered a pilot.
A better route
A cross-functional team scores demonstrated practices, records evidence and unknowns, and prioritizes the riskiest gaps rather than averaging them away.
The working diagram
Follow the boundary
- 01
Evidence
Look for a working example, not a policy claim.
- 02
Score
0 absent; 1 partial; 2 proven on a real workflow.
- 03
Flag
Do not average away critical zeros.
- 04
Recheck
Repeat after the remediation work.
Use the score as a conversation, not a seal
The course scorecard has ten controls worth zero, one, or two points each. Zero means no reliable practice or no evidence. One means a documented or partial practice that has not been tested end to end. Two means the practice is demonstrated on the workflow you selected. The maximum is 20. The numbers are an editorial planning aid, not a NIST rating, legal conclusion, or security certification.
Score one real AI workflow first. A company can be strong on corporate passwords and weak on a new connector. Bring the business owner, IT or security, and the data owner together. Require a piece of evidence for each two: a permission view, a test result, a recovery rehearsal, or an action log. Mark “unknown” as zero until checked. Assigning an investigator is the first repair step, not a score increase; the score changes only after evidence appears.
Interpret the pattern before the total
A total of 16 can still hide a zero on a critical control. The four critical controls are identity and recovery, data boundaries, action permissions, and the ability to pause and recover. Treat any zero in these as a gap that cannot be averaged away. As an editorial starting rule, keep a workflow draft-only if any critical control is zero. With no critical zeros, working evidence behind the answers, and owners and dates for the remaining gaps, a monitored pilot may be reasonable. The decision to move beyond draft-only must also account for the data involved, the actions enabled, and legal or contractual duties—not just the numeric score.
Compare scores for the same workflow over time. Did a tested control improve? Did a new connection create a new gap? Keep the evidence and date beside the number. If a team debates a point, the debate is useful: it often reveals that policy and practice differ. Share the evidence and gaps with leadership, not just a total.
Check it in your organization
- Pick one workflow and list its owner.
- Score each control with evidence or mark it unknown.
- Flag any zero on identity, data, permission, or stop capability.
Use the result to choose the next small action
A low score suggests a narrow draft-only pilot while the basics are fixed. A higher score supports a broader test, not unattended authority. Retest after each change and after a serious incident. The score should make the next decision clearer, not become a target employees learn to game.
The interactive scorecard on the course overview is designed to calculate a total and flag critical zeros locally in your browser without sending answers to the site. If you need an auditable assessment, keep a separate evidence record inside your organization.
Follow one business through the course
Northline: a respectable total with one dangerous zero
Northline Supply is a fictional teaching example, not a reported company incident.
Northline scores its service assistant. It has individual accounts, clear data examples, a trained reviewer, vendor terms, and useful logs. The total looks encouraging. Then the team reaches “pause and recovery” and realizes only one administrator knows how to disable external sending, and that person is on leave. The total cannot make this zero less important.
The team writes down the evidence behind every two-point answer and flags the missing stop path. It keeps the assistant in draft-only mode while IT names a backup operator and rehearses the pause. One week later, the team repeats the same workflow score with a test record. The improvement is not “we gained two points”; it is “two people can now stop sending and find affected cases.”
Another setting
Why the same company can have two scores
Marketing uses public material to draft internal headlines. Finance considers an assistant that can submit payment requests. The same corporate password policy applies to both.
What to do: Score each workflow separately. The payment assistant’s action permissions, approval, and stop capability deserve much more scrutiny even if the organization-wide login practice is identical.
Where this goes wrong
Three traps worth catching early
Scoring the policy instead of the practice
A document can describe a control that no one has tested. Ask for a permission screen, a log entry, or a rehearsal result.
Arguing over one point for an hour
Record the uncertainty and the evidence needed to settle it. The missing evidence is often the useful finding.
Treating equal points as equal harm
The score is intentionally simple. A missing pause route may matter more than a weak friction log; mark critical zeros separately.
What good looks like on paper
A score note, filled in
The live scorecard handles arithmetic. Keep the reasons in your own records.
- Workflow
- Service reply assistant, draft-only, version dated October 9, 2026.
- Two-point evidence
- Named owner, account-scope test, example approval view, and log from a planted case.
- Critical zero
- No rehearsed backup operator for disabling external sends.
- Next review
- Retest after backup access and pause rehearsal; do not widen action rights first.
Put it into practice
Try this on one real workflow
Score one live or planned workflow with its owner, IT, and the data owner.
The fill-in worksheet is in the practice space at the top of this lesson. Open it when you have a workflow in mind; it will keep your notes out of the reading flow.
Go to the worksheetSources behind this lesson
The business examples are constructed. These sources support the method or risk described above; they do not prove a result for the fictional company.
NIST recommends current and target profiles; this course’s 0–20 score is a simpler editorial teaching tool, not a NIST score.
Now the gaps are visible. The final lesson turns them into dated work and helps you decide what to do yourself and where a specialist earns a call.