How to score the AI Altitude Assessment.

The organization has no documented approach, no named owner, and no controls in place. Activities, if they occur at all, happen by accident or as side effects of other work. This score is honest, not embarrassing. Most organizations have several domains here when they baseline for the first time.

• No policy, standard, or procedure exists
• No named owner or accountable party
• No metrics, logs, or evidence collected
• Conversations about this topic have not yet occurred at the leadership level

The practice exists in isolated cases, often triggered by an incident, an audit finding, or one motivated individual. There is no consistency across teams, projects, or business units. What happens once may not happen again, and there is no shared playbook.

• Individual heroics, tribal knowledge, or one-off projects
• Reactive: addressed only when something goes wrong
• Different teams handle it differently or not at all
• No documentation that survives the people involved

The organization has acknowledged the gap and is beginning to act. Pilot programs are underway, some teams have moved further than others, and there is enough motion that leadership can point to it, but enforcement is light and coverage is partial.

• Pilot programs or proof-of-concepts in flight
• Pockets of practice in advanced teams; gaps in others
• Draft policies circulating but not yet ratified
• Inconsistent enforcement: depends on who's watching

The practice is documented in a written standard or policy, communicated to relevant teams, and broadly followed. Most teams comply because they know what's expected, though enforcement may rely on periodic checks rather than continuous controls. This is the threshold most regulators consider 'present.'

• Written policy or standard exists and is current
• Most teams trained and following the standard
• Periodic audits or reviews verify compliance
• A named owner or governing committee maintains the standard

The practice is enforced by automation or recurring review, with quantitative metrics that drive improvement. Deviations are detected quickly and trigger a defined response. Leadership sees the metrics on a regular cadence and uses them to make decisions.

• Continuous controls (automation, gateways, telemetry) enforce the standard
• KPIs and dashboards are reported on a defined cadence
• Defined SLAs and escalation paths for deviations
• Leadership reviews metrics and acts on them

The practice is woven into how the organization operates. Lessons learned drive an explicit improvement loop, controls are predictive rather than reactive, and the program benchmarks itself against industry peers. This level is rare: few organizations are here on more than one or two domains.

• Predictive analytics surface emerging risk before incidents
• Self-healing or auto-remediating controls
• External benchmarking against industry peers
• Continuous improvement loop with documented iterations