Mastascusa Holdings · A free tool
The Readiness Scan
Tell us about your AI in three minutes. Get back a clear picture of where it's strong, where it's weak, and what to fix first.
Automated estimate, not the full audit. Findings are illustrative — useful for self-locating before commissioning the real thing. Scoring is anchored to the same rubric the audit uses; the methodology page lists every framework the rubric maps to.
Scan output
Three production AI surfaces; governance lags behind capability on every pillar.
data architecture
Lvl 2 / 4
Training-serving skew is undocumented for the fraud model; physician-note pipeline lacks formal lineage.
Top gapDefine a baseline distribution per model + monitor in production.
access control
Lvl 2 / 4
Customer-support chatbot can read PHI but role boundaries are inherited from a generic SaaS RBAC.
Top gapEnumerate model-specific access surfaces (weights, fine-tunes, training data, inference endpoints).
process documentation
Lvl 1 / 4
No incident runbook for "the chatbot said something wrong." No kill switch with under-five-minute SLA.
Top gapAuthor and rehearse a model-incident response runbook. Air Canada is a precedent now.
agent governance
Lvl 1 / 4
Three agent surfaces, no published org chart, no named owner per agent, no escalation policy.
Top gapPublish an internal agent org chart with per-agent owner, eval cadence, and escalation path.
Framework crosswalk
| Framework | Status | Note |
|---|---|---|
| NIST AI RMF | partial | GOVERN function mostly absent; MEASURE function ad hoc. |
| ISO/IEC 42001 | gap | No AIMS in place. Pre-certification gap audit recommended. |
| SR 11-7 | gap | Effective challenge requirement not met for any of the three models. |
| EU AI Act | partial | Underwriting summaries may fall under high-risk if used for EU residents. |
| OWASP LLM Top 10 | partial | No documented prompt-injection or supply-chain controls on the chatbot. |
Recommended next step
Commission a Mastascusa Holdings audit. The Readiness Scan is an automated estimate — defensible findings require evidence-backed scoring.
Commission an auditThe Readiness Scan is an automated estimate generated from your inputs. Findings are illustrative and cannot be relied upon for board, regulatory, or commercial decisions. Commission a Mastascusa Holdings audit for evidence-backed, scored conclusions.
What happens next
The scan runs and you get a scored topology immediately.
A copy is emailed to your address (and to us).
If the findings warrant a real audit, we follow up.