Mastascusa Holdings · A free tool
The Readiness Scan
Tell us about your AI in three minutes. Get back a clear picture of where it's strong, where it's weak, and what to fix first.
Automated estimate, not the full audit. Findings are illustrative — useful for self-locating before commissioning the real thing. Scoring is anchored to the same rubric the audit uses; the methodology page lists every framework the rubric maps to.
Scan output
Three production AI surfaces; governance lags behind capability on every pillar.
data architecture
Lvl 2 / 4
Training-serving skew is undocumented for the fraud model; physician-note pipeline lacks formal lineage.
Top gap Define a baseline distribution per model + monitor in production.
access control
Lvl 2 / 4
Customer-support chatbot can read PHI but role boundaries are inherited from a generic SaaS RBAC.
Top gap Enumerate model-specific access surfaces (weights, fine-tunes, training data, inference endpoints).
process documentation
Lvl 1 / 4
No incident runbook for "the chatbot said something wrong." No kill switch with under-five-minute SLA.
Top gap Author and rehearse a model-incident response runbook. Air Canada is a precedent now.
agent governance
Lvl 1 / 4
Three agent surfaces, no published org chart, no named owner per agent, no escalation policy.
Top gap Publish an internal agent org chart with per-agent owner, eval cadence, and escalation path.
Framework crosswalk
NIST AI RMF
partial
GOVERN function mostly absent; MEASURE function ad hoc.
ISO/IEC 42001
gap
No AIMS in place. Pre-certification gap audit recommended.
SR 11-7
gap
Effective challenge requirement not met for any of the three models.
EU AI Act
partial
Underwriting summaries may fall under high-risk if used for EU residents.
OWASP LLM Top 10
partial
No documented prompt-injection or supply-chain controls on the chatbot.
Recommended next step
Commission a Mastascusa Holdings audit. The Readiness Scan is an automated estimate — defensible findings require evidence-backed scoring.
Commission an auditThe Readiness Scan is an automated estimate generated from your inputs. Findings are illustrative and cannot be relied upon for board, regulatory, or commercial decisions. Commission a Mastascusa Holdings audit for evidence-backed, scored conclusions.
What happens next
- 01. The scan runs and you get a scored topology immediately.
- 02. A copy is emailed to your address (and to us).
- 03. If the findings warrant a real audit, we follow up.