Can Your AI Governance Survive Eight Questions?
Nov 6, 2026 · @disc
Your AI is already in production. The only question is whether you can prove it is governed. The free DISC InfoSec AI Governance Scorecard answers that in eight questions and a few minutes, with a maturity score, a PDF report, and your top three gaps.
The question nobody wants to answer on the spot
An enterprise buyer sends a security questionnaire with a new AI section. A board member asks what the company’s AI risk is. A regulator’s deadline lands on the calendar: the Colorado AI Act takes effect January 1, 2027, and EU AI Act obligations are already phasing in.
In each case the honest answer is usually “we think we’re fine.” That is an opinion, not a position. And opinions do not close deals, satisfy auditors, or hold up after an incident.
Most teams are not short on effort. They have an acceptable use policy, a few approved tools, maybe a vendor review. What they lack is a fast, structured way to see where all of that actually stands.
Why a score beats an opinion
AI governance used to be a policy exercise. In 2026 it sits where four disciplines meet, and a gap in any one shows up in the others.
- AI risk. Biased, opaque, or unreliable outputs become business decisions nobody can explain afterward.
- AI threats. Prompt injection, data exfiltration through prompts and uploads, and agents with more access than any human would get.
- AI security. Shared API keys, unvetted plugins and MCP servers, and no logs of what an agent did or on whose behalf.
- AI governance. No inventory, no named owners, no risk register, and oversight that exists as a checkbox rather than a record.
A maturity score turns that sprawl into one number you can track, discuss, and improve. It also gives security, legal, and engineering a shared vocabulary, which is usually the first thing missing.
Meet the free AI Governance Scorecard
The AI Governance Scorecard is a browser-based self-assessment built by DISC InfoSec. It is free, needs no install, and runs in Chrome, Edge, Firefox, or Safari.
| What | Detail |
| Length | 8 questions, a few minutes |
| Scoring | Each answer rated on a five-level maturity scale, 1 to 5 |
| Output | Instant maturity score on screen |
| Report | Detailed, downloadable PDF |
| Priorities | Your top 3 governance gaps, ranked |
| Cost | Free |
Eight questions is deliberate. It is short enough to finish between meetings, yet long enough to separate a team that has written a policy from one that can show the policy working.
How to use it
- Open the Scorecard at this link in any modern browser.
- Enter your details: name, business email, company, job title, and company size. This tailors the report and lets us follow up only if you ask.
- Answer all eight questions on the 1 to 5 scale. Pick the level that describes how things work today, not how the policy says they should.
- Click Generate My Scorecard. Your maturity score appears immediately.
- Download the PDF and review your top three gaps.
- Book a free 30-minute results review at calendly.com/hd-deurainfosec if you want help turning the gaps into a plan.
Tips for a score you can trust
- Score the evidence, not the intent. If you could not show an auditor a dated record tomorrow, score it lower.
- Count the AI you did not buy on purpose. Copilots switched on by a SaaS vendor, meeting recorders, browser extensions, and agents an engineer wired up all count.
- Run it as a team exercise. Have security, legal, and engineering each complete it, then compare. Where the scores disagree is usually where the real exposure lives.
- Retake it quarterly. The trend matters more than any single score.
What you get out of it
- A baseline in minutes, not a quarter. One maturity score gives you a starting point to measure every improvement against.
- A board-ready answer. The PDF turns “what’s our AI risk?” from a guess into a documented position you can put in a slide.
- Priorities, not a wall of findings. Three ranked gaps tell you where the next 30 days of effort pay off most.
- Faster security questionnaires. Knowing your weak spots before a buyer asks keeps AI questions from stalling deals.
- A head start on frameworks. The gaps that drag your score down are the same ones ISO/IEC 42001, NIST AI RMF, the EU AI Act, and the Colorado AI Act all expect you to close.
- Internal alignment. A shared score ends the debate about whether governance is “good enough” and starts one about what to fix.
Who it’s for: CISOs, CIOs, CTOs, compliance and risk leads, and founders at B2B SaaS and financial services firms. It is most useful when a customer questionnaire just landed, the board is asking, agents are going live, or you are weighing ISO 42001 certification.
Reading your score
Level 3 is the line that matters. It is roughly what enterprise buyers and auditors expect to see evidenced, so anything below it is a gap someone outside your company will eventually find.
| Level | What it usually looks like | Your next move |
| 1 | AI use is ad hoc; no inventory, owner, or policy anyone follows | Discovery first: find what is running and who owns it |
| 2 | A policy exists, but enforcement and evidence are thin | Build the risk register and assign accountable owners |
| 3 | Defined processes, documented controls, some records | Close the top three gaps and test the evidence |
| 4 | Controls are measured and monitored | Prepare for ISO 42001 certification |
| 5 | Governance improves continuously from metrics and incidents | Sustain it with periodic internal audit |
Whatever your level, the three priority gaps in your report are the place to start.
From score to a defensible program
A score shows where you stand. DISC InfoSec helps you move, with services sized to whichever level you landed on. Full details are on our AIMS, ISO 42001 and AI Governance page.
| Service | Best for | What you get |
| Free 30-minute results review | Anyone who took the Scorecard | Your gaps explained, noise separated from real exposure, and the shortest path forward |
| AI Governance Quick-Start | Levels 1–2 with a deal or board deadline | AI and agent discovery, shadow AI and data exposure review, a risk register with named owners, and a remediation roadmap in 7–10 days |
| AI Governance Readiness Assessment | Teams preparing for the EU AI Act or Colorado AI Act | A 10-day, fixed-fee review of AI compliance, risk posture, and governance readiness |
| ISO 42001 Control Gap Assessment | Levels 2–3 weighing certification | A 2-week gap assessment against ISO 42001 with a prioritized remediation roadmap |
| Baseline AIMS services | Teams that need the foundations fast | AI risk register setup (1-day engagement) and an ISO 42001-aligned AI Policy & Procedure Starter Kit |
| ISO 42001 implementation | Levels 3–4 heading to audit | A full AI management system that produces audit evidence, not just documents |
| vCAIO and vCISO retainers | Any level, ongoing | Fractional AI governance and security leadership without a full-time hire |
We also map AI governance onto what you already run. If you hold ISO 27001, SOC 2, or follow NIST CSF, we extend those controls to AI rather than building a parallel program.
My perspective
I took a virtual data room provider, through ISO 42001 certification on the first audit attempt. Financial data rooms are the hard mode of compliance: every control gets tested, and every claim needs a record behind it.
The lesson I keep coming back to is that the gap is rarely the policy. Most organizations can write a decent AI policy in a week. The gap is evidence. When I ask for proof of human oversight, I usually get a checkbox, and a checkbox captures what the reviewer said they did, not what they saw, changed, or why.
That is why the Scorecard asks how things work today. If you score well, certification may be a short step. If you don’t, you have just learned where to start, before a customer, an auditor, or an incident shows you.
Take the Scorecard now
Get your free AI Governance Score — eight questions, an instant maturity score, a PDF report, and your top three gaps.
Want help reading the results? Book a free 30-minute results review, email info@deurainfosec.com, or call (707) 998-5164.
DISC InfoSec is a boutique AI governance and cybersecurity consultancy in Petaluma, California, and a PECB Authorized Training Partner. Credentials include CISSP, CISM, AICP, ISO/IEC 42001 Lead Implementer, and ISO/IEC 27001 Lead Implementer.
https://www.deurainfosec.com/disc-infosec-home/aims-iso42001-ai-governance/
- Can Your AI Governance Survive Eight Questions?
- You Can’t Govern AI You Can’t See: The Free AI Governance & Risk Exposure Assessment
- Your ISO 27001 Certificate Has an AI-Shaped Hole in It
- Someone Is Running Your AI Models Right Now. You’re Paying for It
- Your AI Agent Is Only as Secure as Its Harness: The Hidden Layer of AI Risk
