# Assessment Templates

> *"What gets measured gets managed. What gets managed honestly becomes antifragile."*

This directory contains diagnostic tools, maturity models, and assessment resources for evaluating organizational antifragility.

## Production-Ready Templates

| Template | Purpose |
|----------|---------|
| [Findings Backlog](findings-backlog.md) | Single source of truth for all findings across every module and diagnostic. The input queue for the housekeeping stream. Pragmatic alternative to a formal risk register for organisations that do not have one. |
| [NIST CSF 2.0 Baseline Assessment](nist-csf-baseline.md) | The Brownhat Diagnostic: structured 2-half-day workshop, gap analysis, kill chain identification |
| [Module Completion Report](module-completion-report.md) | Completion package template for every module; includes backlog update |
| [Antifragile Risk Register](antifragile-risk-register.md) | Formal risk register template; the backlog feeds into this for organisations with mature risk management |
| [Risk Register Example](risk-register-example.md) | 8 fully populated entries from a realistic engagement — calibration reference |
| [M365 Project Risk Register](m365-project-risk-register.md) | M365-specific risk register with phase gates |

## Planned Assessments

### 1. Antifragile Maturity Model (AF-MM)

A five-level maturity model covering:

- **Level 1: Fragile** — Reactive, undocumented, dependent on single vendors
- **Level 2: Robust** — Documented, monitored, but static
- **Level 3: Resilient** — Automated recovery, tested backups, incident response operational
- **Level 4: Adaptive** — Chaos engineering, continuous learning, structural improvement from failure
- **Level 5: Antifragile** — Volatility is exploited for gain, optionality is strategic, intelligence is sovereign

### 2. AI Sovereignty Readiness Assessment

Evaluates:

- Current AI usage inventory completeness
- Data classification and leakage risk
- Local infrastructure readiness
- Vendor dependency and exit feasibility
- Regulatory compliance posture

### 3. T0 Asset Discovery Scanner

Planned scripted assessment to:

- Enumerate critical assets across on-premises and cloud environments
- Classify assets by tier based on dependency mapping
- Identify gaps in protection, monitoring, and recovery
- Generate prioritized remediation roadmap

### 4. Dependency Risk Mapper

Planned tool to:

- Map vendor and technology dependencies
- Calculate coupling depth and exit difficulty
- Identify hidden single points of failure
- Simulate failure cascades

### 5. Incident Learning Index

Measures the organization's ability to convert incidents into structural improvements:

- Mean time to structural fix
- Post-mortem completion rate
- Structural changes implemented per incident
- Repeat incident rate

## Development Roadmap

Phases are sequenced by client impact, not calendar quarter. Dates are assigned at the start of each development cycle.

| Phase | Deliverable | Format | Status |
|-------|-------------|--------|--------|
| 1 | AF-MM v1.0 — Antifragile Maturity Model questionnaire and scoring guide | Markdown + spreadsheet | Planned |
| 2 | AI Sovereignty Readiness Assessment v1.0 | Interactive web form or CLI tool | Planned |
| 3 | T0 Asset Discovery Scanner v0.1 — cloud APIs + on-premises enumeration | Python script | Planned |
| 4 | Dependency Risk Mapper v0.1 — vendor coupling depth and failure cascade simulation | Python + network analysis | Planned |

## Contributing

When adding new assessments:

1. Document the purpose, methodology, and limitations
2. Include scoring rubrics with clear criteria
3. Provide sample outputs and interpretation guidance
4. Version assessments and maintain changelogs
5. Test on at least two different organizational profiles before release

---

*Return to [Repository Index](../README.md)*