tomas.kracmar
64f73371c9
New documents: - core/engagement-model.md: Full client-facing engagement lifecycle (Sections 1-6) plus consultant delivery discipline (Section 7) - core/consultant-field-guide.md: Decision models, client qualification, module selection, 10 common mistakes, technical onboarding, proposal writing - core/about-cqre.md: Company overview template with [PLACEHOLDER] markers for client-facing use - core/about-cqre-cs.md: Czech version of company overview (O společnosti CQRE) - core/executive-summary-cs.md: Czech translation of the board executive summary - assessment-templates/nist-csf-baseline.md: Full Brownhat Diagnostic workshop methodology (NIST CSF 2.0) - assessment-templates/nist-csf-baseline-cs.md: Czech version of Brownhat Diagnostic (for Czech-language workshops) - assessment-templates/module-completion-report.md: Module completion package template - assessment-templates/risk-register-example.md: 8 fully populated risk entries (Meridian Logistics GmbH fictional engagement) - playbooks/privileged-access-architecture.md: Module 13 - Teleport, Tailscale/Headscale, JIT access, vendor governance - playbooks/sovereign-communications.md: Module 14 - Delta Chat chatmail relay, Matrix/Element, crisis channels Updated documents: - playbooks/sovereign-tool-stack.md: Added Elysium, CAExporter, E8-CAT, macOS_IntuneManagement, IntunePolicyParser, M365-Scripts; updated capability matrix and module pairings - core/modular-engagements.md: Module 2 now includes CAExporter as first step; Module 6 includes Elysium password audit - reference/nist-csf-mapping.md: Added back-reference to nist-csf-baseline.md - assessment-templates/README.md: Changed Q1/Q2/Q3/Q4 to Phase 1/2/3/4, added Status column - index.md: Registered all new documents; restructured consultant navigation into three labeled groups (1-25) - README.md: Updated directory tree; updated Quick Start for Consultants Czech localization pointers: - executive-summary.md: Added Česká verze pointer - nist-csf-baseline.md: Added Česká verze pointer - engagement-model.md: Added note that client-facing Czech translation is planned Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
80 lines
2.9 KiB
Markdown
80 lines
2.9 KiB
Markdown
# Assessment Templates
|
|
|
|
> *"What gets measured gets managed. What gets managed honestly becomes antifragile."*
|
|
|
|
This directory contains diagnostic tools, maturity models, and assessment resources for evaluating organizational antifragility. Two production-ready tools are available now; additional assessments are in active development.
|
|
|
|
## Planned Assessments
|
|
|
|
### 1. Antifragile Maturity Model (AF-MM)
|
|
|
|
A five-level maturity model covering:
|
|
|
|
- **Level 1: Fragile** — Reactive, undocumented, dependent on single vendors
|
|
- **Level 2: Robust** — Documented, monitored, but static
|
|
- **Level 3: Resilient** — Automated recovery, tested backups, incident response operational
|
|
- **Level 4: Adaptive** — Chaos engineering, continuous learning, structural improvement from failure
|
|
- **Level 5: Antifragile** — Volatility is exploited for gain, optionality is strategic, intelligence is sovereign
|
|
|
|
### 2. AI Sovereignty Readiness Assessment
|
|
|
|
Evaluates:
|
|
|
|
- Current AI usage inventory completeness
|
|
- Data classification and leakage risk
|
|
- Local infrastructure readiness
|
|
- Vendor dependency and exit feasibility
|
|
- Regulatory compliance posture
|
|
|
|
### 3. T0 Asset Discovery Scanner
|
|
|
|
Planned scripted assessment to:
|
|
|
|
- Enumerate critical assets across on-premises and cloud environments
|
|
- Classify assets by tier based on dependency mapping
|
|
- Identify gaps in protection, monitoring, and recovery
|
|
- Generate prioritized remediation roadmap
|
|
|
|
### 4. Dependency Risk Mapper
|
|
|
|
Planned tool to:
|
|
|
|
- Map vendor and technology dependencies
|
|
- Calculate coupling depth and exit difficulty
|
|
- Identify hidden single points of failure
|
|
- Simulate failure cascades
|
|
|
|
### 5. Incident Learning Index
|
|
|
|
Measures the organization's ability to convert incidents into structural improvements:
|
|
|
|
- Mean time to structural fix
|
|
- Post-mortem completion rate
|
|
- Structural changes implemented per incident
|
|
- Repeat incident rate
|
|
|
|
## Development Roadmap
|
|
|
|
Phases are sequenced by client impact, not calendar quarter. Dates are assigned at the start of each development cycle.
|
|
|
|
| Phase | Deliverable | Format | Status |
|
|
|-------|-------------|--------|--------|
|
|
| 1 | AF-MM v1.0 — Antifragile Maturity Model questionnaire and scoring guide | Markdown + spreadsheet | Planned |
|
|
| 2 | AI Sovereignty Readiness Assessment v1.0 | Interactive web form or CLI tool | Planned |
|
|
| 3 | T0 Asset Discovery Scanner v0.1 — cloud APIs + on-premises enumeration | Python script | Planned |
|
|
| 4 | Dependency Risk Mapper v0.1 — vendor coupling depth and failure cascade simulation | Python + network analysis | Planned |
|
|
|
|
## Contributing
|
|
|
|
When adding new assessments:
|
|
|
|
1. Document the purpose, methodology, and limitations
|
|
2. Include scoring rubrics with clear criteria
|
|
3. Provide sample outputs and interpretation guidance
|
|
4. Version assessments and maintain changelogs
|
|
5. Test on at least two different organizational profiles before release
|
|
|
|
---
|
|
|
|
*Return to [Repository Index](../README.md)*
|