From score to action plan
A score is a nice thing to have. A score that tells you what to do on Monday morning is worth paying for. So every factor that lands below the top band becomes a short list of tasks. Each task gets a priority, somebody's name, and a date, and the list is ordered so the first few items take the most risk off the table for the least effort.
How gaps become tasks
The factor score sets the priority. Under 5.0 and the tasks come out marked High. Between 5.0 and 7.9 they're Medium. At 8.0 or better they're Low, which in practice means keep doing what you're doing and check it quarterly. When two tasks share a priority, the identity and permissions ones go first. They carry the most weight in the score, and more to the point, every AI assistant you switch on inherits whatever state they happen to be in that morning.
Nothing goes on the list without a person's name and a date beside it; unowned tasks are how plans quietly die. On the guided evaluation, your technical account manager drafts the plan from the scan results and sits with your leadership team to go through it. If you're doing this yourself, the recommendations on your results page are the raw material, and the roadmap template further down this page is where you write them up.
| Sample task | Factor | Priority | Target |
|---|---|---|---|
| Enforce MFA for every admin and disable legacy authentication | Identity | High | Q1 |
| Run a tenant-wide permissions audit and remove broad access | Permissions | High | Q1 |
| Approve the AI acceptable use policy and collect acknowledgments | Governance | High | Q1 |
| Create DLP policies for customer PII and financial data | Monitoring | Medium | Q2 |
| Apply retention to the main document libraries | Data quality | Medium | Q2 |
| Train the leadership team; pick the first two use cases | People | Medium | Q2 |
| Evaluate Copilot-eligible licensing for the pilot group | Technology | Low | Q3 |
The six-step path from assessment to governed AI
This is the route we run with clients, in order. The assessment is step one. Everything after it is optional and sized to what the score says you actually need, so a company that scores well on data might skip step three entirely.
AI Readiness Assessment
The seven-factor assessment described on this site. The guided version adds three scans of your tenant (identity posture, permissions, and data security posture) and comes back as a scored rubric, a maturity rating, and the first draft of this very plan.
Remediation roadmap
The plan itself. Governance gaps, identity exposure, over-shared data and ROT cleanup, written up in the order that gets the most risk off the table soonest.
Data governance onboarding
This is the heavy lifting, and it's for companies whose permissions scored badly. We rebuild or migrate SharePoint, redo the permissions around roles instead of individual names, switch DLP on, and add automated archiving if the ROT numbers say it's worth it.
Data governance as a service
The monthly service that stops step three from quietly undoing itself. Workspace management, security monitoring, Microsoft Purview DLP, and a technical account manager whose job includes noticing when the permissions have drifted back to where they started.
Copilot enablement
Only once the environment has earned it. A structured Copilot deployment, AI literacy training for the people who'll use it, and use cases rolled out one at a time with a number attached to each. See Copilot readiness.
Continuous governance
A quarterly re-score, permission audits, access reviews, and updates to the AI policy whenever the regulators or the attackers change the rules.
A three-phase roadmap
Most organizations end up following roughly this shape over three years. Your action plan supplies the specifics, and the AI Strategy & Roadmap template gives you a document to write them into.
Foundation
- Complete the readiness assessment and set the baseline
- Approve the AI acceptable use policy and name an AI owner
- Close the identity gaps: MFA everywhere, legacy auth off, admin roles minimized
- Audit permissions and external sharing; assign data owners
- Deliver AI awareness training to everyone
- Select the first pilot use case and a pilot group
Expansion
- Enforce DLP across endpoints and cloud; monitor AI activity
- Apply retention and clean up ROT in the main repositories
- Run the pilot, measure results, expand to the next two or three use cases
- Role-based training for managers and power users
- Re-assess; compare against the baseline
Optimization
- Automate permission governance and access reviews
- AI-aware DLP and automated incident response
- AI embedded in core processes with ROI tracked per use case
- Quarterly re-score as part of ongoing governance
- Annual strategy refresh
Implementation tracker
A readiness score is a trend line, not a photograph. Tracking is how you watch it move while the plan gets worked through, and, just as useful, how you notice when it has stopped moving.
Action plan progress
On the guided and full programs, every task sits in the plan with its current status. The leadership team can see how far along things are without sending IT an email and waiting until Thursday for an answer.
Before and after
The full program re-scores the environment after remediation and writes up a progress validation report. If you're doing it yourself, the assessment page keeps your history on your own device, so a retake each quarter gives you the same before-and-after picture, just without the engineer.
Templates
AI Strategy & Roadmap template
A skeleton of the document most boards expect: an executive summary up top, then the readiness scores, use cases in priority order, the phased roadmap, a budget and ROI section, governance, and signature lines at the end. Open it, fill it in, print it to PDF.
Open the template →AI Acceptable Use & Governance Policy
Almost always the first task on the plan. It covers approved tools, what people may and may not do, data classification, security requirements, and a page for staff to sign.
Get the policy template →Start with the score
The recommendations on your results page are the first draft of this plan, so that's the place to begin.