The AI Readiness Assessment
Three weeks. Fixed fee. A real report and a roadmap you can act on whether you hire us or not.
Price: $10,000 flat fee.
What this is
You can’t govern what you can’t see. The Assessment catalogs the AI already in your business, identifies where it’s safe and where it isn’t, prioritizes the workflows worth automating first, and gives you a 90-day roadmap. You get the report. The roadmap works whether ACS implements it or someone else does. About a third of our Assessment clients implement with someone else — including their existing IT staff — and we are okay with that. We sell this as a standalone product because it’s worth standing alone.
What we look at
Shadow AI inventory
What AI tools are actually being used inside your business, by whom, and for what. Pulled from your Microsoft 365 (or Google Workspace) audit logs, browser telemetry where available, expense data, and direct interviews with department heads. The output is a list — names, accounts, data classes touched. Most clients are surprised by what we find. A few are alarmed.
Microsoft 365 / Google Workspace posture
Copilot license utilization vs. spend. License rightsizing recommendations. Identity and conditional access posture as it relates to AI tools. DLP policies in place vs. needed. Sensitivity label coverage. We tell you where you’re paying for what you’re not using, and where you’re using what you haven’t paid for.
SharePoint / OneDrive permission analysis
This is the most operationally important section of the Assessment, and it surprises people. The number one reason Microsoft Copilot leaks data inside SMBs is not the AI — it is SharePoint and OneDrive permissions that have not been audited since 2019. Copilot reads everything your people are allowed to read. We map the permission sprawl, flag the over-broad shares, and produce a remediation plan. If you fix nothing else from the Assessment, fix this.
Data classification status
Which document classes are labeled, which aren’t, where the regulated data lives, where it leaks into unlabeled containers. Output: a labeling plan that scales, not a “label everything” recommendation that nobody implements.
Identity hygiene
Orphaned accounts, service principals nobody owns, MFA gaps, conditional access policies that look strict on paper and aren’t enforced in practice. Adjacent to AI but foundational; if identity is loose, AI governance is theatrical.
Regulated data exposure
HIPAA, ITAR, CMMC, SOX, state bar rules, AICPA — whichever apply to you. Where the regulated data lives, which AI tools (yours and shadow) have touched it, what your current policy says vs. what the regulators expect. Documented.
SaaS sprawl with AI features
Many of your existing SaaS vendors silently turned on AI features in 2024–2025. Your DMS now summarizes documents. Your CRM now drafts emails. Your accounting platform now suggests journal entries. Each of those features eats your data. We inventory which vendors have done this and what data they’re processing.
Use case interviews
Short structured conversations with your leadership and three to five department heads. The goal: find the two or three highest-impact workflows to deploy first, before you’ve committed to a tier. We listen for revenue impact, time leak, and risk reduction.
Vendor AI policy review
Your existing contracts — DMS, ERP, PSA, CRM, payroll, insurance — read for AI-related clauses. What does each vendor allow you to do with AI? What are they doing with your data? Where are the gaps? Where are you out of compliance with a contract you signed and didn’t notice?
What you get
A real deliverable, not a slide deck.
- A 30–40 page report, written in plain language. Findings, evidence, prioritization.
- An executive briefing deck (10 slides) — the version you show your leadership team or board.
- A prioritized 90-day roadmap — every recommendation tagged with effort estimate, cost estimate, and the question “implement, defer, ignore” pre-answered with our recommendation.
- A 90-minute review meeting with your leadership and ours. We walk the report. You ask questions. Your team takes notes.
- The raw data files used to build the report. License utilization exports, permission scan results, audit log queries — yours to keep, yours to re-run.
Timeline
Week 1 — data gathering and tool scans. Tenant admin handoff (read-only). Audit log pulls. Permission scans. Tool inventory. Vendor contract review. We need access; you don’t need to be in the room much.
Week 2 — interviews and analysis. Department head interviews (45 min each, five total typical). Synthesis. Finding validation. Draft report assembly.
Week 3 — report build and delivery. Final report drafted, internal review, delivery to you. 90-minute review meeting at the end of the week.
Sample report preview
FAQ
What if you find something bad?
We tell you. It’s your data and your decision. We document the disclosure. We don’t bill you extra to fix it; the remediation goes in the roadmap with the rest of the recommendations.
Do I have to implement everything?
No. The roadmap is yours. Some recommendations are urgent (regulated data exposure usually is). Some are nice-to-have. We mark which is which. About a third of Assessment clients pick three to five priority items and stop there.
Can we just buy this without buying the ongoing service?
Yes. About a third of Assessment clients do. The Assessment stands alone. If you have an internal team or another vendor that can execute the roadmap, the report works for them.
What if we already have a security assessment?
A standard security assessment and the AI Readiness Assessment overlap maybe 20%. Both look at identity and DLP. The Assessment goes deeper on AI-specific exposure — shadow AI traffic, Copilot permission inheritance, regulated-data-meets-AI scenarios, vendor AI clauses — that a standard security review usually doesn’t cover.
Will you talk to my IT vendor or MSP?
Yes. If they want to be in the room, that’s good. The Assessment improves when your existing IT and security people are part of the conversation. We don’t replace them; we add an AI lens.
What if we’re below the 10-user minimum for ongoing MIP service?
You can still buy the Assessment. We sell it as a standalone product. We just won’t sell you Foundation/Operate/Strategic afterwards if you’re under 10 users — not because we don’t like you, but because the per-user economics don’t make sense for either side under that threshold.
Book yours
Ready when you are.
Three weeks. Fixed fee. A real report and a 90-day roadmap. You keep it whether you hire us or not.