0–4.99
Minimal
8 of the 21 controls apply.
Every AI vendor is scored before and during use. Twenty-one questions against the CT Framework produce one number a leadership team can act on, and the record keeps the working.
Four factors, weighted: Contractual 35%, Data Leakage 30%, Shadow AI 15%, Auditability 20%. Each factor scores 0 to 10. An unanswered question scores 9, because silence is risk. Any single factor above 9.0 forces a High minimum, and a sub-score above 9.1 escalates the result one tier.
8 of the 21 controls apply.
19 controls apply, excluding C13 and C20.
High runs 6.5 to 7.49, Unacceptable from 7.5. All 21 controls apply.