Skip to main content
The Assurance Line
Self-Assessment

The assurance states

Every domain is scored on the same five states. Each says how much confidence a board can place in what it is told about that part of its AI.

  1. 1AbsentNobody is doing this.
  2. 2Ad hocIt happens sometimes, and depends on particular individuals.
  3. 3DefinedDocumented, assigned, and repeatable.
  4. 4EvidencedProduces artifacts a third party could test.
  5. 5AssuredIndependently tested, reported to the board, and acted on.

The Rules of the Line

  1. 1Results are never averaged.Each domain stands on its own result. A strong score in one does not make up for a weak one in another, and no overall score is given.
  2. 2Nothing is more assured than what it rests on.A domain’s result is capped at the lowest result of any domain before it on the Line. If the inventory is only Ad hoc, a claim that most systems are independently tested rests on a count nobody can trust, and the result says so.

Why assurance states, not maturity

Maturity describes how well a process is run. Assurance asks whether the board can rely on what that process reports. The highest state requires independent testing, reporting to the board, and action on the findings.

Defined and Evidenced are separate on purpose

Having a documented policy and producing evidence of a working control are different achievements. This is a common gap: a policy can describe what should happen without showing that it does. Separate states make that distinction visible.

Each domain says what the states look like there

The scale is consistent across the framework, but the evidence differs by domain. Visibility, for example, requires evidence that the inventory has been reconciled against independent sources. Resilience requires evidence of suspension authority, tested procedures, and fallback arrangements. Each complete domain defines what its five states require.

Version 1.1 · Updated October 6, 2026