Steady Solution Group
The Next Chapter Assessment

Steady Solution Group

SSG IT & AI Business Risk Assessment

A self-assessment for small business owners from Steady Solution Group (SSG)

Introduction

AI tools are now part of everyday work, often before a business has decided how they should be used. At the same time, the basics of protecting your data, systems, and customers still matter as much as ever.

This self-assessment helps you see where your business stands today. It covers seven areas, from how your team uses AI to how ready you are if something goes wrong. There are no right or wrong answers, and no technical knowledge is needed. The goal is a clear, honest picture so you can decide what to work on first.

Instructions

  • Set aside 15 to 20 minutes. Answer based on what is true today, not what you plan to do.
  • Read each question and the four descriptions under it. Pick the score (0, 1, 2, or 3) that best matches your business and write it on the "Your score" line.
  • The scale runs from 0 to 3. A 0 means the item is not in place (higher risk). A 3 means it is fully in place (lower risk).
  • If you are not sure, or two descriptions seem to fit, choose the lower score. Not knowing is itself a sign of risk.
  • When you finish, add up each section on the Scoring page, then use the Results page to choose your top three next steps.
ScoreMeaning
0Not in place (high risk)
1Partly in place or informal
2Mostly in place, with some gaps
3Fully in place (low risk)

Section 1

AI Use Today

How your team uses AI tools in daily work right now.

1.1 Do you know which AI tools your team uses for work?
1.2 Are those AI tools set up as business accounts, or are people using personal or free accounts?
1.3 Does someone check AI-generated work before it goes to customers or is used to make decisions?
1.4 Do you know what kinds of information employees enter into AI tools?
1.5 Has your team been trained to use AI tools safely and well?

Section 1 subtotal: 0 / 15

Section 2

AI Policy and Governance

The rules, ownership, and decisions behind your use of AI.

2.1 Do you have a written policy for how employees may use AI at work?
2.2 Is a specific person responsible for decisions about AI in your business?
2.3 Is there an approval step before someone starts using a new AI tool for work?
2.4 Do you tell customers when AI plays a meaningful role in work or communications you provide to them?
2.5 How often is your AI policy reviewed and updated?

Section 2 subtotal: 0 / 15

Section 3

Data Protection

How you keep important business and customer information safe and recoverable.

3.1 Do you know where your important business and customer data is stored?
3.2 Is access to sensitive information limited to the people who need it?
3.3 Are your important files and systems backed up?
3.4 Is sensitive information protected so that only authorized people can read it, both on devices and when it is sent? (This is often called encryption.)
3.5 Do you have rules for how long to keep data and how to delete it safely?

Section 3 subtotal: 0 / 15

Section 4

Security Controls

The everyday safeguards that keep accounts and devices from being misused.

4.1 Do your business accounts require a second step to sign in, such as a code sent to a phone? (This is often called multi-factor authentication.)
4.2 How does your team handle passwords?
4.3 Are computers, phones, and software kept up to date?
4.4 Do your work devices have security software that protects against viruses and other threats?
4.5 Is your team trained to recognize fake emails, texts, and calls that try to trick them? (This is often called phishing.)

Section 4 subtotal: 0 / 15

Section 5

Vendor and Third-Party Risk

The outside companies and services that touch your data or systems.

5.1 Do you have a list of the outside vendors and services that can access your data or systems?
5.2 Do you check a vendor's security and privacy practices before you start using them?
5.3 Do you know whether your vendors use your data to train or improve their AI?
5.4 When you stop working with a vendor, is their access to your accounts and data removed?
5.5 Do your agreements with key vendors cover data protection and how they will tell you about a security problem?

Section 5 subtotal: 0 / 15

Section 6

Incident Readiness

How prepared you are if something goes wrong, such as a hacked account, lost laptop, or ransomware.

6.1 Do you have a written plan for what to do if you have a security problem?
6.2 Do employees know how and to whom to report something suspicious?
6.3 Do you have a contact list of who to call for help, such as IT support, your insurer, your attorney, and your bank?
6.4 Have you ever practiced your response to a security problem?
6.5 Do you have cyber insurance, and do you understand what it covers?

Section 6 subtotal: 0 / 15

Section 7

Compliance Exposure

The laws, regulations, and contract terms that apply to the information you handle.

7.1 Do you know which laws, regulations, or industry rules apply to the information your business handles?
7.2 Do your customer contracts include security or privacy requirements, and are you meeting them?
7.3 Does your website have a privacy notice that accurately describes how you collect and use information, including any use of AI?
7.4 Could you show a customer, insurer, or regulator records of what you do to protect information?
7.5 Do you have a way to keep up with changes in the rules that affect your business, including new rules about AI?

Section 7 subtotal: 0 / 15

Scoring

Your score: 0 / 105

0 of 35 questions answered.

1. AI Use Today0 / 15
2. AI Policy and Governance0 / 15
3. Data Protection0 / 15
4. Security Controls0 / 15
5. Vendor and Third-Party Risk0 / 15
6. Incident Readiness0 / 15
7. Compliance Exposure0 / 15

Your results

See your risk band and next steps

Your privacy: We collect your name, contact details and answers so we can show you your result and follow up with you about IT and AI risk. Your answers are emailed to the Steady Solution Group team and used only for that purpose. We do not sell your information. To ask us to delete it, email hello@steadysolutiongroup.com.

This self-assessment is a general guide to help you think about risk. It is not legal advice, an audit, or a certification of compliance. For questions about specific legal or regulatory requirements, consult a qualified professional.