Assessment questionnaire for measuring maturity. Answer each question honestly based on current, implemented practices.
Source of truth:
../practices/EG-Data-OnePager.md| Canonical framing:../HAIAMM-v3.0-Framing.md§8 / §12
Practice: Education & Guidance (EG) Domain: Data Purpose: Assess organizational maturity in building AI-data-assurance literacy for data-handler workforce (shadow data in AI as the primary L1 cultural outcome) and deep practitioner skills for the reviewer population performing lineage verification, classification review, DPIA composition, and data-flow security review of AI/HAI data archetypes. Scoring Model: Evidence + Outcome Metrics (see Scoring Methodology below)
| Score | Label | Criteria |
|---|---|---|
| 1.0 | Fully Mature | Evidence complete AND ≥3 outcome metrics meet targets |
| 0.67 | Implemented | Evidence complete AND 2 outcome metrics meet targets |
| 0.33 | Partial | Evidence partially complete OR <2 outcome metrics meet targets |
| 0.0 | Not Implemented | No evidence of the activity in place |
Objective: Deliver foundational data-assurance literacy to ≥95% of the data-handler workforce and role-based practitioner training to 100% of the reviewer population, with an active shadow-data-in-AI awareness campaign.
Q1.1: Do you have a current-year AI-data-assurance literacy course (≤20 minutes) completed by ≥95% of engineers, data scientists, ML platform engineers, and analysts handling AI/HAI data, covering the seven data archetypes, the five data-specific HAI TTPs, the AI Data Use Policy rules, and the sanction-gate intake process, with content updated within 30 days of any policy or archetype change?
Evidence Required: - [ ] LMS module published covering the seven AI/HAI data archetypes (training corpus, inference input stream, retrieval store, prompt/completion log corpus, embedding store, fine-tuning dataset, evaluation/test set) with org-specific examples - [ ] Module includes the five data-specific HAI TTPs in plain language: training-data poisoning (TM), training-data leakage (TM), retrieval-poisoning (AGH), embedding inversion (TM), and prompt injection via retrieved documents (AGH), one concrete data-handling example per TTP matched to the relevant archetype - [ ] AI Data Use Policy five-rule summary, sanction-gate intake process, and before-you-use decision aid included - [ ] LMS completion report showing current-year completion rate across in-scope data-handler headcount - [ ] Named training content owner with documented quarterly review cadence - [ ] Evidence that content was updated within 30 days of last policy, archetype, or compliance map change - [ ] New-hire coverage SLA documented (AI-data-assurance literacy within 30 days of start)
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| % data-handler workforce with current-year AI-data-assurance literacy completion | ___% | ___% | ≥95% | ☐ | |
| % sanction-gate reviewers with completed practitioner training | ___% | ___% | 100% | ☐ | |
| Reviewer calibration drift, avg classification-tier delta across reviewers on shared samples | ___ | ___ | ≤1 classification-tier step | ☐ | |
| Reviewer calibration drift, avg DPIA trigger disagreements per sample | ___ | ___ | ≤1 per sample | ☐ |
Metric Collection Guidance:
- Data-handler literacy completion: LMS current-year completion report filtered to in-scope data-handler roles (engineers, data scientists, ML platform engineers, analysts). Cross-reference with HR headcount for denominator. Formula: completed_count / in-scope_headcount × 100
- Reviewer training completion: LMS report filtered to sanction-gate-approval-permissions group (data stewards, DPOs/delegates, AppSec/AI safety reviewers). 100% is a pass/fail gate.
- Calibration drift, classification tier: Quarterly exercise where reviewers independently score the same sample data-asset intake. Record each reviewer's classification label; calculate mean absolute tier deviation. Source: calibration debrief facilitator record.
- Calibration drift, DPIA trigger: Same exercise; count DPIA trigger determinations that differ from the facilitated consensus answer per reviewer per sample; average across reviewers.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No AI-data-assurance literacy training in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q1.2: Has the practitioner population (data stewards, DPOs/delegates, AppSec/AI safety reviewers) completed a role-based training module (~2.5 hours) covering lineage verification, classification scanning and label propagation, consent-basis verification (GDPR Arts. 6/9), DPIA composition (Art. 35), opt-out and deletion enforcement, training-data canary insertion, embedding-store retention and inversion defense, and retrieval-source classification propagation, with completion gated on sanction-gate-approval permissions and calibration drift inside target for two consecutive quarters?
Evidence Required: - [ ] Practitioner training module published covering lineage verification (catalog query patterns: Atlan, Collibra, DataHub, Unity Catalog, MLflow lineage APIs), classification scanning and label-propagation rules, GDPR Arts. 6 and 9 consent-basis verification - [ ] DPIA composition module included: the six DPIA sections, when mandatory (large-scale, systematic evaluation, special-category data), Art. 35 trigger determination, and DPIA adequacy assessment judgment - [ ] Opt-out/deletion enforcement module: Art. 17 propagation through derived embeddings and retrieval indexes; re-training/re-indexing triggers - [ ] Training-data canary insertion technique covered (design, insertion, tracking in data inventory) - [ ] Embedding-store retention and inversion defense covered (inversion attack risk, access-control patterns, retention-limit enforcement) - [ ] Retrieval-source classification propagation module: label propagation to retrieval index, retrieval-poisoning (AGH) entry point through unclassified sources - [ ] Completion gating enforced: sanction-gate-approval permissions provisioned only after LMS training completion confirmed - [ ] Calibration exercise records from two consecutive quarters showing drift inside target (≤1 classification-tier step, ≤1 DPIA trigger disagreement per sample)
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| % sanction-gate reviewers with completed practitioner training | ___% | ___% | 100% | ☐ | |
| Reviewer calibration drift, avg classification-tier delta on shared samples | ___ | ___ | ≤1 classification-tier step | ☐ | |
| Reviewer calibration drift, avg DPIA trigger disagreements per sample | ___ | ___ | ≤1 per sample | ☐ | |
| Reviewer throughput, gate intakes closed per reviewer per week (post-training trend) | ___ | ___ | trending up | ☐ |
Metric Collection Guidance: - Practitioner training completion: LMS completion report filtered to sanction-gate-reviewer role group. Source: LMS + access-control system confirming permissions are gated on training. - Calibration drift, classification tier: Independent scoring of shared sample data-asset intakes; mean absolute classification-tier deviation across reviewer cohort. Source: quarterly calibration debrief facilitator records. - Calibration drift, DPIA trigger: Count of DPIA trigger determination discrepancies per sample versus facilitated consensus; averaged across reviewers. Source: calibration debrief records. - Reviewer throughput: Gate intake queue analytics, intakes closed per reviewer per week before and after training rollout. Source: intake queue system.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No practitioner training in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q1.3: Is a shadow-data-in-AI awareness campaign running with at least monthly content, a visible amnesty path linked from the Data AUP and intake form, measurable attribution of intake submissions and amnesty disclosures to campaign channels, and DPO/data-steward micro-content for every Critical or High AI data archetype active in the inventory?
Evidence Required: - [ ] Campaign launch documented: executive sponsor message naming shadow data in AI, amnesty window announced, sanctioned-archetype catalog published with fast-track framing - [ ] Monthly content cadence evidenced: content calendar or publication log showing at least one shadow-data-in-AI piece per month (approved data source, fast-track win, anonymized TTP catch, external incident reframe) - [ ] Amnesty path linked from the AI Data Use Policy, the intake form, and the engineering/data-science team channel pins - [ ] Campaign channel URLs tagged for attribution; intake-queue referrer-source field populated - [ ] DPO and data-steward micro-content (Art. 10 data-governance evidence, DPIA trigger assessment, deletion-capability requirements) deployed for every Critical or High AI data archetype active in the inventory - [ ] Feedback channel for new data sources with documented ≤5 BD triage SLA
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| Shadow-data-in-AI disclosures per quarter (amnesty path, intake queue tagged "amnesty") | ___ | ___ | rises Q1–Q2 then trends down | ☐ | |
| Intake submissions attributable to campaign channels | ___% | ___% | ≥30% of net-new intakes | ☐ | |
| % data-handler workforce with current-year AI-data-assurance literacy completion | ___% | ___% | ≥95% | ☐ | |
| Campaign content cadence met | ___ | ___ | ≥1 piece/month | ☐ |
Metric Collection Guidance: - Shadow data disclosures: Count of intake submissions tagged "amnesty" per quarter. Expect increase in Q1–Q2 post-launch (awareness working) and decrease thereafter (sanctioned catalog adoption reducing ungated use). Source: intake queue analytics. - Campaign attribution: Percentage of net-new intake submissions arriving via tagged campaign channel links or form-referrer fields. Source: intake queue referrer field; UTM tracking or equivalent. - Data-handler literacy completion: Same methodology as Q1.1. Shared metric. - Content cadence: Count of published shadow-data-in-AI content pieces per calendar month. Source: content calendar or publication log.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No campaign running)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Objective: Deepen practitioner skill through scenario-based training from real intake cases, deliver product-line-specific data-handler tracks calibrated to SM-Data L2 risk tiers, and run seasonal shadow-data-in-AI campaigns tied to model-release and data-refresh cycles.
Q2.1: Is there a scenario library of ≥30 anonymized real intake cases powering practitioner training across the org's in-scope data archetypes, with paired calibration exercises showing Critical-tier drift ≤1 classification-tier step and ≤0 DPIA trigger disagreements per sample for two consecutive quarters, including a practitioner capstone requiring three live end-to-end intakes under a senior-reviewer shadow?
Evidence Required: - [ ] Scenario library of ≥30 scenarios documented, each with as-submitted data-asset description, original reviewer decisions (classification label, DPIA trigger determination, SR gaps), any disagreement, and resolved outcome - [ ] Scenarios organized per archetype (training-corpus, retrieval-store, fine-tuning-dataset, embedding-store, prompt/completion-log-corpus) and per TTP cluster (training-data poisoning, training-data leakage, retrieval-poisoning, embedding inversion, prompt injection via retrieved documents) - [ ] Paired calibration exercises in place: two reviewers score the same scenario independently; debrief facilitated on classification-label delta and DPIA trigger delta - [ ] Critical-tier calibration drift records for two consecutive quarters showing ≤1 classification-tier step and ≤0 DPIA trigger disagreements per sample - [ ] Practitioner capstone in place: practitioners run three live intakes with senior-reviewer shadow and produce passing classification record, lineage review, and DPIA scoping note - [ ] Scenario library reviewed quarterly with retirement criteria for stale scenarios documented
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| Reviewer calibration drift on Critical-tier scenarios, avg classification-tier delta | ___ | ___ | ≤1 classification-tier step | ☐ | |
| Reviewer calibration drift on Critical-tier scenarios, avg DPIA trigger disagreements | ___ | ___ | ≤0 per sample | ☐ | |
| % Critical/High-tier data assets with ≥1 team member trained on applicable product-line track | ___% | ___% | 100% | ☐ | |
| % training content refreshed in last 90 days | ___% | ___% | ≥80% | ☐ |
Metric Collection Guidance:
- Critical-tier calibration drift: Quarterly calibration exercise focused on Critical-tier scenarios (PII-bearing training corpora, special-category fine-tuning datasets). Record classification labels and DPIA trigger determinations independently; calculate mean absolute deviation. Source: calibration debrief facilitator records.
- Product-line track coverage: LMS completion records for product-line tracks cross-referenced against SM-Data L2 inventory Critical/High-tier assets. Formula: assets_with_trained_practitioner / total_Critical_High_assets × 100
- Content freshness: LMS content-management change log; count modules updated within the last 90 days.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No scenario library in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q2.2: Have product-line-specific data-handler tracks (clinical AI, fintech AI, developer-tool AI, consumer AI, or equivalent for the org's product mix) been delivered to ≥1 trained practitioner per Critical/High-tier data asset, each track covering the data archetypes and governance obligations specific to that product line, with team-level coverage tracked in the SM-Data inventory?
Evidence Required: - [ ] Clinical AI track developed: PHI training corpora (HIPAA minimum-necessary, BAA verification), GDPR Art. 9 health-data basis verification, DPIA composition for clinical training data, embedding-store inversion risk for medical records, retrieval-poisoning risk in clinical RAG pipelines - [ ] Fintech AI track developed: PCI cardholder data in training corpora, PCI-DSS 3.4 controls, FINRA/SEC model-input retention, GDPR Art. 6 lawful basis for financial data, prompt/completion log retention for regulatory record-keeping - [ ] Developer-tool AI track developed: source-code training corpora (customer IP, trade secrets), fine-tuning dataset lineage and license compatibility, embedding stores of code (inversion and IP-exposure risk), prompt/completion log corpora from coding assistants (retention and secondary-use restriction) - [ ] Consumer AI track developed: inference input streams with end-user personal data, consent-basis verification for logged interactions, opt-out enforcement, GDPR Art. 22 automated-decisioning safeguards, cross-border transfer risk - [ ] Mandatory enrollment policy: any team owning a Critical or High-tier data asset in the applicable product line must have ≥1 trained practitioner - [ ] LMS completion records cross-referenced with SM-Data inventory showing ≥1 trained practitioner per Critical/High-tier data asset
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| % Critical/High-tier data assets with ≥1 team member trained on applicable product-line track | ___% | ___% | 100% | ☐ | |
| % workforce literacy completion maintained | ___% | ___% | ≥95% | ☐ | |
| Shadow-data-in-AI campaign behavior-target achievement rate | ___% | ___% | ≥70% of campaigns | ☐ | |
| % training content refreshed in last 90 days | ___% | ___% | ≥80% | ☐ |
Metric Collection Guidance:
- Product-line track coverage: LMS module completion records filtered to product-line track modules joined against SM-Data L2 asset inventory by owning team. Formula: assets_with_trained_practitioner / total_Critical_High_assets × 100
- Workforce literacy maintained: Ongoing LMS current-year completion rate; same methodology as Q1.1.
- Campaign behavior-target achievement: For each campaign with a pre-set behavior target (e.g., reduce ungated fine-tuning dataset uploads by 50%), record whether post-campaign measurement met target.
- Content freshness: LMS content management change log; modules with last-updated date within 90 days of assessment.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No product-line data-handler tracks in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q2.3: Are shadow-data-in-AI campaigns running on a seasonal, behavior-driven cadence tied to model-release windows, data-refresh cycles, post-incident moments, and hiring surges, with pre-set measurable behavior targets, post-campaign measurement, ≥70% of campaigns hitting their target, and ≥80% of training content updated in the last 90 days?
Evidence Required: - [ ] At least 2 behavior-driven campaigns run in the last 12 months, each with a documented pre-measured behavior target (e.g., "reduce ungated fine-tuning dataset uploads by 50% in Q3") - [ ] Post-campaign measurement records for each campaign showing whether the behavior target was met - [ ] Campaign scheduling aligned to observed shadow-data risk windows (model-release windows, data-refresh cycles, post-external-incident moments, hiring surges) - [ ] Amnesty windows running alongside campaigns with attribution tracking - [ ] Campaign redesign process: campaigns missing behavior targets by >20% are redesigned - [ ] Content change log showing ≥80% of training modules updated in last 90 days
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| Shadow-data-in-AI campaign behavior-target achievement rate | ___% | ___% | ≥70% of campaigns hit target | ☐ | |
| % training content refreshed in last 90 days | ___% | ___% | ≥80% | ☐ | |
| Reviewer calibration drift on Critical-tier scenarios | ___ | ___ | ≤1 classification-tier step, ≤0 DPIA trigger disagreements | ☐ | |
| % workforce literacy completion maintained | ___% | ___% | ≥95% | ☐ |
Metric Collection Guidance: - Campaign behavior-target achievement: Post-campaign measurement comparing pre-campaign baseline to post-campaign state for each behavior target. Source: intake queue analytics, data-pipeline monitoring, or equivalent behavioral signal. - Content freshness: LMS content management change log; count modules with last-updated date in the 90-day window preceding assessment date. - Calibration drift: Same methodology as Q2.1. - Workforce literacy: Same methodology as Q1.1.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No behavior-driven campaigns in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Objective: Operate continuous calibration at scale, externalize the AI-data-assurance curriculum and reviewer rubric as industry-shared artifacts, and contribute to emerging AI-data-handler certification pathways.
Q3.1: Has the practitioner curriculum, anonymized scenario library, and reviewer rubric been published externally (CSA AI Safety Initiative, IAPP AI data-governance track, OpenSSF AI, DAMA, or sector ISAC) with documented adoption, citations, forks, or direct acknowledgment, and do external community contributions loop back into internal content within 30 days?
Evidence Required: - [ ] Workforce AI-data-assurance literacy module published externally (learning objectives, assessment questions, reference-card template covering the seven archetypes and five data-specific TTPs) - [ ] Practitioner curriculum published externally (module outlines, per-archetype reviewer job aids, DPIA composition guide for AI training data, lineage-verification checklist, embedding-inversion risk assessment guide) - [ ] Anonymized scenario library published (scenario format, per-archetype examples including Clinical AI/Fintech AI/Developer-Tool AI/Consumer AI tracks, calibration debrief format) - [ ] Reviewer rubric published (classification-label criteria, DPIA-trigger determination scoring, lineage-verification scoring, SR-gap-list completeness scoring) - [ ] External adoption evidence: citations, forks/downloads, direct adoption acknowledgment from ≥1 other organization - [ ] Process documented for external contributions to flow back into internal content within 30 days
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| External adoption, citations, forks, downloads of curriculum/scenario library/rubric artifacts | 0 | ___ | tracked, trending up | ☐ | |
| % Critical-tier data reviewers holding an external AI-assurance or AI-data-governance credential | 0% | ___% | ≥50% by year 2 of L3 (where credential exists) | ☐ | |
| Monthly live calibration cadence met | ___ | ___ | monthly, on calendar | ☐ | |
| ATLAS TTP contributions or confirmations per year (training-data poisoning, retrieval-poisoning, embedding inversion) | 0 | ___ | ≥1 where novel observations exist | ☐ |
Metric Collection Guidance:
- External adoption: Repository fork/download counts; citation tracker (Google Scholar, IAPP, CSA publication references); direct outreach acknowledgment records. Tracked quarterly.
- External credentials: HR credential registry cross-referenced with Critical-tier data reviewer list. Credentials in scope: CSA AI Safety, ISACA AI, IAPP AI data-governance certification, CIPP/E with AI extension, sector-specific ISAC credentials. Formula: credentialed_Critical_tier_reviewers / total_Critical_tier_reviewers × 100
- Live calibration cadence: Calendar entries confirming monthly calibration rounds completed; facilitator sign-off records.
- ATLAS contributions: ATLAS GitHub contribution history or MITRE working group correspondence for data-domain techniques (training-data poisoning, retrieval-poisoning, embedding inversion). Source: contribution log.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No external publication in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q3.2: Is a monthly live calibration cadence operating, each round using a current anonymized data-asset intake from the live queue, independent reviewer scoring of classification label/DPIA trigger/primary TTP/top-3-SR-gaps, drift reported to the program sponsor, with calibration results feeding the scenario library within 30 days and ≥50% of Critical-tier data reviewers holding an external credential where one exists?
Evidence Required: - [ ] Monthly calibration calendar entries confirmed for last 12 months (or since L3 initiation) - [ ] Per-round calibration records: anonymized intake used, reviewer cohort, independent scoring results (classification label, DPIA trigger, primary TTP), drift calculation, facilitator debrief notes - [ ] Drift reported to program sponsor each month with trend over last quarter - [ ] Process documented and evidenced for adding new scenarios to the library within 30 days of calibration rounds revealing drift - [ ] Individual reviewer coaching records for reviewers with persistent drift on specific archetype types - [ ] Credential registry showing ≥50% of Critical-tier data reviewers credentialed where external credentials exist
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| Monthly live calibration cadence met | ___ | ___ | monthly, on calendar | ☐ | |
| % Critical-tier data reviewers holding external AI-assurance or AI-data-governance credential | 0% | ___% | ≥50% (where credential exists) | ☐ | |
| Calibration results feeding scenario library within 30 days (% of drift-revealing rounds actioned) | ___% | ___% | 100% | ☐ | |
| ATLAS data-domain TTP contributions or confirmations per year | 0 | ___ | ≥1 where novel observations exist | ☐ |
Metric Collection Guidance: - Live calibration cadence: Program operations calendar; facilitator sign-off records per round. Count calendar months with a completed calibration round in the last 12 months. - External credentials: HR credential registry; count of Critical-tier data reviewers with a recognized AI-data-governance credential divided by total Critical-tier data reviewer count. - Scenario library pipeline: Change log of scenario library; count calibration rounds where drift was identified; count of those rounds that resulted in a new scenario added within 30 days. - ATLAS contributions: ATLAS submission records for data-domain techniques. Source: ATLAS contribution log maintained by program lead.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No continuous live calibration in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q3.3: Does the program contribute ≥2 substantive artifacts per year to industry AI-data-handler certification or curriculum working groups (CSA AI Safety, ISACA AI, IAPP AI data-governance, DAMA AI data-management, CIPP/E extensions for AI data processing), and ≥1 MITRE ATLAS data-domain TTP contribution or confirmation per year where novel observations exist?
Evidence Required: - [ ] At least 2 substantive contributions per year to industry AI-data-handler certification or curriculum working groups, documented with contribution artifact, working group name, and date - [ ] At least 1 MITRE ATLAS data-domain TTP contribution or confirmation per year where novel observations exist (training-data poisoning, retrieval-poisoning, or embedding inversion; submission artifact, ATLAS correspondence, or confirmed technique instance) - [ ] Org's practitioner capstone aligned with certification-grade rubrics where external credentials exist - [ ] Reviewer external-credential pursuit supported: study resources, exam fee reimbursement, time allocation policy - [ ] Process documented for external working-group outputs to update internal curriculum within 30 days
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| Contributions to industry AI-data-handler certification/curriculum working groups per year | 0 | ___ | ≥2 substantive | ☐ | |
| ATLAS data-domain TTP contributions or confirmations per year | 0 | ___ | ≥1 where novel observations exist | ☐ | |
| % Critical-tier data reviewers holding external credential | 0% | ___% | ≥50% by year 2 of L3 (where credential exists) | ☐ | |
| External adoption of curriculum artifacts (citations, forks, downloads) | 0 | ___ | tracked, trending up | ☐ |
Metric Collection Guidance: - Industry contributions: Contribution log maintained by program lead; each entry includes contribution type, working group name, submission date, acceptance or publication status. - ATLAS data-domain contributions: MITRE ATLAS GitHub pull requests or working-group submissions for data-specific techniques (training-data poisoning, retrieval-poisoning, embedding inversion). Source: ATLAS contribution log. - External credentials: Same methodology as Q3.2. - External adoption: Repository analytics, citation tracker, working-group acknowledgment records. Trend tracked quarterly.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No industry certification contributions)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
| Level | Q1 | Q2 | Q3 | Avg | Level Achieved? |
|---|---|---|---|---|---|
| L1 | ___ | ___ | ___ | ___ | ☐ Yes ☐ No |
| L2 | ___ | ___ | ___ | ___ | ☐ Yes ☐ No |
| L3 | ___ | ___ | ___ | ___ | ☐ Yes ☐ No |
Practice Maturity Statement:
The organization's EG-Data practice is at Level ___ with an average score of ___.
Document Version: HAIAMM v3.0 Practice: Education & Guidance (EG) Domain: Data Last Updated: 2026-05-15 Author: Verifhai
Instructions: