Assessment questionnaire for measuring maturity. Answer each question honestly based on current, implemented practices.
Source of truth:
../practices/EG-Software-OnePager.md| Canonical framing:../HAIAMM-v3.0-Framing.md§8 / §12
Practice: Education & Guidance (EG) Domain: Software Purpose: Assess organizational maturity in building AI-assurance literacy for the engineering workforce and deep practitioner skills for the reviewer population performing threat modeling, secure code review, and security testing of AI/HAI software archetypes, with shadow AI in engineering as the primary L1 cultural outcome. Scoring Model: Evidence + Outcome Metrics (see Scoring Methodology below)
| Score | Label | Criteria |
|---|---|---|
| 1.0 | Fully Mature | Evidence complete AND ≥3 outcome metrics meet targets |
| 0.67 | Implemented | Evidence complete AND 2 outcome metrics meet targets |
| 0.33 | Partial | Evidence partially complete OR <2 outcome metrics meet targets |
| 0.0 | Not Implemented | No evidence of the activity in place |
Objective: Deliver foundational AI-assurance literacy to ≥95% of the engineering workforce building AI/HAI software and role-based practitioner training to 100% of the reviewer population, with an active shadow-AI-in-engineering awareness campaign.
Q1.1: Do you have a current-year AI-assurance literacy course (≤20 minutes) completed by ≥95% of engineers building or operating AI/HAI software, covering the seven in-scope archetypes, the four HAI TTPs (EA/AGH/TM/RA) plus prompt injection/training-data leakage/output-integrity regression, the AI AUP rules, and the go-live gate intake process, with content updated within 30 days of any policy or archetype change?
Evidence Required: - [ ] LMS module published covering the seven AI/HAI software archetypes (LLM-integrated apps, agents, RAG pipelines, fine-tune/training workloads, eval harnesses, model-serving services, classical ML models) with org-specific examples - [ ] Module content includes the four HAI TTPs (EA, AGH, TM, RA) in plain language with one concrete engineering example per TTP matched to a relevant archetype - [ ] AI AUP five-rule summary, go-live gate intake process, and before-you-connect decision aid included - [ ] LMS completion report showing current-year completion rate across in-scope engineering headcount - [ ] Named training content owner with documented quarterly review cadence - [ ] Evidence that content was updated within 30 days of last policy, archetype, or compliance map change - [ ] New-hire coverage SLA documented (AI-assurance literacy within 30 days of start)
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| % engineering headcount with current-year AI-assurance literacy completion | ___% | ___% | ≥95% | ☐ | |
| % intake reviewers with completed practitioner training | ___% | ___% | 100% | ☐ | |
| Reviewer calibration drift, avg tier delta across reviewers on shared samples | ___ | ___ | ≤1 tier step | ☐ | |
| Reviewer calibration drift, avg TTP misclassifications per sample | ___ | ___ | ≤2 per sample | ☐ |
Metric Collection Guidance:
- Engineering literacy completion: Pull current-year completion report from LMS filtered to engineers in scope of the AI/HAI software program. Cross-reference with HR headcount for denominator. Formula: completed_count / in-scope_headcount × 100
- Reviewer training completion: LMS report filtered to the intake-approval-permissions group (AppSec reviewers, AI/ML platform engineers, architects, red-teamers). 100% is a pass/fail gate.
- Calibration drift, tier: Quarterly exercise where reviewers independently score the same sample intake. Record each reviewer's tier assignment; calculate mean absolute deviation. Source: calibration debrief facilitator record.
- Calibration drift, TTP misclassifications: Same exercise; count TTP identifications that differ from the facilitated consensus answer per reviewer per sample; average across reviewers.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No AI-assurance literacy training in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q1.2: Has the practitioner population (AppSec reviewers, AI/ML platform engineers, AI-feature architects, red-teamers) completed a role-based training module (~2 hours) covering ATLAS tactics, OWASP LLM/Agentic Top 10, prompt injection patterns, agent goal-hijack scenarios, tool-misuse pattern recognition, training-data poisoning indicators, output-integrity testing, and kill-switch/human-override design, with completion gated on intake-approval permissions and calibration drift inside target for two consecutive quarters?
Evidence Required: - [ ] Practitioner training module published covering all 14 ATLAS tactics applied to the org's archetypes, and OWASP LLM/Agentic Top 10 mapped per archetype - [ ] Module includes prompt injection (direct and indirect), agent goal-hijack scenarios (AGH+RA combined), tool-misuse pattern recognition (TM TTP), training-data poisoning indicators, and output-integrity testing - [ ] Kill-switch and human-override design module included covering EU AI Act Art. 26 at the engineering level - [ ] Completion gating enforced: intake-approval permissions provisioned only after LMS training completion confirmed - [ ] Calibration exercise records from two consecutive quarters showing drift inside target (≤1 tier step, ≤2 TTP misclassifications per sample) - [ ] Per-archetype reviewer job aids published (one per archetype: agent, RAG pipeline, fine-tune) - [ ] Quarterly calibration session scheduled with facilitator and attendance records
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| % intake reviewers with completed practitioner training | ___% | ___% | 100% | ☐ | |
| Reviewer calibration drift, avg tier delta on shared samples | ___ | ___ | ≤1 tier step | ☐ | |
| Reviewer calibration drift, avg TTP misclassifications per sample | ___ | ___ | ≤2 per sample | ☐ | |
| Reviewer throughput, intakes closed per reviewer per week (post-training trend) | ___ | ___ | trending up | ☐ |
Metric Collection Guidance: - Practitioner training completion: LMS completion report filtered to intake-reviewer role group. Source: LMS + access-control system confirming permissions are gated on training. - Calibration drift, tier: Independent scoring of shared sample intakes; mean absolute tier deviation across reviewer cohort. Source: quarterly calibration debrief facilitator records. - Calibration drift, TTP misclassifications: Count of TTP identification discrepancies per sample versus facilitated consensus; averaged across reviewers. Source: calibration debrief records. - Reviewer throughput: Intake queue analytics, intakes closed per reviewer per week before and after training rollout. Source: intake queue system (Jira, ServiceNow, or equivalent).
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No practitioner training in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q1.3: Is a shadow-AI-in-engineering awareness campaign running with at least monthly content, a visible amnesty path linked from the AUP and intake form, measurable attribution of intake submissions and amnesty disclosures to campaign channels, and deployer-duty micro-content for every customer-facing or decision-affecting AI/HAI archetype active in the inventory?
Evidence Required: - [ ] Campaign launch documented: executive sponsor message naming shadow AI in engineering, amnesty window announced, sanctioned-archetype catalog published - [ ] Monthly content cadence evidenced: content calendar or publication log showing at least one shadow-AI-in-engineering piece per month - [ ] Amnesty path linked from the AI AUP document, the intake form, and the engineering Slack/Teams channel pins - [ ] Campaign channel URLs tagged for attribution; intake-queue referrer-source field populated showing campaign attribution rate - [ ] Deployer-duty micro-content (Art. 26 human oversight, Art. 50 disclosure, logging baseline) deployed for every customer-facing or decision-affecting AI/HAI archetype - [ ] Feedback channel established for archetype and SDK nominations with documented ≤5 BD triage SLA
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| Shadow AI disclosures per quarter (amnesty path, intake queue tagged "amnesty") | ___ | ___ | rises Q1–Q2 then trends down | ☐ | |
| Intake submissions attributable to campaign channels | ___% | ___% | ≥30% of net-new intakes | ☐ | |
| % engineering headcount with current-year AI-assurance literacy completion | ___% | ___% | ≥95% | ☐ | |
| Campaign content cadence met | ___ | ___ | ≥1 piece/month | ☐ |
Metric Collection Guidance: - Shadow AI disclosures: Count of intake submissions tagged "amnesty" per quarter. Expect increase in Q1–Q2 post-launch (awareness working) and decrease thereafter (sanctioned catalog adoption reducing ungated use). Source: intake queue analytics. - Campaign attribution: Percentage of net-new intake submissions arriving via tagged campaign channel links or form-referrer fields. Source: intake queue referrer field; UTM tracking or equivalent. - Literacy completion: Same methodology as Q1.1. Shared metric. - Content cadence: Count of published shadow-AI-in-engineering content pieces per calendar month. Source: content calendar or publication log (Confluence, intranet, Slack channel history).
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No campaign running)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Objective: Deepen practitioner skill through scenario-based training from real intake cases, deliver product-line-specific engineering tracks calibrated to SM-Software L2 risk tiers, and run seasonal shadow-AI-in-engineering campaigns tied to release cycles.
Q2.1: Is there a scenario library of ≥30 anonymized real intake cases powering practitioner training across the org's in-scope archetypes, with paired calibration exercises showing Critical-tier drift ≤1 tier step and ≤1 TTP misclassification per sample for two consecutive quarters, including a practitioner capstone requiring three live end-to-end intakes under a senior-reviewer shadow?
Evidence Required: - [ ] Scenario library of ≥30 scenarios documented, each with as-submitted archetype description, original reviewer decisions, any disagreement, and resolved outcome - [ ] Scenarios organized per archetype (agent, RAG pipeline, fine-tune, model-serving) and per TTP cluster (EA-heavy, AGH-heavy, RA-heavy, training-data-leakage-heavy) - [ ] Paired calibration exercises in place: two reviewers score the same scenario independently; debrief facilitated on tier delta and TTP deltas - [ ] Critical-tier calibration drift records for two consecutive quarters showing ≤1 tier step and ≤1 TTP misclassification per sample - [ ] Practitioner capstone in place: practitioners run three live intakes with senior-reviewer shadow and produce passing TA snapshot and SR REM - [ ] Scenario library reviewed quarterly with retirement criteria for stale scenarios documented
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| Reviewer calibration drift on Critical-tier scenarios, avg tier delta | ___ | ___ | ≤1 tier step | ☐ | |
| Reviewer calibration drift on Critical-tier scenarios, avg TTP misclassifications | ___ | ___ | ≤1 per sample | ☐ | |
| % Critical/High-tier artifacts with ≥1 team member trained on applicable product-line track | ___% | ___% | 100% | ☐ | |
| % training content refreshed in last 90 days | ___% | ___% | ≥80% | ☐ |
Metric Collection Guidance:
- Critical-tier calibration drift: Quarterly calibration exercise focused on Critical-tier scenarios (customer-facing agents, fine-tuning on regulated data). Record tier assignments and TTP identifications from each reviewer independently; calculate mean absolute deviation. Source: calibration debrief facilitator records.
- Product-line track coverage: Cross-reference LMS completion records for product-line tracks against SM-Software inventory Critical/High-tier artifacts. Formula: artifacts_with_trained_practitioner / total_Critical_High_artifacts × 100
- Content freshness: Count modules updated within the last 90 days; divide by total module count. Source: LMS content-management change log.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No scenario library in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q2.2: Have product-line-specific engineering tracks (mobile, web/SaaS, ML platform, backend services) been delivered to ≥1 trained practitioner per Critical/High-tier artifact, with each track covering the archetypes and SA reference patterns specific to that product line, and with team-level coverage tracked in the SM-Software inventory?
Evidence Required: - [ ] Four product-line tracks developed: mobile (on-device serving, EA/TM in mobile surface), web/SaaS (AGH via user content, Art. 50 UX), ML platform (fine-tuning pipelines, canary design, no-train verification), backend services (agentic pipelines, RA+EA in long-running sessions, kill-switch architecture) - [ ] Each track paired with the SA reference pattern for the relevant archetype - [ ] Mandatory enrollment policy: any team owning a Critical or High-tier artifact in the applicable product line must have ≥1 trained practitioner - [ ] LMS completion records cross-referenced with SM-Software inventory showing ≥1 trained practitioner per Critical/High-tier artifact - [ ] Training attendance tracked per artifact monthly and reported to program sponsor - [ ] Avoided-incident stories documented where practitioner training enabled a risk to be caught at intake
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| % Critical/High-tier artifacts with ≥1 team member trained on applicable product-line track | ___% | ___% | 100% | ☐ | |
| % workforce literacy completion maintained | ___% | ___% | ≥95% | ☐ | |
| Shadow-AI campaign behavior-target achievement rate | ___% | ___% | ≥70% of campaigns | ☐ | |
| % training content refreshed in last 90 days | ___% | ___% | ≥80% | ☐ |
Metric Collection Guidance:
- Product-line track coverage: LMS module completion records filtered to product-line track modules joined against SM-Software L2 artifact inventory by owning team. Formula: artifacts_with_trained_practitioner / total_Critical_High_artifacts × 100
- Workforce literacy maintained: Ongoing LMS current-year completion rate; same methodology as Q1.1.
- Campaign behavior-target achievement: For each campaign with a pre-set behavior target, record whether post-campaign measurement met target. Formula: campaigns_meeting_target / total_campaigns × 100
- Content freshness: LMS content management change log; modules with last-updated date within 90 days of assessment date.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No product-line tracks in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q2.3: Are shadow-AI campaigns running on a seasonal, behavior-driven cadence tied to release cycles, OKR planning, hiring surges, and post-incident moments, with pre-set measurable behavior targets, post-campaign measurement, ≥70% of campaigns hitting their target, and ≥80% of training content updated in the last 90 days?
Evidence Required: - [ ] At least 2 behavior-driven campaigns run in the last 12 months, each with a documented pre-measured behavior target (e.g., "reduce ungated LLM SDK imports in the monorepo by 50% in Q3") - [ ] Post-campaign measurement records for each campaign showing whether the behavior target was met - [ ] Campaign scheduling documented and aligned to observed shadow-AI risk windows (release windows, Q1 OKR planning, hiring surges, post-external-incident moments) - [ ] Amnesty windows running alongside campaigns with attribution tracking - [ ] Campaign redesign process: campaigns missing behavior targets by >20% are redesigned - [ ] Content change log showing ≥80% of training modules updated in last 90 days
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| Shadow-AI campaign behavior-target achievement rate | ___% | ___% | ≥70% of campaigns hit target | ☐ | |
| % training content refreshed in last 90 days | ___% | ___% | ≥80% | ☐ | |
| Reviewer calibration drift on Critical-tier scenarios | ___ | ___ | ≤1 tier step, ≤1 TTP mismatch | ☐ | |
| % workforce literacy completion maintained | ___% | ___% | ≥95% | ☐ |
Metric Collection Guidance: - Campaign behavior-target achievement: Post-campaign measurement comparing pre-campaign baseline to post-campaign state for each behavior target. Source: intake queue analytics, code-scanning reports, or equivalent behavioral signal. - Content freshness: LMS content management change log; count modules with last-updated date in the 90-day window preceding assessment date. - Calibration drift: Same methodology as Q2.1. - Workforce literacy: Same methodology as Q1.1.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No behavior-driven campaigns in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Objective: Operate continuous calibration at scale, externalize the AI-assurance curriculum and reviewer rubric as industry-shared artifacts, and contribute to emerging AI-engineering certification pathways.
Q3.1: Has the practitioner curriculum, anonymized scenario library, and reviewer rubric been published externally (CSA AI Safety Initiative, OpenSSF AI, OWASP AI security track, or sector ISAC) with documented adoption, citations, forks, or direct acknowledgment, and do external community contributions loop back into internal content within 30 days?
Evidence Required: - [ ] Workforce AI-assurance literacy module published externally under permissive license or as a consortium deliverable (learning objectives, assessment questions, reference-card template) - [ ] Practitioner curriculum published externally (module outlines, ATLAS tactic coverage matrix, per-archetype reviewer job aids) - [ ] Anonymized scenario library published (scenario format, per-archetype examples, calibration debrief format) - [ ] Reviewer rubric published (tier-assignment criteria, TTP-identification scoring, SR-gap-list completeness scoring) - [ ] External adoption evidence: citations in external publications, forks/downloads in repository, direct adoption acknowledgment from ≥1 other organization - [ ] Process documented for external contributions to flow back into internal content within 30 days
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| External adoption, citations, forks, downloads of curriculum/scenario library/rubric artifacts | 0 | ___ | tracked, trending up | ☐ | |
| % Critical-tier reviewers holding an external AI-assurance or AI-engineering credential | 0% | ___% | ≥50% by year 2 of L3 (where credential exists) | ☐ | |
| Monthly live calibration cadence met | ___ | ___ | monthly, on calendar | ☐ | |
| ATLAS TTP contributions or confirmations per year | 0 | ___ | ≥1 where novel observations exist | ☐ |
Metric Collection Guidance:
- External adoption: GitHub/GitLab fork and download counts; citation tracker (Google Scholar, CSA publication references); direct outreach acknowledgment records. Tracked by program sponsor quarterly.
- External credentials: HR credential registry cross-referenced with Critical-tier reviewer list. Credentials in scope: CSA AI Safety, ISACA AI, OWASP AI-related, sector-specific ISAC credentials where they exist. Formula: credentialed_Critical_tier_reviewers / total_Critical_tier_reviewers × 100
- Live calibration cadence: Calendar entries confirming monthly calibration rounds completed; facilitator sign-off records. Count calendar months with a completed round in the last 12 months.
- ATLAS contributions: ATLAS GitHub contribution history or MITRE working group correspondence confirming submission. Source: program contribution log.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No external publication in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q3.2: Is a monthly live calibration cadence operating, each round using a current anonymized intake from the live queue, independent reviewer scoring of tier/TTPs/top-3-SR-gaps, drift reported to the program sponsor, with calibration results feeding the scenario library within 30 days and ≥50% of Critical-tier reviewers holding an external credential where one exists?
Evidence Required: - [ ] Monthly calibration calendar entries confirmed for last 12 months (or since L3 initiation) - [ ] Per-round calibration records: anonymized intake used, reviewer cohort, independent scoring results, drift calculation, facilitator debrief notes - [ ] Drift reported to program sponsor each month with trend data over last quarter - [ ] Process documented and evidenced for adding new scenarios to the library within 30 days of calibration rounds revealing drift - [ ] Individual reviewer coaching records for reviewers with persistent drift on specific archetype types - [ ] Credential registry showing ≥50% of Critical-tier reviewers credentialed where external credentials exist
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| Monthly live calibration cadence met | ___ | ___ | monthly, on calendar | ☐ | |
| % Critical-tier reviewers holding external AI-assurance or AI-engineering credential | 0% | ___% | ≥50% (where credential exists) | ☐ | |
| Calibration results feeding scenario library within 30 days (% of drift-revealing rounds actioned) | ___% | ___% | 100% | ☐ | |
| ATLAS TTP contributions or confirmations per year | 0 | ___ | ≥1 where novel observations exist | ☐ |
Metric Collection Guidance: - Live calibration cadence: Program operations calendar; facilitator sign-off records per round. Count calendar months with a completed calibration round in the last 12 months. - External credentials: HR credential registry; count of Critical-tier reviewers with a recognized AI-assurance credential divided by total Critical-tier reviewer count. - Scenario library pipeline: Change log of scenario library; count calibration rounds where drift was identified; count of those rounds that resulted in a new scenario added within 30 days. - ATLAS contributions: ATLAS submission records; MITRE working-group correspondence. Source: contribution log maintained by program lead.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No continuous live calibration in place)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
Q3.3: Does the program contribute ≥2 substantive artifacts per year to industry AI-engineering certification or curriculum working groups (CSA AI Safety, ISACA AI, OWASP AI, OpenSSF AI Practitioner path), and ≥1 MITRE ATLAS TTP contribution or confirmation per year where novel observations exist in own-built AI/HAI software?
Evidence Required: - [ ] At least 2 substantive contributions per year to industry AI-engineering certification or curriculum working groups, documented with contribution artifact, working group name, and date - [ ] At least 1 MITRE ATLAS TTP contribution or confirmation per year where novel technique observations exist (submission artifact, ATLAS correspondence, or confirmed technique instance record) - [ ] Org's practitioner capstone aligned with certification-grade rubrics where external credentials exist - [ ] Reviewer external-credential pursuit supported: study resources, exam fee reimbursement, time allocation policy - [ ] Process documented for external working-group outputs to update internal curriculum within 30 days
Outcome Metrics:
| Metric | Baseline | Current | Target | Met? | Notes |
|---|---|---|---|---|---|
| Contributions to industry certification/curriculum working groups per year | 0 | ___ | ≥2 substantive | ☐ | |
| ATLAS TTP contributions or confirmations per year | 0 | ___ | ≥1 where novel observations exist | ☐ | |
| % Critical-tier reviewers holding external credential | 0% | ___% | ≥50% by year 2 of L3 (where credential exists) | ☐ | |
| External adoption of curriculum artifacts (citations, forks, downloads) | 0 | ___ | tracked, trending up | ☐ |
Metric Collection Guidance: - Industry contributions: Contribution log maintained by program lead; each entry includes contribution type, working group name, submission date, acceptance or publication status. - ATLAS contributions: MITRE ATLAS GitHub pull requests, working-group submissions, or confirmed-technique acknowledgments. Source: ATLAS contribution log. - External credentials: Same methodology as Q3.2. - External adoption: Repository analytics (forks, downloads), citation tracker, working-group acknowledgment records. Trend tracked quarterly.
Answer: - ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets) - ☐ Implemented (Evidence complete + 2 metrics meet targets) - ☐ Partial (Evidence partially complete + <2 metrics meet targets) - ☐ Not Implemented (No industry certification contributions)
Evidence Location: _______ Metric Validation Date: ______ Notes: ________
| Level | Q1 | Q2 | Q3 | Avg | Level Achieved? |
|---|---|---|---|---|---|
| L1 | ___ | ___ | ___ | ___ | ☐ Yes ☐ No |
| L2 | ___ | ___ | ___ | ___ | ☐ Yes ☐ No |
| L3 | ___ | ___ | ___ | ___ | ☐ Yes ☐ No |
Practice Maturity Statement:
The organization's EG-Software practice is at Level ___ with an average score of ___.
Document Version: HAIAMM v3.0 Practice: Education & Guidance (EG) Domain: Software Last Updated: 2026-05-15 Author: Verifhai
Instructions: