AI Maturity Index

The three headline scores

GMI — Governance Maturity Index

AI governance maturity on a 0-100 scale. Driven by AI system and use case coverage, control effectiveness, risk treatment, evidence currency, and framework coverage.

CGMI — Cyber Governance Maturity Index

Cybersecurity governance maturity on the same scale, driven by NIST CSF 2.0 and CIS Controls v8 posture, hygiene results, and incident readiness. Populates when Cybersecurity Mode is enabled.

TGP — Total Governance Posture

The weighted combination of GMI and CGMI, giving one number for overall governance standing.

How sub-metrics are computed

Each headline score aggregates a set of sub-metrics, and every sub-metric reads live platform data rather than a manually maintained figure. A sub-metric with no underlying data scores zero rather than being skipped, which is deliberate: an empty register is a real governance gap, not a missing measurement.

• Inventory completeness — registered AI systems and use cases against discovered signals.
• Ownership — records with a named accountable owner.
• Risk coverage — systems and use cases with a scored inherent and residual risk.
• Control effectiveness — controls with current test evidence inside their review cadence.
• Framework coverage — mapped and evidenced requirements per enabled framework.
• Evidence currency — proportion of evidence within its validity window.
• Third-party posture — suppliers with current due diligence and, where required, executed agreements.
• Training completion — assigned training completed and still valid.
• Monitoring — systems with active operation monitoring and thresholds.
• Identity hygiene — non-human identity over-permission and stale credential findings.

Daily snapshots and trends

A scheduled job captures the full metric set once per day, so the dashboard can show trajectory rather than just a current reading. Trend charts cover the trailing twelve months at daily granularity, and the same snapshots feed PowerGRYD's Trend & Trajectory report. Snapshots are immutable — correcting underlying data changes today's score, not last month's.

Reading the dashboard

• Headline tiles show the current score and the change since the previous snapshot.
• Each sub-metric tile links straight to the register that would improve it.
• A sub-metric at zero with a populated register indicates a data problem worth reporting, not just a governance gap.
• Band thresholds are consistent across the platform: Initial, Developing, Defined, Managed, Optimizing.

Improving your score

The fastest gains almost always come from ownership and evidence currency rather than new controls: assigning owners to unowned records and refreshing lapsed evidence moves several sub-metrics at once. After that, close inventory gaps surfaced by AI Discovery, then work framework coverage for the frameworks you are actually assessed against.

Export and reporting

• CSV export of current and historical scores with MM/DD/YYYY HH:MM dates and a RhindonCyber_ filename prefix.
• Branded DOCX maturity report with trend charts, suitable for board packs.
• Scores appear in the executive summary and, for partners, in the QBR report.