Enora Cyber ยท AI Readiness Assessment

Example Ltd

AI Readiness AssessmentReport 2026-10-20
Summary

Partly ready: no blocking findings, but significant actions remain.

Identity and the cloud platform are in place. The content has not been tidied up: nothing is labelled as confidential, and content is shared anonymously without oversight. A pilot is justifiable now; a broad rollout should wait.

An adviser at Enora has quality-assured the whole report before delivery, and reviewed the recommendations and the findings that need professional assessment in detail.

62
control points assessed
16
already in place
37
recommended improvements
0
must be resolved before AI is adopted
The overall picture

Status by area

In place Partly in place Should be improved Needs checking Not assessed

Classification

0 in place2 should be improved

Cloud platform and licence

4 in place1 partly

Devices and apps

2 in place4 partly1 should be improved

Governance and organisation

0 in place2 partly4 should be improved

Identity and access

6 in place2 partly1 should be improved

Lifecycle

1 in place4 should be improved1 needs checking

Logging and insight

1 in place1 partly1 should be improved

Protection of data

1 in place3 partly1 should be improved

Sharing and access to content

1 in place6 partly1 should be improved2 needs checking
Most important to improve

Three of the 15 recommended improvements

Should be improvedUser consent to apps High risk

Users can give all apps access themselves (Microsoft's older setting). This opens the door to shadow AI, and to phishing where the attacker asks for consent instead of a password.

Our recommendation: Limit consent to apps with low risk, or let only administrators give consent.
Should be improvedShare of public Microsoft 365 groups and Teams High risk

Requirement: Passed: no public groups or Teams. Partly in place: at most 10%.

31 of 96 groups are public (32%). All content in these is available to all employees and will appear in AI answers.

Our recommendation: Set groups to private unless openness is a deliberate choice; consider the default setting.
Should be improvedSensitivity labels Medium risk

No sensitivity labels. Without classification, AI access cannot be controlled at content level.

Our recommendation: Establish a simple label set (3 to 5 levels) as the first Purview measure. Sensitivity labels requires Microsoft 365 Business Premium or E3, or Office 365 E3, which no users in the Microsoft 365 environment have been assigned.