AICGA 4-Week Assessment

AI adoption has outpaced AI governance. Copilots, custom agents and machine-learning workloads are already in your environment — often deployed faster than your security and governance controls have adapted. Boards, regulators and auditors are now asking questions most organisations cannot yet answer with evidence: What AI is running? Who can reach it? What data does it touch? Which regulations apply, and are we ready? This assessment answers those questions in four weeks. Phakamo Tech's security engineering team conducts a fixed-scope assessment of your AI estate on the Microsoft cloud. Working read-only against your telemetry — Microsoft Entra ID, Microsoft Defender, Microsoft Purview, Azure and Microsoft 365, including Microsoft Copilot and Azure AI workloads — we evaluate more than 120 controls across eight domains: AI governance and accountability; model and agent security; identity and access for AI workloads; data protection; threat detection and response; regulatory readiness; secure AI development; and third-party risk. Every finding is evidence-backed and mapped to recognised frameworks — NIST AI RMF, ISO/IEC 42001, CIS Controls and the Microsoft Cloud Security Benchmark — with regulatory readiness assessed against POPIA and the EU AI Act.

How the four weeks run • Week 1 — Discover: stakeholder and scope workshops, AI and data estate inventory, read-only telemetry onboarding. • Weeks 2–3 — Assess and Analyse: control evaluation, AI model and agent risk review, evidence capture, maturity scoring and gap analysis. • Week 4 — Roadmap: prioritised 90-day and 12-month remediation plan, executive report, board briefing and handover.

What you receive • A quantified AI security and governance maturity score across all eight domains • A risk-ranked findings register with evidence for every finding • A regulatory readiness map giving your board and auditors a defensible position • A prioritised 90-day and 12-month remediation roadmap your team can execute • An executive report and briefing designed for board and audit-committee consumption

Need a different depth? Two companion engagements are also listed on Azure Marketplace: a 2-Week Assessment (single tenant, 40 priority controls, executive briefing and 90-day quick-win plan) for a rapid defensible baseline, and an 8-Week Assessment (multi-tenant and multi-entity estates, governance operating model design, threat-led validation and a board and regulator-ready evidence pack) for group structures. We will recommend the right fit during scoping — many customers start with two weeks and extend.

Why Phakamo Tech We are a South African security engineering firm serving national departments, state-owned entities, municipalities and regulated enterprises. Assessments are delivered under strict data-handling terms: evidence is processed within your jurisdiction, access is read-only, least-privilege and time-boxed, and nothing in your environment is changed without written approval.

What happens when you select Contact Me

We respond within one business day and offer a scoping call within three. The call is free, carries no commitment, and ends with a clear recommendation on tier and a fixed written proposal within five business days. The price shown is an estimate; your proposal states the final fixed price before you commit to anything.