Switch on Copilot. Not your data exposure.
Copilot answers with whatever a user can open. The Readiness Index scores your tenant across seven weighted pillars, flags the gate controls that must pass first, and turns every gap into a phased roadmap mapped to NCA ECC, PDPL and SAMA CSF.
If a user can open it, Copilot can surface it.
Copilot does not create new access. It makes existing access instant. The risks that sat quietly in SharePoint, Entra ID and guest lists become one prompt away.
One session. A roadmap you can fund.
- 01Answer 28 questionsIT, security, data protection and the business sponsor answer together, each on a four-level scale.
- 02Watch the score moveThe weighted score, maturity level and gate controls update with every answer.
- 03Get the phased roadmapEvery answer below level 4 becomes an action, placed in the phase that unblocks it.
- 04Share with the sponsorExport a PDF report, the Excel answer log, or a summary ready to paste into email.
Seven pillars, weighted by risk.
Data governance carries the most weight because it is where Copilot exposure happens first.
| Pillar | Weight | What it checks |
|---|---|---|
| LICLicensing & M365 foundation | 10% | Copilot-eligible licences, cloud adoption, Microsoft 365 Apps currency and Teams meeting policy. |
| IDNIdentity & access | 15% | MFA and Conditional Access, Entra ID hygiene, guest governance and managed devices. |
| DATData governance & oversharing | 20% | Oversharing in SharePoint and OneDrive, sensitivity labels, Purview DLP and stale content. |
| SECSecurity & regulatory | 15% | Regulatory mapping, residency approval, AI audit logging and insider risk protection. |
| VALUse cases & business value | 15% | Prioritised use cases, executive sponsorship, ROI baseline and Arabic workflows. |
| PPLPeople, skills & adoption | 15% | AI literacy, champions network, shadow AI discovery and an acceptable use policy. |
| GOVAI governance & extensibility | 10% | Responsible AI framework, Copilot Studio agent governance, connectors and rollout gates. |
A score, a level, and the order to fix things in.
Pillar scores against the 75% pilot target. Sample data.
Mapped to the rules you answer to.
The security and governance pillars check that Copilot use is mapped to Saudi and GCC obligations and approved by your DPO or risk committee before rollout.
How is the score calculated?
Each pillar score is the average answer level, rescaled from 0 to 100. The overall score is the weighted mean: data governance 20%, identity, security, value and people 15% each, foundation and AI governance 10% each.
What is a gate control?
Four questions decide whether Copilot can be deployed at all: eligible licences, MFA, oversharing and data residency approval. Any of them answered at level 1 caps the result at level 2, whatever the total.
Who should take part?
The Microsoft 365 owner, identity and security leads, the data protection officer and the business sponsor. Answers should rest on evidence from the tenant, not opinion.
Is it available in Arabic?
Yes. Every question, recommendation and export switches to Arabic with a right-to-left layout.
Start with the assessment. Leave with a roadmap.
Run it with your team, or book a facilitated session with a Next Step Microsoft specialist.