HSCC AI Cyber Governance
Maturity Assessment

Cognome | HSCC AI Cyber Governance Maturity Assessment

Scored against the HSCC Health Industry AI Cyber Governance Framework Implementation Guide (May 2026) — Core Assessment (Appendix C), plus an optional Extended Assessment

What this is

This tool operationalizes the 5-point maturity scale defined in Appendix C of the HSCC AI Cyber Governance Framework Implementation Guide. It assesses your organization's AI cyber governance program across the three objectives HSCC defines: AI Cybersecurity Governance Framework, Regulatory Alignment, and Standards & Compliance Mapping. An optional Extended Assessment is also available, covering additional domains from the body of the same Implementation Guide — Ethics, Security, Resilience, and Transparency — for organizations that want to go further than Appendix C's core scope. It's additive, not a change to what Appendix C itself covers.

How to use it

1. Assemble a cross-functional assessment team (IT/security, clinical leadership, compliance, legal, privacy, AI Governance Committee) before scoring — no single function should score in isolation, per HSCC guidance.
2. Go to each of the three Objective tabs. For each control statement, select the maturity level (1–5) that best reflects current, documented practice — not intent or plans.
3. Where evidence is ambiguous between two levels, HSCC's rule applies: assign the LOWER score unless there is documented evidence the higher level is substantially met.
4. Use the Evidence field to record what document, system, or artifact supports the score (inventory record, charter, audit report, crosswalk, dashboard, etc.); use Notes for working notes that evolve as you progress toward a higher maturity level.
5. The Maturity Summary tab calculates each objective score automatically and applies HSCC's conservative scoring rule: overall maturity = the LOWEST of the three objective scores.
6. Use the Gap & Remediation Log to document gaps below your target maturity level, with owners and timelines, per HSCC Appendix C Step 6. (The optional Extended Assessment has its own separate Extended Gap Log.)

This conservative-minimum principle governs the Core Assessment's three objectives above. The optional Extended Assessment mirrors the same principle across its own four domains, kept as a separate summary — the two scores are never blended.

Start Here

Score your AI system's risk tier, then jump into the assessment.

Risk tier checklist (Appendix F)

Sourced from Appendix F of the HSCC Implementation Guide, not invented for this tool. Answer all 5 questions for your AI system to calculate its risk tier and the recommended minimum governance maturity before deployment.

If your AI portfolio spans multiple systems, answer for your single highest-risk system.

Navigate

Source: HSCC Health Industry AI Cyber Governance Framework Implementation Guide, May 2026 — Core Assessment: Appendix C (Maturity Model), Appendix D (AI Autonomy Levels), and Appendix F (Risk Tier Classification). Extended Assessment: additional domain guidance from the body of the same Implementation Guide (see the Reference tab for page citations); this is optional and additive, not a change to what Appendix C itself covers. This tool is an independent implementation tool built on the publicly published HSCC framework and is not an HSCC work product.

Objective 1: AI Cybersecurity Governance Framework

Inventory, committee structure, board oversight, lifecycle management, NHI/agentic controls, incident response, and supply chain risk

Score each control area independently. HSCC rule: where evidence is ambiguous between two levels, assign the LOWER score unless the higher level is substantially documented.

(See Implementation Guide, p. 57 for full definitions and evidence examples.)

HSCC scores each objective as a single 1–5 rating: the lowest of its control-area scores. This tool shows the control-area breakdown so gaps are visible at a granular level, consistent with that same conservative rule.

Objective 2: Regulatory Alignment

HIPAA, FDA SaMD/PCCP, state law, post-market surveillance, and liability/insurance alignment for AI

Score each control area independently. HSCC rule: where evidence is ambiguous between two levels, assign the LOWER score unless the higher level is substantially documented.

(See Implementation Guide, p. 57 for full definitions and evidence examples.)

HSCC scores each objective as a single 1–5 rating: the lowest of its control-area scores. This tool shows the control-area breakdown so gaps are visible at a granular level, consistent with that same conservative rule.

Objective 3: Standards & Compliance Mapping

NIST AI RMF, OWASP LLM Top 10, MITRE ATLAS, ISO/IEC 42001 family, and clinical safety standards alignment

Score each control area independently. HSCC rule: where evidence is ambiguous between two levels, assign the LOWER score unless the higher level is substantially documented.

(See Implementation Guide, p. 58 for full definitions and evidence examples.)

HSCC scores each objective as a single 1–5 rating: the lowest of its control-area scores. This tool shows the control-area breakdown so gaps are visible at a granular level, consistent with that same conservative rule.

AI Cyber Governance — Maturity Summary

Auto-calculated from Objective 1–3 | Format aligned to HSCC Appendix K board reporting template

1. Governance Objective Scores

HSCC's framework favors the lowest-score (conservative) metric as your official maturity level — that's the HSCC Score. The Cognome Score (average) is shown alongside it because incremental improvement in a non-lowest-scoring control area won't move your HSCC Score, but is still real progress worth seeing.

2. Deployment Readiness Check

Driven by the Appendix F risk tier checklist you completed on the Start Here tab. Per HSCC: High Risk systems (clinical diagnostics) require at least Maturity Level 4 before deployment, while Low Risk (administrative) systems may accept Level 2.

Source: HSCC Health Industry AI Cyber Governance Framework Implementation Guide, May 2026, Appendix C and Appendix K. Independent implementation tool, not an HSCC work product.

Ready to export your results? Go to Export & Print.

Gap & Remediation Log

Per HSCC Appendix C, Step 6: document Core Assessment gaps below target maturity with evidence, owner, timeline, and success criteria. (Extended Assessment gaps have their own separate Extended Gap Log.)

Tip: prioritize gaps in the objective with the lowest score first — HSCC’s conservative scoring rule means that objective sets your overall maturity ceiling regardless of strength elsewhere.

Ethics

Bias and fairness testing, clinical ethics oversight, and explainability in clinical contexts

Extended assessment domain — not part of HSCC's three core Governance Objectives. Cognome-authored content.

This domain scores as a single 1–5 rating: the lowest of its control-area scores, mirroring HSCC's conservative principle for the Core objectives. This tool shows the control-area breakdown so gaps are visible at a granular level.

Security

Vulnerability and patch management, adversarial testing, AI data quality and retention, vendor AI risk, and fourth-party risk

Extended assessment domain — not part of HSCC's three core Governance Objectives. Cognome-authored content.

This domain scores as a single 1–5 rating: the lowest of its control-area scores, mirroring HSCC's conservative principle for the Core objectives. This tool shows the control-area breakdown so gaps are visible at a granular level.

Resilience

AI dependency assessment, manual fallback procedures, business continuity, and workforce training

Extended assessment domain — not part of HSCC's three core Governance Objectives. Cognome-authored content.

This domain scores as a single 1–5 rating: the lowest of its control-area scores, mirroring HSCC's conservative principle for the Core objectives. This tool shows the control-area breakdown so gaps are visible at a granular level.

Transparency

Patient notification, patient data rights, and patient AI disclosure

Extended assessment domain — not part of HSCC's three core Governance Objectives. Cognome-authored content.

This domain scores as a single 1–5 rating: the lowest of its control-area scores, mirroring HSCC's conservative principle for the Core objectives. This tool shows the control-area breakdown so gaps are visible at a granular level.

Extended Maturity Summary

A second, additive summary covering the four Extended domains (Ethics, Security, Resilience, Transparency) only — not a replacement or correction of the original Maturity Summary. No blended Core+Extended score exists anywhere in this tool.

Extended Domain Scores

Same principle as the Core Maturity Summary: the lowest-score (conservative) metric is each domain's official score. The Cognome Score (average) is shown alongside it because incremental improvement in a non-lowest-scoring control area is still real progress worth seeing, even though it won't move the domain's lowest-score metric.

Extended Gap Log

Cognome-authored companion to the Core Gap & Remediation Log — document gaps below target maturity for the Extended domains (Ethics, Security, Resilience, Transparency), with evidence, owner, timeline, and status.

Tip: prioritize gaps in the domain with the lowest score first — the same conservative-scoring logic used for Core applies here, so that domain sets the Extended overall maturity ceiling regardless of strength elsewhere.

Export & Print

Save a copy of your completed assessment.

These exports include your scores and notes from all three Objectives, plus the Gap & Remediation Log — not just the Maturity Summary page.

Runs entirely in your browser — nothing is uploaded or sent to Cognome.

Looking to print the HSCC Reference material instead? Go to the Reference tab.

HSCC Reference — Appendix C & D

Source: HSCC AI Cyber Governance Framework Implementation Guide, May 2026, pages 56–60

Appendix C: Maturity Model — Overview

Governance effectiveness is assessed on a 5-point scale:

(See Implementation Guide, p. 56 for full definitions and evidence examples.)

How to Conduct a Maturity Assessment (HSCC’s 7 steps)

1. Assemble the Assessment Team. Cross-functional team: IT/security, clinical leadership, compliance, legal, privacy, AI Governance Committee. No single function should score in isolation.
2. Define Assessment Scope. Enterprise level, by business unit, or by AI risk tier. Score separately by risk tier where the AI portfolio is diverse.
3. Gather Evidence. Documentation, artifacts, and data for each objective — inventory records, policies, approval workflows, audit reports, crosswalks, training records, dashboards, incident logs. Scores should be based on demonstrated, documented practice — not intent or plans.
4. Score Each Objective. Score 1 to 5 based on the level description that best fits current state. Where the organization falls between two levels, assign the LOWER score unless there is documented evidence the higher level criteria are substantially met. Each objective is scored independently.
5. Determine Overall Maturity. Use the lowest of the three objective scores as the overall maturity level, unless the organization formally documents and the AI Governance Committee approves an alternative scoring rule (e.g., weighted average based on risk exposure). The conservative default ensures a significant gap in any one area is not masked by strength in others.
6. Identify Gaps and Prioritize Remediation. For any objective scored below target, document specific gaps, supporting evidence, and a remediation plan with owners, timelines, and success criteria.
7. Document and Report. Complete the Maturity Assessment Summary and present findings to the AI Governance Committee and executive leadership. Retain records for audit and year-over-year trend analysis.

(See Implementation Guide, p. 56–57 for full definitions and evidence examples.)

Appendix D: AI Autonomy Levels

For scoring individual AI systems, not governance maturity.

The AI autonomy framework establishes a common language for responsibility and oversight, similar to autonomous vehicle levels.

(See Implementation Guide, p. 60 for full definitions and evidence examples.)

Risk-Tier Minimum Maturity

Risk tier is calculated in this tool from the Appendix F checklist (Start Here). Low and High minimum maturity levels are stated directly in the Implementation Guide; Medium and Critical are Cognome's interpolation between those stated bands and are not values stated by HSCC.

Source: HSCC Health Industry AI Cyber Governance Framework Implementation Guide, May 2026, pages 45, 56–60. Independent implementation tool, not an HSCC work product.

Extended Assessment — Source Material

Page citations only — text is not reproduced here, and there are no hyperlinks to the source PDF. These back the optional Extended Assessment's four domains (Ethics, Security, Resilience, Transparency), drawn from the body of the same Implementation Guide rather than a single numbered appendix.

Source: HSCC Health Industry AI Cyber Governance Framework Implementation Guide, May 2026, pages 18–42 (body). Independent implementation tool, not an HSCC work product. Level descriptions for these domains are Cognome-authored, not verbatim HSCC text.

How We Can Help

Cognome product mapping — not HSCC content. This tab maps Cognome's AI Sniffer and ExplainerAI products to the specific control areas, Core and Extended, where a genuine product connection exists. Many control areas are intentionally not covered here because no real product connection exists for them. Nothing here is required — you can complete the entire assessment, Core and/or Extended, without ever opening this tab.

Cognome offers two products relevant to what this assessment measures: AI Sniffer (AI discovery and inventory) and ExplainerAI (ongoing AI governance and risk monitoring). You can learn more about either before or after completing your assessment.

Questions? www.cognome.com · info@cognome.com

Product Capability Map

Cognome product mapping — not HSCC content. A static reference showing where Cognome's products directly apply, the same 17 control areas used in How We Can Help — independent of your assessment answers.

Questions? www.cognome.com · info@cognome.com