Checklist
The D.R.I.V.E. AI Readiness Framework
Five questions every business owner should answer before connecting AI to anything that matters.
D
Data Inventory
Do you know where your critical business data lives? Who has access? What's sensitive?
Action: List every system that stores customer, financial, or operational data. Note who has admin access to each.
R
Risk Assessment
What could go wrong if AI touches your most important workflows?
Action: For each system AI might connect to, write down the worst-case scenario if that data leaked or was processed incorrectly.
I
Integration Map
What would AI need to connect to? What data flows between your systems?
Action: Draw a simple diagram of your core tools and what data moves between them. Identify which connections an AI tool would need.
V
Vendor Vetting
How do you evaluate AI tools before adopting them?
Action: Before signing up for any AI tool, ask: Where is my data stored? Who can access it? Is the provider SOC 2 compliant? Can I delete my data? Does my data train their models?
E
Employee Readiness
Does your team know what AI tools are approved, what's off-limits, and what to do when they're unsure?
Action: Draft a 1-page AI acceptable use policy. Communicate it to your team this week.
Starter Kit
Four Engineered Prompts
Copy, paste into your AI of choice, and watch it do the work. Each prompt is interview-style — it asks you questions, then produces a deliverable.
The Internal Process Documenter
Turn tribal knowledge into a documented SOP.
You're a business process analyst. Interview me about [process name] by asking one question at a time. After each answer, summarize what you've learned so far. When we've covered the full process, produce a step-by-step SOP I can hand to a new employee.
The Vendor Security Screener
Know the right questions before you sign anything.
You're a technology risk advisor for a mid-size business. I'm evaluating [tool/vendor name] for [use case]. Ask me the 10 most important questions I should be asking the vendor about data security, privacy, and compliance before I sign anything. Then score my answers.
The AI Policy Drafter
Create your team's AI acceptable use policy in 15 minutes.
You're an IT policy specialist helping a small business create its first acceptable use policy for AI tools. Ask me about my business (industry, size, data sensitivity, current tools) one question at a time, then draft a 1-page AI acceptable use policy my team can follow starting next week.
The Tech Stack Auditor
Finally know what your business actually runs on.
You're a technology consultant for mid-market businesses. Interview me about every piece of software, hardware, and cloud service my business uses. Ask one category at a time (communication, finance, operations, customer-facing, etc.). When done, produce a tech stack inventory with: tool name, what it does, who uses it, what data it touches, and whether it has AI features enabled.
Security
AI Security — Quick Reference
Three rules and five threats to keep in mind any time AI touches your business.
The Defender's Three Rules
1
Never give AI more access than a new hire on Day 1.
Least privilege applies to machines too. Start with read-only access. Add permissions only when there's a documented business reason.
2
If you wouldn't email it to a stranger, don't paste it into a prompt.
Treat every AI interaction as semi-public. Customer names, financial data, health records, passwords, API keys — keep them out of prompts.
3
Automate the boring, protect the critical.
AI is brilliant at repetitive tasks. Keep humans in the loop for anything that touches money, health, legal, or reputation. Every AI output that matters should have a human review step.
Common Threats in Plain Language
| Threat | What It Means | What To Do |
|---|---|---|
| Shadow AI | Employees using AI tools that IT doesn't know about. | Create an approved tool list. Communicate it. |
| Data Leakage | Sensitive business data sent to AI providers and stored or used for training. | Check every tool's data retention and training policy before use. |
| Prompt Injection | Malicious input that tricks AI into doing something unintended. | Never let AI tools execute actions without human approval. |
| Credential Exposure | Accidentally pasting passwords, API keys, or tokens into AI chats. | Treat every AI prompt like a public post. |
| Model Hallucination | AI generating confident but incorrect information. | Always verify AI outputs against source data before acting. |
Next Step
Want an expert in your corner?
The toolkit above will get you started. If you want a full AI-readiness assessment for your business — security posture, tech-stack audit, integration roadmap — that's what we do. Black Door helps mid-market organizations adopt AI securely, from first idea through full lifecycle.
Book Your Free Pulse Check