Education & Guidance (EG) - Infrastructure Domain

HAIAMM Assessment Questionnaire v3.5

Generated from cells/EG-Infrastructure-L*.cell.json. Do not edit by hand. Canonical model: HAIAMM-v3.5-Framing.md · Handbook: HAIAMM-v3.5-Handbook.md.

---

Practice: Education & Guidance (EG) Domain: Infrastructure Business Function: Governance Purpose: Give the people who provision and operate AI infrastructure the role-based AI security literacy and the practical guidance they need to make safe decisions without asking, in the Infrastructure domain. Scoring Model: Evidence + Outcome Metrics (see Scoring Methodology below)

---

Instructions

• Answer from current, implemented practice, not plans or aspirations.
• Each question has two components: Evidence (what you did) and Outcome Metrics (how well it worked).
• Levels are derived, never self-assigned. Record evidence and metric values; the level falls out of the scoring below.
• Silence is not a pass. A metric you cannot produce is left blank and counts as not met. Do not estimate.
• Answer progressively. Complete all Level 1 questions before Level 2.

Evidence grade

Record how each answer is known, not only what is claimed (v3.5 framing §6). A level claim is graded at its weakest field.

Grade	Meaning
E0	Asserted by a practitioner, unevidenced
E1	Asserted, with a link to a named artifact
E2	Emitted by a system as telemetry
E3	Machine-attested and independently checkable

---

Scoring Methodology

Tier	Score	Criteria
Fully Mature	1.0	Evidence complete + ≥3 outcome metrics meet targets
Implemented	0.67	Evidence complete + 2 outcome metrics meet targets
Partial	0.33	Evidence partially complete + <2 outcome metrics meet targets
Not Implemented	0.0	No substantive evidence of practice

Practice maturity level achieved = the highest level where all 3 questions score ≥ 0.67.

---

Maturity Level 1, Foundational

Objective: Give the people who provision and operate AI infrastructure the role-based AI security literacy and the practical guidance they need to make safe decisions without asking, in the Infrastructure domain.

Prerequisite cells: SM-Infrastructure-L1, PC-Infrastructure-L1

Question L1.1: Define roles and build role-based curricula

Q1.1: Does every in-scope role have its own curriculum under 90 minutes covering the AI failure modes that role actually encounters in the Infrastructure domain, delivered through the existing learning system with a 90-day deadline for new joiners?

Evidence Required:

• [ ] Identify the roles in scope, being platform and site-reliability engineers, cloud architects, ML platform engineers, and the security architects reviewing their baselines, and build a short curriculum per role rather than one course for everyone
• [ ] A single general course is the most common failure in this practice: it is long enough to be resented, general enough to be forgettable, and calibrated to no one
• [ ] Each curriculum covers the AI failure modes that role actually meets, which in this domain means unsanctioned model hosting, standing credentials on accelerator fleets, inference endpoints exposed beyond their intended boundary, and denial-of-wallet at the serving layer, together with the specific controls that role is expected to apply and the escalation path when something looks wrong
• [ ] Keep each curriculum under 90 minutes, because attention is the binding constraint and a curriculum nobody finishes teaches nothing
• [ ] Set a 90-day competence deadline for new joiners in scope, and deliver through the existing learning system so that completion and assessment records land where compliance evidence already lives

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L1.2: Assess competence rather than completion

Q1.2: Is competence assessed by applied scenario rather than recall, with a published pass threshold, an 80% or better pass rate per role, and item-level results reviewed by the curriculum owner so cohort-wide failures are treated as teaching defects? For Infrastructure, the assessor should be shown the platform-engineer curriculum and the wallet-drain exercise.

Evidence Required:

• [ ] Build an assessment per role that tests whether the learner can apply the material, not whether they sat through it
• [ ] Include a hands-on exercise where the learner exposes an inference endpoint, observes the absence of any availability signal under a wallet-drain load, and then applies per-tenant limits, because a scenario the learner works through is the only assessment format that distinguishes recognition from capability, and recognition is what multiple-choice tests measure
• [ ] Set a pass threshold, require a retake on failure, and record the pass rate per role as the practice's headline outcome metric
• [ ] Publish item-level results to the curriculum owner so that a question the whole cohort fails is treated as a teaching failure rather than a learner failure, which is the usual cause
• [ ] Re-assess at least annually and whenever the threat picture or the sanctioned toolset changes materially

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L1.3: Publish the guidance library where the work happens

Q1.3: Does a guidance library sit where the work happens with every item carrying an owner and a review date, are stale items withdrawn rather than retained, and is there a named question route with a response service level that is mined monthly for gaps? In Infrastructure, ask to see the platform-engineer curriculum and the wallet-drain exercise.

Evidence Required:

• [ ] Publish a guidance library covering hardened infrastructure-as-code modules for serving, registry and vector-store deployment, with egress allowlisting and no-standing-access identity patterns
• [ ] The binding constraint is reachability, not completeness: guidance that requires leaving the working context to find will be guessed around, so place it where the work is, in the repository for engineers, in the workflow tool for process owners, in the service catalogue for requesters
• [ ] Every guidance item names an owner and a review date, and stale guidance is withdrawn rather than left standing, because out-of-date guidance is worse than none and is trusted for longer
• [ ] Publish a named route for questions the library does not answer, staffed with a response service level, and mine those questions monthly as the highest-quality signal available about where the guidance is missing or wrong

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Level 1 Outcome Metrics

Metric	Baseline	Current	Target	Met?	Notes
In-scope practitioners passing the role-based AI security assessment	___	___	≥80% pass rate per role, with per-role results reported	☐
In-scope roles with a published curriculum matched to their actual failure modes	___	___	100% of identified roles	☐
New joiners in scope reaching baseline literacy within 90 days	___	___	≥90%	☐
Guidance library items carrying a named owner and a review date within the last 12 months	___	___	100%, with stale items withdrawn rather than retained	☐
Questions to the named route answered within the published service level	___	___	≥90% within 5 business days	☐

Where each number is read from:

• In-scope practitioners passing the role-based AI security assessment — Learning system assessment records; where no learning system is in use, a dated completion and assessment register held by the practice lead, recorded at E1
• In-scope roles with a published curriculum matched to their actual failure modes — Curriculum register
• New joiners in scope reaching baseline literacy within 90 days — Learning system completion records joined to HR start dates; where no learning system is in use, a dated completion and assessment register held by the practice lead, recorded at E1
• Guidance library items carrying a named owner and a review date within the last 12 months — Guidance library metadata
• Questions to the named route answered within the published service level — Question route ticket log

Level 1 30-second check (E0)

• ☐ Yes ☐ No — Does anyone in the people get AI-specific security training?
• ☐ Yes ☐ No — Can someone find guidance on a routine AI security question in under a minute?
• ☐ Yes ☐ No — Do you know who answers an AI security question when guidance runs out?

---

Maturity Level 2, Comprehensive

Objective: Scale Infrastructure AI security literacy through tier-calibrated depth, a champions network embedded in the teams, and exercises drawn from the organisation's own incidents.

Prerequisite cells: EG-Infrastructure-L1, SM-Infrastructure-L2, IM-Infrastructure-L1

Question L2.1: Calibrate curriculum depth to asset tier

Q2.1: Is curriculum depth calibrated to the SM L2 asset tier with enrolment derived automatically from the inventory, and are pass rates and currency reported per tier rather than in an aggregate that could conceal a weak Critical-tier cohort? Evidence this in the Infrastructure domain against the platform-engineer curriculum and the wallet-drain exercise.

Evidence Required:

• [ ] Extend the L1 curricula with tier-calibrated depth keyed to the SM L2 rubric
• [ ] Practitioners working on Critical- and High-tier assets take an extended curriculum with hands-on laboratory work and a higher pass threshold
• [ ] Those on Medium and Low take the baseline
• [ ] Publish the mapping from asset tier to required curriculum so that assignment is derived rather than negotiated, and wire enrolment to the asset inventory so that a practitioner joining a Critical-tier team is enrolled automatically rather than when someone remembers
• [ ] Set a currency requirement: Critical-tier practitioners re-assess annually, others every two years
• [ ] Report pass rates and currency by tier rather than in aggregate, because an organisation-wide 85% pass rate is consistent with the Critical-tier cohort being the weakest, and aggregate reporting actively conceals exactly the case that matters
• [ ] In this domain the extended curriculum has learners expose an inference endpoint, drive a wallet-drain load against it, and observe that every availability dashboard stays green throughout, because that observation changes how platform engineers think about limits far more effectively than a policy does

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L2.2: Build and resource a champions network

Q2.2: Does every team working on Critical-tier assets have a trained champion with explicitly allocated time agreed with the management chain, and do champions resolve at least 60% of routine questions without central escalation? For Infrastructure, the assessor should be shown the platform-engineer curriculum and the wallet-drain exercise.

Evidence Required:

• [ ] Establish a security champion inside each team working on Critical- and High-tier assets
• [ ] The champion is not a security professional and should not be treated as one: the role is to be the person who recognises when something needs the central function, to answer the routine questions locally, and to carry context the central team cannot have
• [ ] Resource the role explicitly with allocated time, typically half a day a week, agreed with the engineering or business management chain rather than assumed as goodwill, because an unresourced champion network decays within two quarters and its decay is invisible until it is total
• [ ] Give champions a deeper curriculum, a private channel to the central team, early access to threat and guidance updates, and visible recognition in performance processes
• [ ] Meet the network monthly and mine it for what the central function cannot see
• [ ] Infrastructure champions sit inside the platform and site-reliability teams, and their distinguishing value is knowing which workload just requested accelerators and why, which cost allocation reveals only a billing cycle later

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L2.3: Run exercises from the organisation's own incidents

Q2.3: Are at least four exercises per year built from the organisation's own incidents and near-misses, run first with champions and then by champions with their teams, with recurring failure modes fed back to threat assessment and guidance? In Infrastructure, ask to see the platform-engineer curriculum and the wallet-drain exercise.

Evidence Required:

• [ ] Convert incidents and near-misses from the issue-management practice into teaching material on a defined cadence, targeting one new exercise per quarter
• [ ] An exercise built from something that actually happened in this organisation carries an authority that no generic example achieves, and it converts the incident from a cost into an asset
• [ ] Anonymise where necessary but keep the specifics that make it recognisable, since the recognisable detail is the part that is remembered
• [ ] Run the exercises with the champions network first, then let champions run them with their teams, which both scales delivery and tests whether the champion can teach the material rather than only pass an assessment
• [ ] Track which failure modes recur across exercises and feed that back to the threat assessment and guidance practices as evidence of where understanding is genuinely weak
• [ ] Infrastructure exercises are built from real exposure incidents and shadow-workload discoveries, where the recognisable detail is usually a security group or namespace the team recognises

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Level 2 Outcome Metrics

Metric	Baseline	Current	Target	Met?	Notes
Practitioners on Critical- and High-tier assets holding a current extended-curriculum pass	___	___	≥90% of Critical-tier practitioners, ≥80% of High	☐
Teams working on Critical- and High-tier assets with a trained champion holding allocated time	___	___	100% of Critical-tier teams, ≥85% of High	☐
Assessment pass rate reported per tier rather than in aggregate	___	___	≥85% at every tier, with no tier below the organisation average by more than 5 points	☐
Exercises drawn from the organisation's own incidents	___	___	≥4 per year, each traced to a specific incident or near-miss	☐
Routine AI security questions resolved by a champion without central escalation	___	___	≥60%	☐

Where each number is read from:

• Practitioners on Critical- and High-tier assets holding a current extended-curriculum pass — Learning records joined to the asset inventory tier
• Teams working on Critical- and High-tier assets with a trained champion holding allocated time — Champion register with management-agreed time allocation
• Assessment pass rate reported per tier rather than in aggregate — Learning records segmented by tier
• Exercises drawn from the organisation's own incidents — Exercise register joined to the issue tracker
• Routine AI security questions resolved by a champion without central escalation — Question route ticket log with resolver field

Level 2 30-second check (E0)

• ☐ Yes ☐ No — Do people working on your riskiest AI get deeper training than everyone else?
• ☐ Yes ☐ No — Does each team working on high-risk AI have a named security champion?
• ☐ Yes ☐ No — Has any training exercise been built from an incident that actually happened here?

---

Maturity Level 3, Industry-Leading

Objective: Make Infrastructure AI security learning continuous and evidence-driven, measure whether it changes behaviour rather than knowledge, and contribute curricula back to the field.

Prerequisite cells: EG-Infrastructure-L2, IM-Infrastructure-L2, ML-Infrastructure-L2

Question L3.1: Drive curriculum and guidance from observed signal

Q3.1: Do curricula and guidance update from incident root causes, review findings, test failures and detections, with any failure mode appearing three times triggering a mandatory curriculum change within 30 days, and are guidance gaps detected from search misses and unanswered questions? Evidence this in the Infrastructure domain against the platform-engineer curriculum and the wallet-drain exercise.

Evidence Required:

• [ ] Close the loop between what the organisation observes and what it teaches
• [ ] Feed incident root causes, design and implementation review findings, security test failures and monitoring detections into a quarterly curriculum review, and treat any failure mode appearing three times as a mandatory curriculum change rather than a discussion item
• [ ] Instrument the guidance library so that search terms returning nothing, and the questions reaching the named route, are captured as gap signals, because what practitioners look for and fail to find is the highest-quality guidance-gap data available and it is free
• [ ] Publish a service level covering the interval from an observed recurring failure mode to updated guidance, targeting 30 days
• [ ] Retire material that the signal shows is no longer relevant, since a curriculum that only grows becomes one nobody completes
• [ ] In this domain the extended curriculum has learners expose an inference endpoint, drive a wallet-drain load against it, and observe that every availability dashboard stays green throughout, because that observation changes how platform engineers think about limits far more effectively than a policy does

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L3.2: Measure behaviour change rather than knowledge

Q3.2: Does the programme measure behaviour change in the environment using at least three downstream measures tracked pre and post training, reported alongside assessment results with attribution limits stated rather than a causal claim the data cannot carry? For Infrastructure, the assessor should be shown the platform-engineer curriculum and the wallet-drain exercise.

Evidence Required:

• [ ] Move the headline measure from assessment scores to behaviour in the environment
• [ ] Compare teams and cohorts before and after training on measures the other practices already produce: the rate of findings by category in implementation review, the reuse rate of sanctioned patterns, the proportion of designs arriving at review already conformant, the rate of self-reported near-misses, which should rise as psychological safety improves and is one of the few metrics where an increase is good news
• [ ] Accept that attribution is imperfect and say so, rather than claiming a causal link the data cannot carry
• [ ] The honest claim is that behaviour moved in the trained cohort and did not in the untrained one, over a stated period
• [ ] Report behaviour measures alongside assessment results so that a high pass rate with unchanged behaviour is visible as the failure it represents
• [ ] Infrastructure champions sit inside the platform and site-reliability teams, and their distinguishing value is knowing which workload just requested accelerators and why, which cost allocation reveals only a billing cycle later

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Question L3.3: Contribute curricula and measure capability in progression

Q3.3: Does the organisation contribute at least four externally accepted curriculum or exercise artifacts per year, and is AI security capability a recognised factor in performance and progression for every in-scope role? In Infrastructure, ask to see the platform-engineer curriculum and the wallet-drain exercise.

Evidence Required:

• [ ] Contribute at least four substantive artifacts per year to the field, weighted toward teaching material: role-based AI security curricula, applied exercise and laboratory scenarios, anonymised incident case studies that other organisations can teach from, and guidance patterns
• [ ] Good AI security teaching material is the field's scarcest resource, far scarcer than frameworks or tooling, which makes curriculum contribution unusually high-leverage and unusually likely to be adopted
• [ ] Work through OWASP education projects, sector bodies, professional associations and academic partnerships
• [ ] Separately, establish AI security capability as a recognised factor in performance and progression for in-scope roles, agreed with human resources, because a capability the organisation says matters but never recognises is one practitioners correctly deprioritise
• [ ] Infrastructure exercises are built from real exposure incidents and shadow-workload discoveries, where the recognisable detail is usually a security group or namespace the team recognises

Evidence grade for this question: ☐ E0 ☐ E1 ☐ E2 ☐ E3

Answer:

• ☐ Fully Mature (Evidence complete + ≥3 metrics meet targets)
• ☐ Implemented (Evidence complete + 2 metrics meet targets)
• ☐ Partial (Evidence partially complete + <2 metrics meet targets)
• ☐ Not Implemented (No evidence)

Evidence Location: _________________________________

Notes: ___________________________________________

Level 3 Outcome Metrics

Metric	Baseline	Current	Target	Met?	Notes
Recurring failure modes reaching updated guidance within the service level	___	___	≥90% within 30 days of the third occurrence	☐
Guidance gap signals captured from search misses and unanswered questions	___	___	captured continuously, with ≥80% triaged within 30 days	☐
Behaviour change measured in the environment for trained cohorts	___	___	≥3 behaviour measures tracked pre and post training, reported with attribution limits stated	☐
Externally accepted curriculum and exercise contributions per year	___	___	≥4 accepted or published	☐
In-scope roles with AI security capability recognised in performance and progression criteria	___	___	100% of in-scope roles, agreed with human resources	☐

Where each number is read from:

• Recurring failure modes reaching updated guidance within the service level — Guidance change log joined to the issue tracker
• Guidance gap signals captured from search misses and unanswered questions — Guidance search telemetry and question route log
• Behaviour change measured in the environment for trained cohorts — Downstream practice telemetry segmented by cohort
• Externally accepted curriculum and exercise contributions per year — Contribution log with acceptance references
• In-scope roles with AI security capability recognised in performance and progression criteria — Published role and progression criteria

Level 3 30-second check (E0)

• ☐ Yes ☐ No — Does your training change when an incident reveals a new failure mode?
• ☐ Yes ☐ No — Do you measure whether training changed behaviour, or only test scores?
• ☐ Yes ☐ No — Have you published AI security teaching material externally?

---

Summary Scorecard

Level	Q1	Q2	Q3	Level score	Weakest evidence grade	Achieved?
L1	___	___	___	___	___	☐
L2	___	___	___	___	___	☐
L3	___	___	___	___	___	☐

Education & Guidance (EG) maturity in the Infrastructure domain: ____________

---

Document Version: HAIAMM v3.5 (generated)